Article 58 — Conditions for the establishment and operation of AI regulatory sandboxes (EU AI Act)

Article 58 of Regulation (EU) 2024/1689 — Conditions for the establishment and operation of AI regulatory sandboxes. Official text, practical interpretation, key obligations and compliance implications.

Official Text Summary

Article 58 of Regulation (EU) 2024/1689 establishes the conditions under which AI regulatory sandboxes must be created and operated. It places a direct obligation on Member States to ensure that at least one sandbox is established at national level no later than 2 August 2026. The European Data Protection Supervisor must establish a sandbox for Union institutions, bodies, offices, and agencies falling within the scope of the Regulation.

The article sets out that sandboxes must operate on the basis of a specific plan agreed between the participant and the competent authority. Participation is time-limited, as a general rule to twelve months, extendable by a further twelve months. Selection of participants must follow transparent and fair criteria; SMEs and startups are to be given priority where they meet the eligibility conditions.

Competent authorities must provide guidance, supervision, and appropriate support to participants throughout the sandbox period. Participants remain subject to all applicable Union and national law during sandbox activities, including obligations regarding safety, fundamental rights, and data protection. Personal data processed during sandbox activities must be handled in accordance with Regulation (EU) 2016/679 (GDPR), Regulation (EU) 2018/1725, and Directive (EU) 2016/680, and must not be used for any purpose other than those set out in the sandbox plan without explicit authorisation.

At the conclusion of the sandbox, participants must submit a final report. Competent authorities may publish a summary of results, contributing to the broader evidence base for AI regulation across the Union.

What This Means in Practice

Article 58 has practical consequences for a wide range of stakeholders — national regulators, innovators, and legal teams alike.

For national competent authorities, the article creates a binding obligation: at least one functional sandbox must exist in each Member State by 2 August 2026. Regulators that have not yet launched sandbox programmes must accelerate governance design, resource allocation, and inter-agency coordination (particularly with data protection authorities). Cross-border sandboxes, which Article 58 explicitly permits, require bilateral or multilateral coordination protocols between national authorities.

For providers and prospective providers, the sandbox offers a structured path to test high-risk or novel AI systems under regulatory supervision before full market deployment. Concretely, a startup developing a predictive risk-scoring system for credit decisions — a likely high-risk system under Annex III — could apply to participate in a national sandbox to assess conformity and refine technical documentation before the high-risk rules become fully applicable.

For legal and compliance teams, Article 58 does not create a compliance holiday. All substantive obligations under other applicable law remain in force during sandbox participation. Data protection impact assessments are still required where relevant; fundamental rights safeguards cannot be waived. What the sandbox provides is structured regulatory dialogue, early supervisory feedback, and a degree of procedural flexibility — not a derogation from substantive rules.

Organisations considering sandbox participation should engage early with their national competent authority, prepare a detailed sandbox plan covering objectives, methodology, data governance, and exit criteria, and document all decisions and outcomes thoroughly in anticipation of the final report obligation.

Key Obligations

• Member States must establish at least one AI regulatory sandbox at national level no later than 2 August 2026; the European Data Protection Supervisor must establish a sandbox for Union institutions, bodies, offices, and agencies.
• Sandbox participation must be governed by a written plan agreed between the participant and the competent authority, specifying the AI system to be developed or tested, the activities to be carried out, the objectives, the duration, and the supervisory arrangements.
• Duration is capped at twelve months, extendable once by a further twelve months, for a maximum total of twenty-four months; extensions must be justified and approved by the competent authority.
• Selection criteria must be transparent and non-discriminatory; SMEs and startups meeting eligibility conditions must be prioritised, reflecting the pro-innovation policy intent of Title VI.
• All applicable Union and national law continues to apply throughout the sandbox period, including GDPR, sector-specific legislation, and safety requirements; personal data may only be processed for the purposes set out in the sandbox plan.
• A final report must be submitted at the end of the sandbox period, documenting activities, results, lessons learned, and measures taken or planned to ensure compliance prior to market placement or service deployment.

Relationship to Other Articles

Article 58 sits within Title VI (Measures in Support of Innovation) and must be read alongside the surrounding provisions of that title. Article 57 defines what an AI regulatory sandbox is and establishes the general framework obligation, forming the foundation on which Article 58 builds its operational conditions. Article 59 addresses the specific regime applicable to processing of personal data within sandboxes, providing the data protection interface that Article 58 requires but does not itself detail. Article 60 extends analogous testing provisions to real-world conditions outside sandboxes for certain high-risk AI systems.

Beyond Title VI, Article 58 connects to the obligations of high-risk AI system providers under Title III, since sandbox participation is most relevant precisely for systems that may fall under Annex III classifications. It also interacts with Article 74 (market surveillance) and Article 70 (confidentiality), as competent authorities exercise supervisory powers within the sandbox and handle commercially sensitive information shared by participants.

Compliance Timeline

The EU AI Act entered into force on 1 August 2024, triggering a phased application schedule. The key dates relevant to Article 58 are:

• 1 August 2024 — Regulation enters into force; all provisions begin their countdown to application.
• 2 February 2025 — Prohibitions on unacceptable-risk AI practices (Article 5) become applicable.
• 2 August 2025 — GPAI model obligations (Title VIII) and governance provisions become applicable.
• 2 August 2026 — Article 58 becomes fully applicable: Member States must have established at least one operational national AI regulatory sandbox by this date. The European Data Protection Supervisor's sandbox for Union institutions must also be operational.
• 2 December 2026 / 2 August 2027 — High-risk AI system obligations under Annex III (and Annex I for embedded systems) become fully applicable — the period for which sandbox participation is most strategically relevant for providers developing high-risk systems.

Organisations and national authorities should treat 2 August 2026 as a hard deadline for sandbox readiness, not a target to plan toward at the last moment.