evidoria

← Back to browse

Good practice Imported

The Netherlands' National AI Regulatory Sandbox — a Single Access Point Built on a 2024 Pilot

Netherlands · The Hague · See the Netherlands profile · See the The Hague profile

Evidence: Descriptive / self-reported Top 47% 60/100 · Ask Evidence Copilot about this practice

Ahead of the EU AI Act's August 2026 deadline, the Netherlands designed one multi-sector AI regulatory sandbox -- a single access point run jointly by the RDI and the Data Protection Authority -- building on a 2024 pilot that handled 40 questions from 25 organisations.

40
Questions fielded during 2024 shaping pilot (2024)
25
Organisations participating in 2024 shaping pilot (2024)
8
National AI Act market-surveillance authorities behind one access point

Details

Maturity
Pilot
Promoter
Rijksinspectie Digitale Infrastructuur (RDI) & Autoriteit Persoonsgegevens (AP)
Period
2023–2026 (pilot 2024; sandbox required to launch by 2 August 2026)
Keywords
AI regulation, digital government, data protection, market surveillance

Context

Under Article 57 of the EU AI Act, every member state must operate at least one AI regulatory sandbox by 2 August 2026. The Netherlands designed a single, multi-sectoral sandbox jointly coordinated by the Rijksinspectie Digitale Infrastructuur (RDI) and the Autoriteit Persoonsgegevens (AP, the Dutch data protection authority), with all eight national AI Act market-surveillance authorities participating behind one digital access point, so an AI provider does not need to work out which regulator to approach.

Activities

The design, published in April 2025, builds on a 2023 exploration phase and a 2024 pilot that fielded 40 questions from 25 organisations, which shaped the intake process, scope and single-point-of-contact model now proposed for the full sandbox; start-ups and SMEs are intended to get priority access.

Results

As of mid-2026 the sandbox is still being built out toward the statutory August 2026 deadline, and no case-outcome or compliance-impact data from an operating sandbox cohort has been published; the evidence base so far is the 2024 pilot volume and the published design documentation, not live operating results.

Conclusions

Governance is unusually explicit -- the RDI and AP jointly coordinate, all eight AI Act market-surveillance authorities are named participants, and the mechanism has a clear legal basis in Article 57 -- but the design has not yet been tested at the scale it is built for.

Implementation
Indicative cost
Medium (€50k–€500k) — Coordinating eight national market-surveillance authorities behind one access point implies a meaningful cross-agency staffing and integration cost, though no specific budget figure is published.
Time to results
Medium (1–3 years) — Built through a 2023 exploration phase and 2024 pilot toward a mandatory operational launch by the EU AI Act's 2 August 2026 deadline -- a bounded, legally timetabled build-out.
Staffing & skills
Rijksinspectie Digitale Infrastructuur (RDI) coordination staff, Autoriteit Persoonsgegevens (AP) case handlers, eight national AI Act market-surveillance authorities

Conditions for success

  • a single digital access point so applicants do not need to identify the right regulator themselves
  • joint coordination between the digital-infrastructure inspectorate and the data-protection authority to cover both AI Act and GDPR questions
  • a prior pilot phase (2024) used to shape intake, scope and process before full launch

Common failure modes

  • the design has not yet operated at the scale it is built for -- only 25 organisations engaged during the shaping pilot
  • no case-outcome or compliance-impact data exists yet to show the sandbox changes AI providers' compliance behaviour

Commonly funded by

National / regional programmes Digital Europe Programme

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Similar practices you may find useful