The Bathtub of European AI Governance: Identifying Technical Sandboxes as the Micro-Foundation of Regulatory Learning

TL;DR

The paper addresses how to operationalize regulatory learning under the EU AI Act by identifying a missing micro-foundation for evidence generation. It introduces the AI Act Bathtub model (micro, meso, macro) and proposes AI Technical Sandboxes (AITS) as the micro-level engine that generates data feeding learning across levels. The authors argue for modular AITS built on a DSL, unified data model, standardized metrics, and machine-readable reporting to bridge law and technology. They discuss socio-technical challenges, including speed mismatches, standardisation bottlenecks, and regulatory capture, and outline concrete steps toward implementing these infrastructures. The work has practical implications for regulators, industry, and standardisers to achieve adaptive, evidence-driven governance of AI in Europe.

Abstract

The EU AI Act adopts a horizontal and adaptive approach to govern AI technologies characterised by rapid development and unpredictable emerging capabilities. To maintain relevance, the Act embeds provisions for regulatory learning. However, these provisions operate within a complex network of actors and mechanisms that lack a clearly defined technical basis for scalable information flow. This paper addresses this gap by establishing a theoretical model of regulatory learning space defined by the AI Act, decomposed into micro, meso, and macro levels. Drawing from this functional perspective of this model, we situate the diverse stakeholders - ranging from the EU Commission at the macro level to AI developers at the micro level - within the transitions of enforcement (macro-micro) and evidence aggregation (micro-macro). We identify AI Technical Sandboxes as the essential engine for evidence generation at the micro level, providing the necessary data to drive scalable learning across all levels of the model. By providing an extensive discussion of the requirements and challenges for AITSes to serve as this micro-level evidence generator, we aim to bridge the gap between legislative commands and technical operationalisation, thereby enabling a structured discourse between technical and legal experts.

Figures (3)

• Figure 1: The EU AI Act's bathtub.
• Figure 2: The flow of information in the self-assessment by an SME. While the regulatory learning here is primarily internal to the SME and constrained to the micro level, its participation in structures such as standardisation processes and the Advisory Forum allows for their information and experience to also be passed to the meso and macro levels.
• Figure 3: Work and information flow in the AIRS scenario.