Summary

  • On 9 September, the European Commission proposed both a European Innovation Act and a separate Council Recommendation on common principles for regulatory sandboxes. Neither has been adopted.
  • The Innovation Act memorandum says sandbox definitions and principles were removed from that proposed Regulation and moved to the Recommendation proposal. The legal containers are not equivalent: under Article 288 TFEU, recommendations have no binding force.
  • The sandbox proposal expressly says participation is neither a permanent exemption from regulation nor an alternative route to regulatory authorisation. A derogation from Union secondary law must already be permitted by an applicable Union act.
  • Cross-border testing would still need an agreement allocating the roles of competent authorities and identifying applicable legal and administrative arrangements. The useful evidence is therefore an authority chain, not a “sandbox” label.

Two documents left Brussels together

The European Commission presented its innovation package on 9 September. The public shorthand is tempting: Europe wants more experimentation, so the European Innovation Act must be creating a broad route around slow regulation. The documents say something narrower.

COM(2026) 567 final is a proposal for a Regulation establishing measures for the Union innovation ecosystem. It would proceed through the ordinary legislative procedure. Its own explanatory memorandum records a material scope change: definitions and principles for regulatory sandboxes were removed from the Act and moved to a proposal for a Council Recommendation.

That second document, COM(2026) 568 final, is based on Article 292 in conjunction with Article 173(3) TFEU. It is still a Commission proposal; the Council has not adopted it. Even if adopted, its form matters. Article 288 TFEU says a Regulation is binding in its entirety and directly applicable in every Member State, while recommendations have no binding force.

The Commission’s explanatory text is unusually direct about the consequence. The initiative does not extend Union regulatory power or impose binding commitments on Member States. National governments would decide how to implement it, taking account of Union legislation and national circumstances. Common language may coordinate practice. It is not common permission.

A sandbox contains a test, not a legal holiday

The Recommendation proposal defines a regulatory sandbox as a structured framework in which participants experiment with an innovative solution for a limited time, in a controlled environment, under one or more competent authorities, producing evidence-based regulatory learning. Each part narrows the claim. There is an admitted participant, a defined experiment, a clock, a supervisor and an intended learning output.

The proposal then closes the most marketable misreading. Participation should not be considered a permanent exemption from regulatory requirements or an alternative pathway to regulatory authorisations in the Union. Completion may help an authority, standards body or conformity assessor understand a product. It does not turn an exit report into a licence.

This distinction is also practical. The proposed conditions include the experiment’s objective and scope, the tests that may be performed, maximum duration or geographic limits, risk assessment, safeguards, evaluation, serious-incident reporting, and rules for extension, modification, suspension or termination. Participation conditions would also address liability under applicable law, intellectual property, data protection, privacy, confidential information, monitoring and exit. A venture may obtain supervised room to learn while remaining unable to sell, deploy or scale the result without the approvals that ordinary law requires.

Derogation authority has to come from somewhere else

The most important sentence for operators is not the definition. It is the proposed rule for exceptions. Where national law contemplates a derogation, the derogation should be explicit, clearly defined and justified. Where the rule being displaced is Union secondary law, the applicable Union act must already provide the possibility.

That creates a traceable sequence. First identify the obligation. Then identify the legal provision that permits deviation. Then identify the competent authority and the bounded decision it took. Only after those steps does the sandbox plan describe what the participant may actually do. A recommendation about good sandbox design cannot manufacture a derogation that the underlying law withholds.

The proposal itself recognizes that several sectors already have their own arrangements. The AI Act, the Interoperable Europe Act, the Cyber Resilience Act and the Net-Zero Industry Act contain sector-specific provisions or duties. Point 2(b) of the new proposal tells Member States to apply Union provisions already in force where relevant. The common principles do not flatten those legal regimes into one pan-European safe harbour.

Crossing a border adds an agreement, not automatic recognition

The proposed Recommendation encourages cross-border sandboxes, but it does not say that admission by one authority automatically binds another. Instead, competent authorities should conclude an agreement. At minimum it should state the conditions for experimentation, allocate the roles and responsibilities of authorities from different Member States, and identify the legal provisions and administrative arrangements that apply.

That is a governance map. Who admits the participant? Who supervises data use or product safety? Who receives an incident report? Who may suspend the experiment? Who terminates it? Which law supplies any derogation? A joint press release cannot answer those questions, and the word “cross-border” cannot make them disappear.

Access also remains bounded. Requests should be assessed transparently and without discrimination. Yet, subject to international obligations and objective grounds, Member States could restrict participation to Union citizens and Union-established entities, prioritise Union-established smaller innovators, or require relevant research and development activity in the Union. Open procedure and universal eligibility are not synonyms.

The proposal’s strongest output is a record of learning

The design ends with evidence. Member States should collect and analyse results, consider whether national regulation should change, provide a participant with an exit report on request, and publish information about establishment and outcomes while protecting secrets and security interests. Those are useful disciplines. They can show whether an experiment informed a conformity assessment, standard, market-approval process or later rule.

They also reveal what the proposal does not create. There is no single EU application desk in this text, no general list of activities made lawful, no universal passport for a successful participant and no guarantee that an exit report produces approval. The proposed Recommendation is an interoperability layer for public administration: shared concepts and minimum questions that separate authorities may use.

A public “sandbox authority receipt” would make that separation visible. It could identify the source law, derogation clause, competent authority, participant, admitted activity, duration, geography, safeguards, liability rule, suspension and exit conditions, cross-border agreement, and outcome report. This is an editorial proposal, not an existing requirement. Its purpose would be to prevent a policy label from carrying more authority than the underlying instruments.

Sources