Denmark's AI Regulatory Sandbox — Testing AI Projects for GDPR and AI Act Compliance

Datatilsynet (the Danish Data Protection Agency) and Digitaliseringsstyrelsen (the Danish Agency for Digital Government) jointly established a regulatory sandbox for AI, running since 2024 with a mandate through 2027. Public and private organisations developing or deploying AI systems can apply for free, project-specific guidance on GDPR compliance and on risk classification under the EU AI Act, with the stated aim of reducing legal uncertainty and preventing project abandonment.
Two projects have completed the sandbox with published final reports: Børns Vilkår (a children's-welfare NGO) and BrainCapture ApS (a medical-technology company). In July 2026 a third round selected three new projects: Lex — Danmarks Nationalleksikon (a Danish-language encyclopedia chatbot), a Kintella ApS/Region Hovedstaden project on AI translation and early deterioration detection in healthcare communication, and Fenja ApS, which is building an on-premises AI platform for data sovereignty.
The scheme is non-binding guidance rather than certification, and neither agency has published aggregate figures on applications received, rejection rates, or measured public-value outcomes (cost savings, time-to-market gains) — the evidence so far is procedural (published cohort reports) rather than outcome-quantified.

Read the full analysis: https://www.datatilsynet.dk/regler-og-vejledning/kunstig-intelligens/regulatorisk-sandkasse