Germany's Trilateral AI Regulatory Sandbox Pilot — Simulating an AI Act Sandbox With Two Medical-Device Start-ups

In May 2025 the Bundesnetzagentur, the Hessian Ministry for Digitalisation and Innovation and the Federal Commissioner for Data Protection and Freedom of Information launched a seven-month pilot to simulate an AI regulatory sandbox under the EU AI Act, which obliges every Member State to have at least one sandbox by August 2026.
Two medical-device companies took part as use cases. The sandbox period lasted around five months, with a schedule (the equivalent of a sandbox plan) drawn up and executed for each case. Both cases were at an early stage and had no legally compliant test data, so no technical testing took place; the overlaps between the AI Act, the Medical Devices Regulation and the GDPR were the central issues.
Outputs were exit reports for the companies, including a roadmap on how the AI Act and MDR interact for a medical device with an integrated high-risk AI system, and a joint final report prepared with ZEVEDI. Findings: clear selection criteria matter; confidentiality, professional communication and documentation are key success factors; a maturity model could help structure requirements; authorities need close cooperation where the AI Act meets sector rules.
Caution: this was a simulation with two cases and no technical testing, and the report contains no quantitative outcome measures. Its value is as a documented design input for the sandboxes Germany must now stand up.

Read the full analysis: https://zevedi.de/wp-content/uploads/ZEVEDI_AI-regulatory-sandbox_pilot_project-_20260429.pdf