Sandboxes and regulatory sandboxes: innovating safely in the age of the AI Act

In the world of artificial intelligence, innovation is no longer just a question of technology but of trust, transparency and accountability.
Every new algorithm, platform or AI model brings opportunities, but also risks: to security, of bias or of non-compliance.
To tackle them concretely without slowing progress, new tools are emerging in Europe, such as sandboxes and, above all, regulatory sandboxes. Two different concepts, united by the same philosophy: experimenting safely. Let’s take a closer look.

What is a sandbox?

In IT, a sandbox is an isolated environment, a digital laboratory where you can test code, models or applications without risking the main system: the technological version of “learning by trying”. Everything that happens stays confined within a controlled space.

The term comes from the world of play: the “sandbox” is the enclosed area where children can build and destroy without getting hurt.
The same applies in computing: it is a space where you can try, fail and improve — safely.

For companies, this means being able to experiment with new solutions without fear of bringing down a service or exposing sensitive data. The sandbox thus becomes a tool for technology governance: it lets you innovate methodically, controlling the effects of every change before it reaches production.

Setting up a company sandbox requires careful planning. It is essential to start from the objectives: which models do you want to test? Which risks do you want to analyse? And which data will you use? The choice of infrastructure is crucial. Many companies opt for isolated environments on containers or virtual machines, often integrated with cloud services that guarantee GDPR compliance and data security.

During testing, models are assessed on metrics of accuracy, robustness, fairness and explainability. Monitoring is continuous, and detailed logs make it possible to track every behaviour of the model. At the end of testing, a report documents the results and indicates any corrective actions, providing a solid starting point for integration into production. We sum it all up in the table below:

Regulatory sandboxes: experimentation under supervision

Today the sandbox concept goes beyond technology, extending to regulatory sandboxes: regulated environments where companies, universities and start-ups can test innovative solutions under the supervision of public authorities, with temporarily relaxed rules but always within a secure perimeter.

They originated in fintech (to test new forms of payment, blockchain or digital financial services), but are now taking on a central role in artificial intelligence too. The new European AI Act requires member states to create spaces for controlled experimentation in the development of high-risk AI systems.

Here companies will be able to validate their models, engage with the authorities on transparency, privacy and security, and help build a shared regulatory foundation.

In other words, regulatory sandboxes are a bridge between innovation and rules. They allow companies to grow within a clear regulatory framework, and institutions to better understand how to regulate constantly evolving technologies.

Two levels of protection for responsible innovation

Sandboxes and regulatory sandboxes work on two distinct but complementary levels:

• The technical sandbox protects systems, isolating code and data to prevent damage and vulnerabilities

• The regulatory sandbox protects innovation, allowing companies to experiment with new solutions without risking penalties or regulatory blocks.

Together, they form a model of safe and sustainable innovation: a path that lets you move fast without losing control.
For companies working with AI, this means being able to build experimentation into the compliance cycle, anticipating the requirements of the AI Act and building trust in their products.

The benefits of using sandboxes or regulatory sandboxes

Taking part in a sandbox or a regulatory sandbox is not just a security measure: it is a strategic choice, a paradigm shift in which security and regulation are no longer constraints. Companies that adopt this approach:

• Cut the time needed to validate new projects

• Increase the resilience of their systems

• Improve compliance with the new European AI rules

• Reduce incidents caused by misconfigurations or integration bugs

• Show a concrete commitment to ethical and transparent innovation.

Regulatory sandboxes in particular are a meeting point between technological experimentation and regulatory certainty, where companies can innovate while respecting the rules, and institutions can learn from the market to refine public policy.

In Italy, the first regulatory sandboxes are expected to be set up by 2025, coordinated by AgID (the Agency for Digital Italy) and the Department for Digital Transformation.
For companies, taking part will be an extraordinary opportunity to test advanced AI solutions in a controlled legal context and, at the same time, to help define the industry’s future standards.

At Neurally, we believe that real innovation does not come from improvisation, but from the ability to experiment with method and responsibility. Every day we work to help organisations turn the complexity of AI into concrete value, combining research, ethics and technology.

Want to bring artificial intelligence into your company safely and in compliance with the AI Act? At Neurally we support your company with advanced technologies.

Contact us now