Regulatory Sandbox Notification

The sandbox notification activates a derogation from full pre-market registration. Instead of submitting the complete Technical Documentation File, providers file a sandbox-specific plan outlining:

• The testing scope and duration
• The specific regulatory provisions being derogated
• The risk mitigation measures in place

This allows for iterative development without triggering the full conformity assessment process under the EU AI Act.

The notification is submitted to the National Competent Authority (NCA) of the member state where the sandbox operates. The NCA:

• Reviews the sandbox plan for completeness
• Issues written guidance on regulatory expectations
• Monitors testing activities for compliance with the agreed scope

This creates a supervised learning loop where regulators provide real-time feedback before market entry.

A sandbox notification is not an indefinite license. It specifies a fixed duration aligned with the testing phase. Key temporal constraints include:

• A defined start and end date for the sandbox period
• An exit plan detailing transition to full registration
• A requirement to notify the NCA of any substantial modification during testing

Upon expiration, the provider must either pursue full registration or cease operations.

The notification does not exempt providers from liability. The sandbox framework requires:

• Mandatory safeguards to protect fundamental rights
• Clear informed consent from sandbox participants
• A residual risk disclosure specific to the testing environment

Any serious incident occurring during the sandbox phase must be reported through the incident reporting linkage tied to the provisional registration ID.

A sandbox notification approved in one EU member state can facilitate cross-border testing under mutual recognition principles. This requires:

• Coordination between the home NCA and host member states
• Adherence to the harmonized standard for sandbox operations
• A unified Unique Registration ID for traceability across jurisdictions

This mechanism prevents regulatory fragmentation while allowing localized supervision.

The sandbox notification serves as a precursor to formal registration. The exit process mandates:

• Compilation of a complete Technical Documentation File incorporating sandbox learnings
• A finalized Declaration of Conformity based on validated performance data
• Submission to the EU AI Act Database for a permanent Unique Registration ID

The sandbox phase effectively acts as a pre-market authorization proving ground.

The centralized European Commission repository where providers and deployers must register high-risk AI systems before market placement. This database serves as the single source of truth for regulatory oversight, linking each system to its Unique Registration ID, conformity documentation, and incident reports. Registration is a legal prerequisite, not an optional step.

A change to an AI system's intended purpose or performance that triggers a new conformity assessment. This is not a minor update; it fundamentally alters the system's risk profile. Key triggers include:

• Expanding the target user base to vulnerable populations
• Modifying the core algorithmic logic
• Changing the operational context in ways that introduce new hazards Such a modification legally resets the registration clock.

The continuous, systematic process by which providers collect and analyze real-world performance data after registration. This is a dynamic obligation, requiring providers to feed operational insights back into their risk management files. The documented plan must be included in the Technical Documentation File and is critical for detecting emergent biases or safety issues that were not visible during sandbox testing.

The designated public authority within an EU member state responsible for supervising AI registration and enforcement. This is the primary entity to which a Regulatory Sandbox Notification is submitted. The NCA acts as the gatekeeper for sandbox participation, granting supervised testing privileges and providing regulatory guidance before formal market entry procedures begin.

The technical mechanism connecting a registered AI system's Unique Registration ID to a mandatory incident portal. If a serious incident or malfunction occurs—whether during sandbox testing or post-market operation—providers must file a report. This linkage ensures that the system's compliance history is dynamically updated, allowing regulators to correlate sandbox findings with real-world safety events.