The effectiveness of the Cloud and AI Development Act regarding data centres

 

Annelieke Mooij, Assistant Professor, Tilburg Law School

Photo: Facebook Clonee (Ireland) data centre

Photo credit: Thomas Nugent, via Wikimedia commons

 

1.    Introduction

The debate about sovereignty and specifically digital sovereignty is fierce. Member States, struggle to achieve digital sovereignty which impacts the continuity and safety of the digital services. To speed up the realization of the sovereign cloud the Commission has proposed a new act the Cloud and AI Development Act (CADA). The act covers three important facets: AI, Cloud and Data centres. This contribution is limited to the proposed rules regarding data centres and analyze their effectiveness. The proposed Regulation should not be considered a stand-alone Regulation but rather forms part of the European Union’s broader strategy to strengthen digital sovereignty. The EU aims to reduce dependence on foreign digital service providers and expand Europe’s cloud and data centre capacity. At its core, the proposed Regulation seeks to create the conditions necessary for a sovereign European cloud ecosystem. A system that can support economic growth, innovation, and public-sector resilience.

The pursuit of cloud sovereignty, however, depends on more than software, governance frameworks, or industrial policy. Cloud services, AI and other digital services ultimately rely on physical infrastructure. Data centres provide storage, computing power, and connectivity upon which cloud services and AI applications depend. Without sufficient data centre capacity, ambitions for European technological autonomy cannot be achieved. The Commission aims to stimulate the increase of the data centre capacity through the CADA. The CADA therefore introduces a regulatory framework aimed at accelerating the development of data centres.  The Commission aims for the EU capacity to have tripled by 2030, and by 2035, all critical infrastructure will be hosted in EU data centres. These objectives are ambitious but there are good reasons for the Commission to emphasize digital sovereignty.

2. Why Digital Sovereignty Is Necessary & Difficult

Before delving into the CADA, it is important to understand why digital sovereignty is important to the EU. Cloud computing provides its users with remote access to data storage, software, and computing resources hosted on external servers. By outsourcing storage and computing functions to the cloud, organizations can reduce the need to maintain their own IT infrastructure. Whilst benefiting from greater scalability and operational flexibility. Public authorities increasingly rely on cloud services for precisely these reasons.

At present, however, the European cloud market is heavily concentrated. American providers dominate the sector, with Amazon Web Services and Microsoft accounting for approximately 75% of the European market. The largest European provider holds only a marginal 2% share. This concentration creates a structural dependency on foreign companies for critical digital infrastructure. One of the principal objectives of CADA is therefore to reduce this dependency and strengthen Europe’s technological autonomy.

The strategic rationale for reducing dependence on non-European providers extends beyond concerns about market concentration. Control over cloud infrastructure increasingly translates into geopolitical influence. A recent example is that of the latest AI-model created by Anthropic. The US government prohibited Anthropic from releasing its newest and most powerful model to its European customers. The official reason was due to considered possibilities of jailbreaks. The possibility of this happening was strongly denied by Anthropic. The EU Commission, however, stressed the possible negative impact on EU cybersecurity and cyberdefense.  It has been illustrative of how the US can cut-off new technologies to the EU, without serious repercussions. These incidents have not remained limited to simply limiting foreign accessibility but also to demonstrate power to individuals and institutions. Illustrative of this is the disruption of e-mail communications involving the International Criminal Court. The ICC’s email was cut-off after President Trump disagreed with actions from its main prosecutor. The case illustrated how political pressure exerted through private technology providers, without court permission, may affect the continuity of essential digital services. This dependence can be dangerous for Europe as it includes technology that is necessary for military purposes.

To achieve the desired increased EU cloud and AI capacity, physical infrastructure (or hardware) is necessary. Cloud and AI systems require data centres to operate on. The CADA therefore introduces a framework to create the necessary infrastructure.

3. The CADA’s rules on achieving data centre capacity.  

3.1. Specific Objectives

The CADA seeks to establish what the Commission describes as a coordinated and integrated ecosystem approach to cloud computing and artificial intelligence. According to the Commission, divergent national approaches to data centre permitting barriers to the efficient functioning of the internal market and hinder the development of a competitive European cloud ecosystem.

Against this background, the Regulation aims to create the conditions necessary for the large-scale deployment of cloud and AI infrastructure throughout the Union. In addition to reducing regulatory fragmentation, the proposal seeks to strengthen technological sovereignty, improve operational resilience, and support public-order objectives. The Commission further presents the Regulation as an instrument for promoting innovation and sustainability in Europe's digital infrastructure.

Regarding data centres specifically, the proposal seeks to address perceived shortages in computing and storage capacity through a combination of harmonisation measures and accelerated deployment procedures. This should lead to a specific result namely; triple the data centre capacity by 2030 and have sufficient EU data centre capacity for critical infrastructure by 2035.

3.2 Role of the Commission

The responsibility for achieving the operational objectives established by the CADA rests primarily with the European Commission. To achieve its goals, the proposal relies heavily on existing and future funding programmes intended to stimulate the development of cloud and AI technologies. These programmes seek, among other things, to improve the efficiency with which computing resources are used.

Particular emphasis is placed on technological innovation. High Performance Computing (HPC), for example, may increase the amount of computing output generated from a given level of infrastructure. More efficient use of computing resources can reduce the relative amount of storage and processing capacity required to achieve a particular outcome. Nevertheless, such efficiency gains do not eliminate the need for physical infrastructure. High-performance computing still depends on data centres and therefore remains subject to the same underlying constraints relating to energy, water, and spatial planning.

The effectiveness of this strategy consequently depends largely on the success of research and innovation projects supported through European funding programmes. There is ample reason to believe these strategies can be successful, economic literature has long recognised that research subsidies can stimulate innovation by reducing investment costs and encouraging experimentation. The chance of success, however, depends on the knowledge of the subsidy provider. In the past EU subsidies have proven a successful strategy. It is to be expected that the aim of development through subsidies will be successful again.

3.3. Data centre Acceleration Zones

To facilitate the expansion of data centre capacity, the CADA introduces so-called Data Centre Acceleration Areas (article 10). Each Member State is required to designate at least one such area for the accelerated development of data centre infrastructure, within six months of the Regulation entering into force.

When identifying acceleration areas, Member States must consider existing and future infrastructure capacity, energy availability, and broader sustainability considerations. The proposal further requires national authorities responsible for spatial planning to consider future data centre development and the necessary supporting infrastructure in those zones.

A developer wishing to develop a data centre in such an acceleration zone, will have the right to be assisted by a single point of information (article 11). This single point of information can assist the developer by sharing and coordinating the necessary permits and environmental and habitat assessments. The latter will be a sped-up procedure in accordance with Regulation 2026/XXXX on speeding-up environmental assessments. This Regulation was proposed in December 2025 with the aim to simplify environmental assessments. These rules aim to ensure that new projects have completed the permitting procedures within a year. The latter is the maximum that permitting procedures are allowed to last.

Taken together, these measures are intended to reduce administrative burdens and increase legal certainty for developers. The underlying assumption is that lengthy and fragmented permitting procedures constitute a significant obstacle to data centre deployment. To the extent that regulatory complexity delays investment, the proposed measures may indeed facilitate development. It is, however, questionable whether regulatory procedures are the primary challenge. The extent to which these objectives can be achieved in practice is, however, less clear. The realization of data centres come with significant challenges. When in operation, data centres become increasingly hot. With temperatures rising to 70 degrees in an hour. To continue their operations data centres need to cool. The cooling process requires high amounts of energy and clean water. E.g. data centres in the Netherlands constituted for approximately 5% of electricity demand in 2024. Recently a data centre by Microsoft made headlines that it uses 1% of the total national energy in the Netherlands. This whilst on the other hand there are significant shortages in energy supply for new housing and net congestion is increasing. Thereby creating serious debates on whether power should be diverted to data centres. On an EU level the targets for energy consumption are not yet met. The reduction target is approximately 18% away from its 2030 target. In 2024 the EU was 17% from renewable energy targets for 2030. In 2024 data centres consumed roughly 3% of the EU’s energy. Tripling this number and increasing it further till there is sufficient capacity for digital sovereignty creates a significant challenge.

These concerns are not limited to energy, the Netherlands is estimated to have a drinking water shortage by 2030. This whilst the data centres require approximately 3.7 million tonnes of drinking water per year, roughly 0.3% of Dutch tap water consumption, in the EU it is estimated to total 5.747.764.000 (nearly 6 billion liters). The CADA does not provide solutions to these underlying constraints. Instead, it requires Member States to create data centre acceleration zones and take infrastructure into account when designating these zones. Within these zones permitting procedures must be conducted within 12 months. While this may improve planning and coordination, it does not generate additional electricity capacity, alleviate network congestion, or increase the availability of water resources. The permits may become a hollow factor. A good example of the potential irony is that of the data centre in the Netherlands. The data centre had the required planning permits but were put on a waiting list for their energy connection.

The requirements created by the CADA may seem with a large margin of discretion as it uses language such as “take into consideration”. This language does not exert pressure on Member States. The CADA, however, also includes the earlier mentioned hard objective to triple the data centre capacity by 2030. Here lies another difficulty with the proposed framework. The CADA does not introduce a division key for how much capacity must be realized by each individual Member State. There are, however, big gaps between Member States in the current capacity.

Hungary for example only has 7.3MW of total capacity whereas Germany has 2.6GW of IT power. Arguably the capacity can be divided equally over all Member States, using the GDP as percentage divider. GDP is an indication of how much IT power is consumed in the economy. Generally, the higher the GDP the higher the IT consumption is. There is, however, little data on the demand for critical infrastructure in the EU. This is likely to change as article 15 of the CADA charges the EU Commission with obtaining that data. From an environmental perspective it is, however, ineffective to simply divide along GDP. Countries with cold climates and large coastal areas can build new more efficient data centres as the can use ocean water or outside air to cool. A submerged data centre on the coast is more sustainable than a data centre in a desert. In theory, the incentive to build data centre capacity by these countries is profit. Countries with favorable circumstances can build capacity cheaper than others and sell the capacity for profit. This theory of absolute advantage seems undermined by the next section of the CADA; the introduction of the European Cloud Federation.

 

4. The European Cloud Federation

In addition to measures aimed at expanding data centre capacity, in articles 34 and 35 the CADA introduces the proposed EuroCloud Federation. Participation in the Federation is voluntary and open to EU institutions and public-sector bodies. The purpose of the Federation is to facilitate the sharing of public cloud and data centre resources among participating members.

The underlying rationale is straightforward. Public authorities do not always utilize their available computing resources at full capacity. By enabling participating organisations to share infrastructure, the Federation seeks to improve the utilisation of existing resources and reduce unnecessary duplication of investments. In principle, such an approach may contribute to a more efficient use of public infrastructure.

To facilitate this objective, the proposal establishes a framework governing access to and sharing of infrastructure within the Federation. A notable feature of this framework is the limitation placed on financial compensation. Under Article 35(5), members providing infrastructure may recover their costs but are not permitted to generate profit from sharing their capacity with other participants.

From the perspective of short-term efficiency, this approach is understandable. Allowing access at cost price reduces barriers for participating entities and may encourage greater use of available infrastructure. The arrangement may therefore improve the allocation of existing capacity within the public sector.

The longer-term effects are less clear. The development of additional infrastructure requires significant investment and involves financial and operational risks. Where providers are unable to obtain any return beyond cost recovery, but cost recovery is not guaranteed, the incentive to create surplus capacity that can later be shared within the Federation may be reduced. Public entities may conclude that it is more attractive to rely on the capacity of other participants than to invest in additional infrastructure themselves.

 

5. Conclusion: a failed attempt?

The aim of the CADA is to increase the total EU data centre capacity. The CADA, however, does not create a division key. This is a fundamental gap within the regulation, it is too easy to state that all Member States should triple their data centre capacity equally. At present there are high differences in capacity between the different Member States.

The proposed Cloud and AI Development Act represents an ambitious attempt to strengthen European digital sovereignty through the expansion of cloud and AI infrastructure. Central to this ambition is the objective of significantly increasing data centre capacity across the European Union. To facilitate this development, the Regulation requires Member States to designate acceleration areas, develop national cloud and AI strategies, and participate in a broader framework intended to support the growth of sovereign digital infrastructure.

The proposal therefore sends a clear political signal. Data centres are no longer regarded as purely commercial infrastructure but as strategic assets that are essential for economic competitiveness, public administration, and technological autonomy. In that respect, the CADA forms part of a broader shift in European policy towards reducing strategic dependencies in critical digital technologies. Nevertheless, the CADA does not solve issues regarding natural resources. The introduction of the EU Cloud Federation furthermore has the potential to undermine a sustainable and economically efficient capacity division.  

 

Revolutionizing Law? Exploring experimental regulations and artificial intelligence Sandboxes in the AI Act

 

 

Davide Rauhe

 

Photo credit: Chief Photographer, MoD

 

Executive Summary

 

This blog post explores the emergence of experimental regulations and policies with focus on its gained prominence within the European Union in the recent years.

 

As emerging technologies, especially in the field of artificial intelligence (AI), continue to shape our societies, there is a growing need for flexible regulatory approaches that can adapt to rapidly evolving technological landscapes. Experimental regulation and Regulatory sandboxes have gained popularity as a potential solution to foster innovation while ensuring the maintenance of minimum standards in fundamental rights and ethical questions.

 

Therefore, special focus shall be laid upon the significance of regulatory sandboxes and their implementation in the new AI Act on EU-level. This post analyzes the significance of these new law-making methods and answers the question whether or not lawmakers can benefit from them.

 

I. Introduction

 

Regulation and legislation can have strong impacts on the economy and society of a country. However, both are still regarded as a merely bureaucratic action, despite its influence on economic and social development. Indeed, legislation is by some even considered a major force in enabling capitalistic structures, assuming that law itself can create capital by allocating resources either by allowing, shaping or even prohibiting certain economic behaviors.^[1] This is particularly the case when sudden and impactful technological improvements are made as with them usually a shift in political and economic power is recorded as well – its design and scope is therefore of even greater importance.^[2] This applies especially to the European Union as legislator, because the EU as a regulative body influences other jurisdictions all over the world – a process often describes as the so-called Brussels-effect.^[3]

 

With the emergence of increasingly complex technological and innovative economic models in various economic sectors such as finance, commerce and others, there has been a greater demand for more diverse and innovative regulatory approaches in various sectors. However, the protection of fundamental rights standards takes a key role in this discussion as well as the age of “information” or “surveillance” capitalism comes with an increased danger for fundamental rights. Furthermore, new technologies often tend to change the distribution of wealth within societies and therefore possibly lead to either the reduction or the growth of inequality depending on how they are regulated.^[4] The misalignment of innovation and regulation can therefore be extremely problematic for societies.^[5] Major reasons for a misalignment have been localized in information gaps of regulators, the inability of regulators to fully grasp the innovational model itself and the invisibility of certain innovational flaws only until they become critical and therefore unmissable.^[6]

 

Experimental regulations and regulatory Sandboxes may provide a fitting and promising remedy to these conditions. Both concepts promise to handle innovative business models more effectively through the implementation of different adaptability and adjustment measures while also securing a sophisticated human rights standard. The discourse over these specific forms of regulation gained more prominence with the recent improvements of artificial intelligence (AI), a generic term that encompasses various technologies that are considered to have some form of intelligent behavior, and its spreading usage in various economic and scientific sectors. Especially with the public roll out of ChatGPT and other artificial intelligence powered Large Language Models (LLM), the potential of Artificial intelligence became more apparent to a greater circle of persons, including policymakers.^[7]

 

With the next technological milestones in artificial intelligence development already on the horizon, generally referred to as superintelligence, a dedicated and consistent approach is essential here.^[8] The goal in this regard is to reach so-called superalignment, which translates to agile and adaptive regulation combined with state of the art monitoring and reactional measures for any form of super-intelligent machines.^[9] But there is still a long way to go. Until then, however, the goal must remain to reach an alignment as far as possible.

 

Due to the rapid evolution of this technology and its improvements and changes, experimental regulation and sandboxes seem to serve here as the right method to effectively regulate this technology while not preventing economic and/or scientific growth using it. As seen in the recent implementation of the AI Act and its use of experimental legislation and sandboxes these lawmaking forms found their way into one of the most discussed and anticipated EU regulations in the recent years. The EU's AI Act represents therefore a significant milestone, using the concept of regulatory sandboxes on the EU-Level for probably the technology of the 21st century.

 

This blogpost tries to assess whether this legislative approach is the right measure to tackle artificial intelligence by analyzing its historical background and the legal implications of it. After that, the case of experimental regulations and legislative sandboxes and their effective provision in the AI act will be addressed through a case study on the AI act.

 

II. Experimental Regulation and Regulatory Sandboxes

 

To comprehensively analyze the concept of experimental regulation and regulatory sandboxes, particularly in the realm of AI, it is essential to clarify its specific meaning.

1. Experimental Regulation

 

Experimental Regulation is inherently designed to serve as a more adaptive and collaborative approach to regulatory compliance in comparison to more conventional regulation methods, offering a framework that fosters innovation while ensuring accountability. Generally speaking, experimental regulation can be seen as legislation which authorizes, monitors and executes legal experiments.^[10]

 

In its core, experimental regulation serves as an evidence-based form of law making in opposition to the conventional “trial & error” approach.^[11] Experimental regulation tries to limit the unpredictability of that approach to an acceptable amount.

 

The most notable features of experimental regulation are its temporal nature, its derogation from current, already existing statutes and finally the evaluation of the results stemming from the execution of the experiment.^[12] It can be therefore defined as a form of legislation that includes legislative measures on trial that serve the sole purpose of evaluating its effectiveness and practicability before its widespread and definitive implementation.

Experimental regulations are therefore a method for piloting fresh rules on a limited scale to assess their practical efficacy, tailor them to evolving conditions, and empower regulatory authorities to gain insights from the outcomes acquired in real-world scenarios.^[13] In this regard experimental regulation serves as a form of anticipatory and flexible regulation which encompasses preventive citizen protection while promoting innovation at the same time; its experimental framework and limited scale allows private actors and state authorities to analyze possible outcomes of technologies as well as of the regulation itself in a more detailed, safe and overall sophisticated way.^[14] Due to real-time feedback and constant evaluating of outcoming results, it is specially feasible for subjects and industries that require a fast and reactive regulative response to practical issues.

Furthermore, experimental regulation can easily adapt to cultural changes in economic behavior as itself is changing and adapting constantly as well.^[15] While it does not make sense to apply old regulation, which for instance was made for regulating taxi and cab services to more innovative transport companies like Uber, experimental regulation could adapt and adjust its rules to the seemingly similar, but essentially different business models of new market players more easily.^[16] The case-by-case approach of experimental regulation promises here a coherent and up to date regulation even in times with increasingly faster changing industries and economic realities.^[17] Moreover, it can even lead to a better cost-effectiveness of state spending as potential negative monetary impacts can be detected faster and the regulation can be adjusted before its widespread establishment.

2. Regulatory Sandboxes

 

Another and more recent form of experimental regulation is Regulatory Sandboxes. As has been the case with experimental regulation, one reason why sandboxes are being promoted is that traditional legislation is no longer regarded as adequately fitting to regulate innovative business models. These frequently outpace regulatory development, which can stifle innovation or lead to unregulated deployments, which could be seen in the case of Big Tech. Here, traditional legal measures like competition law weren’t capable of regulating these companies effectively during their rise-ups.^[18] In fact it could be even argued that their entire business-model cannot be monitored with previous existing measures.^[19]

The alternative to the mere adjustments of already existing regulatory frameworks could be the introduction of regulatory sandboxes. Introduced for the first time in 2016 within the UK for the enhancement of innovation within the fintech sector, regulatory sandboxes can serve as a method to effectively promote innovation while mitigating compliance with regulation.^[20]

Sandboxes facilitate close cooperation between public and private entities and provide secure environments for fostering innovation by either temporarily applying an alternate regulatory framework to a (pre-)selected group of companies or by providing guidance on compliance through public actors.^[21] Usually, but not necessarily, both is the case. It therefore is a safe space for (often) start-ups and established companies to test new technologies, products, or services that are usually not compliant with current legislations within a limited, well-defined scope and under public supervision.^[22]

 

These controlled, yet real-world environments allow for a sophisticated testing of services, products and/or market approaches while minimizing the risks associated with unchecked and new technologies as they affect here only a limited circle of individuals and/or companies with proper safeguards provided.^[23] The sandboxes‘ duration depends on the decision-making authority, but they usually last up to 12 months.^[24]

While the private parties involved in the sandbox regime gain important information on client impressions, lawmakers can learn from emerging technologies and refine already existing regulations, ensuring this way the maintenance of an ethical but also efficient regulation.^[25] In contrast to experimental regulation in the narrow sense, regulative sandboxes do not always foresee the derogation of existing legislature within the laboratory-like framework.^[26] Here, the focus lies more on the collaborative factor between companies and the regulator and sometimes even only between companies and other private actors.^[27]

 

By offering a safe space for experimentation, sandboxes shall promote ideally innovation and learning on both sides, facilitating a two-way dialogue between innovators and regulators. This dialogue is instrumental in fine-tuning the regulatory framework as technologies advance since the knowledge necessary for effectively regulating increasingly more complex economic models becomes more and more complex itself.

 

The micro-optimizing and technology-specific approach promises to lead to satisfactory results, that can then be applied to a greater scale or other sectors/technologies.^[28] It also minimizes knowledge gaps between regulators and innovators as the constant exchange of information lets the legislator gain a wider understanding of new products, which makes it in turn easier to adjust regulation to the specifics of the product.^[29] Here, it is crucial to adjust regulation in the early stages of the development process as later changes may be already outdated or even harmful to the new standard, which the innovation usually gains more quickly after a certain period of time.^[30] Overall Sandboxes can therefore lead to better informed and tested regulation, making it likely to prevent flaws in legal regimes like the before-mentioned competition law.

 

Furthermore, sandboxes can accelerate efficient, coherent, and ‘bullet-proof’ regulation, thus also improving legal certainty for businesses.^[31] On top of that they also make it easier for companies to comply with upcoming regulation, as the experiences from the sandbox can already be used to amend or adjust the companies’ respective services, products and mechanisms while the legislative process is still running. Therefore, the time for these products and services to be deployed onto the respective markets can be significantly shortened. An established and well-planed learning and knowledge sharing mechanism could then foster the achieved results and make them useful for future sandboxes and thus amplify the gained knowledge. Sandboxes therefore promise to serve as a framework for nurturing innovation, but also compliance. Regulation thus often turns here into some sort of Governance based on enhanced communication.^[32]

 

III. The ‘smart’ legal framework in practice: The AI Act

 

The most recent and significant use of sandboxes can be found in the new AI Act of the EU, which came into effect in August 2024, trying to regulate Artificial Intelligence and its usage.^[33]  In general, the EU chose to follow a horizontal regulating approach with implementing the AI Act.^[34] In this regard many artificial intelligence tools already fall under current legislation regarding several different sectors, like data protection law or competition law.^[35] This is usually not due to the peculiarities of the artificial intelligence used, but rather of varying reasons connected to other issues regarding the product or the company.

 

However, the EU legislator attempted to at least minimize negative consequences of artificial intelligence in particular before the implementation of the AI Act in a non-centralized and somewhat chaotic approach, enshrining some regulative measures in different legal initiatives like the GDPR, cf. Art. 22 or 35.^[36] Most of these regulations were of vertical nature, mostly born out of pressure to quickly react to fast-changing technologies and the legal vacuum they nurtured from.^[37] The amendments were necessary due to the lack of a general law constraining and defining the powers and limits of this technology.^[38] With the AI Act such a law now exists, crossing the threshold of regulation being predominantly reactive to being increasingly more structural and therefore preventive.^[39] Through its implementation the EU now seeks to create a comprehensive framework and ecosystem to enable citizens to nurture the benefits of artificial intelligence while simultaneously minimize its risks EU-wide.^[40]

 

The EU followed in this regard a mostly risk-based approach, meaning that it categorizes artificial intelligence systems and foundation models into different risk categories with different compliance standards according to the specific risk level the respective artificial intelligence systems falls under.^[41] Providers as well as deployers of such systems will then be obliged to perform certain duties and comply with the regulation in order to mitigate risks stemming from risky artificial intelligence.^[42] This approach does justice to the different types and areas of application of artificial intelligence, some of which have very different potential risks for society.

 

The AI Act introduces different forms of governance and regulation including complete prohibitions, the possibility of substantive fines, reporting, record keeping, documentation, transparency and human oversight obligations, but also providing among others the option to establish regulatory artificial intelligence sandboxes.^[43] Proponents of regulatory sandboxes saw this as a great opportunity for the successful implementation of this legal measure on a large scale. Thus, the EU followed other legislators who already established AI-Sandboxes in their own respective jurisdictions, for example Russia,^[44] Brazil, Norway, United Kingdom or Spain.^[45]

 

But how and how well did the EU design these sandboxes? As outlined above the specific operationalization and the actual design of a sandbox are extremely influential on its success.

 

IV. The AI Act as a Case Study

 

If regulatory sandboxes are regarded as a sub-category of experimental regulation, both forms of legislation have found their place in the AI Act in the form of a regulatory AI sandbox, which can be found in Art. 57 ff. AI Act. According to these Articles each Member State shall establish at least one AI regulatory sandbox alone or jointly with other Member States and their competent authorities, cf. Art. 57(1) AI-Act. Accordingly, Member States must either introduce such an AI regulatory sandbox themselves or participate in a sandbox established by another Member State. This applies to the extent and only if participation in the sandbox of the other Member State is comparable to the establishment of its own. In this respect, this should be of particular interest and advantage to smaller member states if their own AI sector is too small to introduce an AI regulatory sandbox. Larger member states are likely to regularly fail this restrictive condition, unless the scale of the desired sandbox is correspondingly large.

To prevent segmentation and fragmentation of regulatory sandbox regimes across the EU, the Commission is obliged under Art. 58(1) of the AI Act to adopt an implementing act in which the modalities for the establishment, development, implementation, operation and monitoring of the AI sandboxes. Art. 58 of the Act lists numerous points that must be observed by the national authorities when establishing and operating sandboxes. It is to be welcomed that the national authorities are given an appropriate amount of leeway to shape the concrete form of the sandboxes without it being too extensive. For example, the authorities can determine the length of the respective sandbox themselves, which makes sense in line with the concept of sandboxes based on individual projects, cf. Art. 58(2)(h) AI-Act.

 

As outlined above, the success of regulatory sandboxes and experimental regulation is also highly dependent on the evaluation process as it is a crucial part of conducting the sandbox and gaining important information for future regulation attempts. Here, the national competent authorities responsible for the establishment and operation of the sandboxes must send annual reports to the AI Office and the European artificial intelligence Board – two organs introduced by the AI Act in order to monitor and guarantee the success of the regulation ­– in accordance with Art. 57(16) AI Act, in which they report on the progress and results of the implementation of these sandboxes, including best practices, incidents, lessons learned and recommendations on their establishment and, where appropriate, application and possible revision of this Regulation. Depending on whether the expected and previously mentioned implementing act of the Commission further specifies these evaluation obligations, the standard of the respective assessments could even be increased accordingly.

 

Furthermore the AI-Act provides several organizational points that should guarantee the successful implementation of European Union AI sandboxes. Pursuant to Art. 57(1) AI-Act the Commission may provide assistance in the form of technical support, advice or the providing of tools for the establishment as well as the operation of such AI regulatory sandboxes. Depending on whether – and if yes on how – the support is actually given, the sandbox framework in the AI Act may turn out as a success or a failure. This of course also depends on whether the support of the Commission is needed in the first place. Since the sandboxes will probably remain national to the greatest extent and according to Art. 57(1) AI-Act might be even conducted on a regional or local level, the centralized expertise of the Commission might turn out to be unnecessary. However, when two or more member states establish and/or operate an AI sandbox together according to Art. 57(1) Para. 1, 2 AI-Act, it may be useful to obtain information from a supranational body like the Commission as it might have more supranational resources in the first place.

 

According to Art. 53(17) AI-Act the Commission must create a comprehensive interface to give stakeholders and interested parties an overview of the sandboxes and, if necessary, contact options, which should make the access to the sandboxes easier. The attempt to amplify supranational cooperation and cross-border innovation is reflected several times within the regulation, cf. Art. 57 Para. 1 or 4 AI Act, which stipulate that the sandboxes should be designed in such a way that competent authorities from other member states can also participate if needed. Also, there is the possibility of a European Union AI regulatory sandbox for the EU institutions themselves, which can be established by the European Data Protection Supervisor.

 

All the above-mentioned points promise to guarantee a successful implementation of regulatory AI-sandboxes on an EU level. However, there are also points in which the EU only partly succeeds in establishing a coherent and effective sandbox environment. To effectively attract applicants to participate in a regulatory sandbox there should be exemptions from the existing regulatory burden. However, there is no mention of this in the AI Act, at least not explicitly. The reason for this is not entirely clear. Here too, the legislator could have easily continued to pursue the risk-based approach and made the derogation from existing rules and regulation dependent on the respective risk level of the respective artificial intelligence technology. There should still be incentives for companies to participate in the sandbox, such as faster distribution of products to the European Union market. Especially with a complex technology such as artificial intelligence, it would have made sense to offer incentives to deviate from the now comprehensive legislation in order to try out new approaches and ideas.^[46]

 

Rather, a genuine "experimentation clause" should have been chosen here, which would have given the supervisory authority a certain amount of leeway to act flexibly in the application of the existing legal framework and to deviate from it accordingly if necessary.^[47] Furthermore, applicants could also be attracted by monetary incentives. Here the providers of artificial intelligence systems that fall under the AI-Act are spared administrative fines as long as they respect the sandbox plan and the terms and conditions for their participation and followed the guidance given by the national competent authority, Art. 57(12) AI-Act.

 

It also has to be noted that AI Sandboxes introduced by the AI-Act do not play a too prominent role in regard to the rest of the regulation. Due to the partly extensively broad wording and categorization of certain artificial intelligence systems, there remains the fear of overregulating the technology;^[48] this could have been easily mitigated or even prevented if the sandbox would have been given a more central role in the legislation as this is exactly one of the main advantages of regulatory sandboxes: balancing regulating and innovation.

 

It can be said that by establishing AI regulatory sandboxes, the AI Act has taken an important and necessary step towards the flexible and innovative regulation of artificial intelligence, perhaps the most important technology of this century. The EU has indeed successfully fulfilled many of the points that should be considered when establishing and designing regulatory sandboxes. However, some other points, in particular the lack of flexibility to deviate from the provisions of the AI Act within the sandbox, were implemented rather inadequately by the EU. This is particularly unfortunate because, due to the importance and significance of the AI Act, a full-fledged regulatory sandbox would have sent an important signal to stakeholders, companies and citizens: namely that the EU is an innovative and progressive legislator. After analyzing the sandboxes in the AI Act, this can only be partially attributed to the EU.

 

Since artificial intelligence would have been an excellent application example for effective sandboxes outside of fintech ­– both in terms of the concept of the technology itself and the importance and potential market capitalization of AI-driven business models – it is particularly unfortunate that the EU has only created a partially promising sandbox here.

 

IV. Conclusion

 

While the two discussed forms of smart legislation – experimental regulation and regulatory sandboxes – offer several advantages, they also have flaws that can be mitigated under the right conditions. These approaches introduce innovation and empiricism to a traditionally bureaucratic and slow legislative process, with the aim of rationalizing lawmaking, especially in technocratic fields. However, politics is not always purely rational and should account for emotions and ideologies, as long as they avoid extremism. While these legislative models can be useful in managing disruptive technologies and national emergencies, their effectiveness depends on careful design by legislators. As seen in the AI Act case study, success is not guaranteed, but with continued use, these approaches are likely to improve, benefiting both society and the legislative process. It was expected that the goal of super-alignment could not have been reached by the AI-Act and its use of experimental regulation. However, the EU did take a big step towards a modern approach of law-making and an alignment as far reaching as possible when it comes to the AI-Act. Whether this approach will be successful in regulating such an important and influential technology as AI remains to be seen.

 

 

---

[1] Pistor, The Code of Capital, passim.

[2] Sabeel Rahman, Artificial Sovereigns: A quasi-constitutional Moment for Tech?, https://lpeproject.org/blog/a-quasi-constitutional-moment-for-tech/.

[3] Bradford, who coined the term in her article, The Brussels Effect, Northwestern University School of Law 2012, Vol. 107, No. 1; see also Siegmann et al., The Brussels Effect of AI Regulations, https://www.governance.ai/research-paper/brussels-effect-ai for further insights on the Brussels Effect in regard to the AI Act. However, it should be noted that the impact of the Brussels effect in the case of the AI Act is questioned by some, as artificial intelligence itself is often already (co-)regulated by other laws that actually focus on data security or intellectual property, for example, cf. Engler, The EU AI Act will have global impact, but a limited Brussels Effect, https://www.brookings.edu/articles/the-eu-ai-act-will-have-global-impact-but-a-limited-brussels-effect/.

[4] Markovits, Are we prisoners of technological fate?, https://lpeproject.org/blog/are-we-prisoners-of-technological-fate/.

[5] Cf. Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 17.

[6] Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 18.

[7] Smuha, Internet Policy Review 2021, Vol. 10, Iss. 3.

[8] Burkhard, Was ist Superalignment und warum ist es wichtig?, https://medium.com/@pratheekburkhard/was-ist-superalignment-und-warum-ist-es-wichtig-52b94fe37e22.

[9] Heaven, Now we know what OpenAI’s superalignment team has been up to, https://www.technologyreview.com/2023/12/14/1085344/openai-super-alignment-rogue-agi-gpt-4/; Burkhard, Was ist Superalignment und warum ist es wichtig?, https://medium.com/@pratheekburkhard/was-ist-superalignment-und-warum-ist-es-wichtig-52b94fe37e22.

[10] Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 5.

[11] Van Gestel/Van Dijck, European Public Law 2011, 539.

[12] Cf. Ranchordas, The whys and woes of experimental legislation, p. 419, 420.

[13] Ranchordas, Sunset Clauses and Experimental Regulations: Blessing or Curse for Legal Certainty?, p. 29.

[14] Ranchordas, Experimental Regulations for AI: Sandboxes for Morals and Mores, p. 94.

[15] Dutil/Williams, Canadian Public Administration 2017, p. 562, 571.

[16] Dutil/Williams, Canadian Public Administration 2017, p. 562, 571.

[17] Soeteman-Hernandez et al., NanoImpact 2021, 10031, p. 6.

[18] Cf. among others Khan, Amazon’s Antitrust Paradox, passim, in which the author outlines how the legal framework of antitrust law isn’t capable of effectively addressing the challenges Amazon’s business model established.

[19] Khan, Amazon’s Antitrust Paradox, passim.

[20] Ahern, European Business Organization Law Review 2021, p. 395, 405; Nabil, Reforming the European Union’s Proposed AI Regulatory Sandbox, https://www.internationalaffairs.org.au/australianoutlook/reforming-the-european-unions-proposed-ai-regulatory-sandbox/#:~:text=More%20specifically%2C%20an%20AI%20sandbox,for%20compliance%20with%20relevant%20laws.

[21] Ranchordas, Experimental Regulations and Regulatory Sandboxes – Law Without Order?, p. 2.

[22] Cf. Ringe, Why we need a regulatory sandbox for AI, https://blogs.law.ox.ac.uk/oblb/blog-post/2023/05/why-we-need-regulatory-sandbox-ai.

[23] https://www.consilium.europa.eu/en/press/press-releases/2020/11/16/regulatory-sandboxes-and-experimentation-clauses-as-tools-for-better-regulation-council-adopts-conclusions/.

[24] Ahern, European Business Organization Law Review 2021, p. 395, 411.

[25] Ringe, Why we need a regulatory sandbox for AI, https://blogs.law.ox.ac.uk/oblb/blog-post/2023/05/why-we-need-regulatory-sandbox-ai.

[26] Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 6.

[27] Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 7.

[28] Omarova, Journal of Financial Regulation 2020, p. 78.

[29] This way the so-called Collingridge Dilemma is avoided (at least to a certain extent), cf. Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 16.

[30] Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 16.

[31] Ringe, Why we need a regulatory sandbox for AI, https://blogs.law.ox.ac.uk/oblb/blog-post/2023/05/why-we-need-regulatory-sandbox-ai.

[32] Ranchordas/Vinci, Regulatory Sandboxes and innovation-friendly Regulation, p. 11.

[33] Friedl/Gil Gasiola, Examining the EU’s Artificial Intelligence Act, https://verfassungsblog.de/examining-the-eus-artificial-intelligence-act/; Smuha, Internet Policy Review 2021, Vol. 10, Iss. 3.

[34] https://www.psa.ac.uk/psa/news/ai-act-it-golden-standard-or-just-another-over-regulation-symphony-brussels.

[35] Cf. Dotan, AI Regulation: A Step Forward or Ethics Washing?, https://www.spiceworks.com/tech/artificial-intelligence/guest-article/ai-regulation-and-ethics/.

[36] See also Art. 9 GDPR, which prohibits the processing of special categories of personal data under certain conditions and through this for instance the use of biometric categorization systems; Ranchordas, MORALS + MACHINES 1/2021, p. 89, 90.

[37] Chen, China sets restrictions on generative AI, but leaves room for innovation, https://thechinaproject.com/2023/07/21/chinas-new-regulations-on-generative-ai-sets-restrictions-but-leaves-room-for-innovation/.

[38] Chen, China sets restrictions on generative AI, but leaves room for innovation, https://thechinaproject.com/2023/07/21/chinas-new-regulations-on-generative-ai-sets-restrictions-but-leaves-room-for-innovation/.

[39] Chen, China sets restrictions on generative AI, but leaves room for innovation, https://thechinaproject.com/2023/07/21/chinas-new-regulations-on-generative-ai-sets-restrictions-but-leaves-room-for-innovation/; Pasquale, The second wave of alghoritmic accountability, https://lpeproject.org/blog/the-second-wave-of-algorithmic-accountability/.

[40] Ranchordas, MORALS + MACHINES 1/2021, p. 90.

[41] Fraser/Villarino, European Journal of Risk Regulation 2023, p. 1, 4; Friedl/Gil Gasiola, Examining the EU’s Artificial Intelligence Act, https://verfassungsblog.de/examining-the-eus-artificial-intelligence-act/.

[42] Friedl/Gil Gasiola, Examining the EU’s Artificial Intelligence Act, https://verfassungsblog.de/examining-the-eus-artificial-intelligence-act/.

[43] Friedl/Gil Gasiola, Examining the EU’s Artificial Intelligence Act, https://verfassungsblog.de/examining-the-eus-artificial-intelligence-act/; MacCarthy/Propp, Machines learn that Brussels writes the rules: The EU’s new AI regulation, https://www.brookings.edu/articles/machines-learn-that-brussels-writes-the-rules-the-eus-new-ai-regulation/; Smuha, Internet Policy Review 2021, Vol. 10, Iss. 3.

[44] Russia even introduced a sandbox, which also covered Artificial Intelligence applications already back in 2021, cf. Ranchordas, MORALS + MACHINES 1/2021, p. 95.

[45] Nabil, Reforming the European Union’s Proposed AI Regulatory Sandbox, https://www.internationalaffairs.org.au/australianoutlook/reforming-the-european-unions-proposed-ai-regulatory-sandbox/#:~:text=More%20specifically%2C%20an%20AI%20sandbox,for%20compliance%20with%20relevant%20laws.

[46] Ringe, Why we need a regulatory sandbox for AI, https://blogs.law.ox.ac.uk/oblb/blog-post/2023/05/why-we-need-regulatory-sandbox-ai.

[47] Ringe, Why we need a regulatory sandbox for AI, https://blogs.law.ox.ac.uk/oblb/blog-post/2023/05/why-we-need-regulatory-sandbox-ai.

[48] Cf. Streitbörger, Kann der was? Ein kritischer Blick auf die letzten Änderungsvorschläge für den AI-Act, https://blog.ai-laws.org/kann-der-was-bewertung-der-jungsten-anderungsvorschlage-fur-den-ai-act-der-eu/.