AI Regulatory Sandbox under the EU AI Act: Why the Deadline Was Postponed to 2027

Anyone currently looking for a state-provided test environment for their artificial intelligence will find closed doors. Contrary to many outdated publications, the obligation to establish national AI regulatory sandboxes under Article 57 of the EU AI Act did not take effect on August 2, 2026. The European Union postponed this deadline by one year to August 2, 2027, through the amending Regulation (EU) 2026/1744, known as the Digital Omnibus on AI. For mid-sized companies, this means: The state is not providing a protected environment to legally test AI systems before they are placed on the market for the time being. Instead, the legal safeguarding of AI operations must be mapped immediately within the company's own system architecture.

Why the AI regulatory sandbox under the EU AI Act is delayed until 2027

The deadline extension to August 2, 2027, became legally binding through the Digital Omnibus on AI because member states could not implement the original requirement in time. Originally, Article 57 of Regulation (EU) 2024/1689 required every national authority to provide at least one operational regulatory sandbox by August 2026. This environment was intended to allow companies to test innovative AI systems under regulatory supervision before they hit the market. The amending regulation, which entered into force in July 2026, not only postponed the deadline but also announced a new Union-wide sandbox by the AI Office, which is supposed to grant prioritized access to small and medium-sized enterprises.

Who is responsible in Germany and where we currently stand

The Federal Network Agency (Bundesnetzagentur) is responsible for establishing the German sandbox according to the new AI Market Surveillance and Innovation Promotion Act (KI-MIG), but currently has no operational setup. The KI-MIG came into force at the end of July 2026 and makes the Federal Network Agency the central market surveillance authority. So far, there has only been a trilateral pilot project to simulate such a sandbox, which ended in March 2026. A real national sandbox usable by SMEs is still a long way off.

What the delay means for AI deployment in SMEs

Companies cannot pause the introduction of AI systems until August 2027; they must anchor the regulatory requirements of the EU AI Act within their own systems. Participation in a sandbox would not have exempted them from the material obligations of the regulation anyway. Anyone using AI today in core processes such as controlling, accounting, or pricing bears full responsibility for risk classification, transparency, and data protection. Waiting for state test environments is not a strategy. The solution lies in a system architecture that treats governance not as an afterthought, but as a foundation.

What a legally secured AI architecture looks like in practice

Legally compliant AI operations require built-in approval levels, seamless logging, and the processing of sensitive data via European endpoints. For example, if a system generates concrete recommendations for prices or reorders from scattered data across marketplaces, shops, and ERP systems, the AI must not act blindly. In practice, an approval-first approach proves effective: The system makes suggestions with justifications, and a human approves them. Nothing fires without approval.

This human oversight can be mapped via tiered autonomy levels (L0 to L4). Depending on the risk class of the decision, different approval processes apply. If a customer database merges traces from ERP, newsletters, and support and enriches them independently, every enrichment must be backed by a source. When the system calculates a churn risk and suggests a measure, a human approves it – and the system learns from the feedback. If a content system escalates complex patient inquiries to a human, the requirement for human oversight under the EU AI Act is directly anchored in the process.

Additionally, secure operations require an overarching knowledge layer that consolidates the memory of all tools used. If a system detects correlations across tool boundaries – such as a campaign spike leading to low inventory reach and endangering a top customer segment – this knowledge must be available as a versioned building block. The system reports strategy conflicts when knowledge and actions contradict each other. This form of white-spot detection and targeted inquiry via interview ensures that the AI does not act on the basis of outdated or contradictory premises.

GoBD compliance and traceability to the source

Every AI-generated metric and every automated booking must remain auditable down to the raw data source. When a document and accounting system reads receipts via OCR and AI vision and creates booking proposals, an orchestrator decides in three stages: automatically, for review, or manually. Every confirmed or corrected booking trains the system. The database remains GoBD-compliant right through to payment.

The same applies to business monitoring: If an AI-supported P&L statement allocates costs down to the individual invoice line, every metric must be traceable – from the source field via the mapping to the formula. A black box is legally impermissible. By using models via EU endpoints, such as Vertex AI or Azure, sensitive data remains within the defined framework. Governance, transparency, and risk management are therefore not tasks for a future state sandbox, but daily, automated reality in your own company.

The technical implementation of these requirements demands a modular principle where management configures processes and rules top-down. These guidelines roll out directly to the departments without translation losses. A central access point to all tools proactively reports what is important, takes instructions, and executes them within the defined regulatory framework. This ensures that the requirements of the EU AI Act do not just exist on paper, but are technically enforced in every single transaction.