Sandboxes are popping up all over the tech space. In just a few years, they’ve moved from niche experiments to central tools in major policy initiatives, from the EU AI act to a mention in the United State’s newly released AI Action Plan.
At the Datasphere Initiative, we’ve spent years exploring how sandboxes are designed, run, and evaluated. There’s one question we hear again and again: do they actually make a difference?
The evidence shows that they can — but impact depends on the goals of the sandbox, the regulators who design it, and the participants who engage in it. In this article, we look at real-world examples across fintech, privacy, and health to see how regulatory sandboxes are shaping innovation, compliance, and policymaking.
Unsure what a sandbox is? See our 5-min intro to Sandboxes
Fintech sandboxes: reducing costs, increasing trust, and unlocking capital
When many hear the word “sandbox”, they think of the financial sector. That’s largely due to the UK Financial Conduct Authority (FCA)’s leadership in launching regulatory sandboxes since 2016.
Reading one of their many public reports on their sandbox outcomes one can derive a range of examples of impact (as well as lessons learnt) and how these sandboxes are helping innovative business models in the financial sector.
For example, the FCA’s regulatory sandbox lessons learned report shows that access to the regulatory expertise the sandbox offered had reduced the time and cost of getting innovative ideas to market. The same report highlights feedback from participating firms, with one noting that continuous dialogue with the FCA during the sandbox process enabled them to develop more rigorous policies and compliance procedures than they otherwise would have. This regulatory certainty is also a key consideration for investors, who are more likely to back firms they see as compliant and well-prepared.
These findings are reinforced by the 2021 BIS study Regulatory Sandboxes and Fintech Funding: Evidence from the UK, which showed that firms in the sandbox raised 15% more capital and had a 50% higher probability of securing funding. Participation also had positive effects on business survival rates and patenting activity, clear indicators of how regulatory sandboxes can help emerging businesses scale.
Sandboxes and regulatory clarity
According to the Norwegian Data Protection Authority, the idea of their regulatory sandbox is to provide exploratory, dialogue-based guidance to selected projects in exchange for full openness about the assessments that are made. The sandbox builds up a base of practical examples in a field where both the technology and the law are complicated and relatively new.
The sandbox on artificial intelligence and privacy was launched in 2020 as part of the National Strategy for Artificial Intelligence.It has led to businesses ensuring that solutions not only complied with data protection laws but also set a precedent for privacy-friendly innovations in the security industry. Following these successes, the Norwegian Data Protection Authority confirmed the sandbox would become a permanent program, exemplifying how sandbox participation can lead to the successful integration of privacy principles in technological advancements.
Shaping policy through privacy-enhancing technology sandboxes
As a global technology and innovation hub, Singapore wanted to get ahead with adopting privacy enhancing technologies (PETs). But many companies weren’t convinced and felt their use could put their compliance with data protection laws at risk.
To address this, Singapore’s Infocomm Media Development Authority (IMDA) launched the Data Privacy and Privacy-Enhancing Technologies (PETs) sandbox. The sandbox was designed to help companies explore together with the regulators, whether PETs could enable secure, privacy-respecting data collaboration in domains where traditional data sharing is often constrained by regulatory or ethical barriers.
Several participants developed proof-of-concept solutions that applied advanced privacy-preserving technologies to real-world data challenges across different sectors.
Beyond technical findings, the sandbox revealed the importance of early alignment between legal teams, data stewards, and technology developers. It also served as a trust-building platform, allowing participants to articulate shared risks, expectations, and accountability structures.
Health sandboxes: securing telemedicine and patient safety
In 2023, Indonesia’s Ministry of Health launched a regulatory sandbox for digital health and telemedicine to support the growth of the health innovation ecosystem.
Much like the regulatory sandbox model applied to Fintech, the sandbox created a structured testing mechanism for digital health innovation led by the Ministry of Health in collaboration with experts from both the public and private sector.
The sandbox assessed the reliability of new business processes and models, while also encouraging service providers and regulators to jointly explore innovative business models and analyze potential risks to society. This collaborative approach allowed the development of regulations that actively support the implementation of these new technologies in the health sector.
The test process generated learnings that resulted in solid recommendations for the development of evidence-based regulations in the health sector and reportedly supported hospitals to strengthen consumer protection and patient safety, including the safeguarding personal data of service users.
Sharing lessons from global sandbox experimentation
These examples just skim the surface of the case studies and research the Datasphere Initiative is developing on sandboxes and their impact in supporting innovation, boosting AI adoption and facilitating evidence based policymaking.
One ongoing challenge is how to report on sandboxes and share learnings that are sometimes sensitive and often experimental. Through the Global Sandboxes Forum and our training programs on how to design, participate and implement sandboxes, we aim to build this field of knowledge: showcasing what worked and providing a safe space to discuss what didn’t.
