Regulatory sandbox

In short

A regulatory sandbox is a scheme run by a regulator that lets companies test new products, such as AI tools, with real users for a limited time, under supervision and agreed safeguards, before full launch.

Also called: AI regulatory sandbox, Sandbox
Topic: Law, policy and the UK
Level: Some background helps
First described: The UK Financial Conduct Authority introduced its regulatory sandbox in a November 2015 report and opened it to applications in June 2016¹.

The idea is simple: rather than guess how rules apply to something new, the firm and the regulator try it out together on a small scale. The UK's Financial Conduct Authority (FCA) set out its sandbox in November 2015 and opened it for applications in June 2016, letting firms test products "in a live market environment, while ensuring that appropriate safeguards are in place"¹.

A sandbox is not a free pass. The FCA says plainly that its sandbox "is not regulatory exempt"; what it offers is tools such as restricted authorisation, individual guidance, rule waivers and "no enforcement action" letters². The Information Commissioner's Office runs its own free sandbox for products that use personal data in new ways³.

The EU AI Act makes AI sandboxes a legal requirement. Article 57 describes a "controlled framework" where providers can develop, train, validate and test AI systems for a limited time under a sandbox plan agreed with the regulator⁴. After the 2026 Digital Omnibus, Regulation (EU) 2026/1744, each EU country must have at least one running by 2 August 2027 rather than 2026, and the EU AI Office gets its own EU-level sandbox⁵⁴.

The UK is going further with its proposed AI Growth Lab. A 2025 call for evidence described a cross-economy sandbox that could grant "time-limited regulatory exemptions", with "red lines" such as consumer protections, safety provisions and fundamental rights that could not be modified⁶. An advisory version launched in June 2026, starting with legal services⁷, and the May 2026 King's Speech included a Regulating for Growth bill with sandbox powers⁸.

Example

Under the UK's advisory AI Growth Lab, the ICO is working with the Solicitors Regulation Authority, the Council for Licensed Conveyancers and the Legal Services Board to help firms using AI in legal services and conveyancing understand how the rules apply⁷.

Why it matters

Sandboxes are how regulators try to let new AI products reach people without waiting years for rules to catch up. They also decide which safeguards stay in place while that testing happens.

Questions people ask

Does a regulatory sandbox mean the law does not apply?

No. The FCA says its sandbox is not regulatory exempt; firms get supervision, guidance and sometimes specific waivers². The UK's proposed AI Growth Lab would allow some temporary exemptions, but with red lines covering consumer protection, safety and fundamental rights⁶.

What is an AI regulatory sandbox under the EU AI Act?

A controlled setting, run by a national authority, where a company can develop and test an AI system for a limited time under an agreed plan before selling it⁴. Every EU country must have at least one by 2 August 2027⁵.

What is the AI Growth Lab?

A UK government plan for a cross-economy AI sandbox that could temporarily modify some regulations for live trials⁶. An advisory version, starting with the legal sector, launched in June 2026⁷.

Related terms

Sources

Back to the glossary