Regulatory Sandboxes for Artificial Intelligence

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Regulatory sandboxes for artificial intelligence are among the most promising strategies for balancing technological innovation and legal certainty in Brazil.

What a Regulatory Sandbox Is and Why It Matters for AI

Look at the current state of artificial intelligence regulation in Brazil and around the world, and the same dilemma keeps coming up: how can emerging technologies develop without giving up the protection of citizens’ fundamental rights? This is where the concept of the regulatory sandbox comes into its own. A regulatory sandbox is a controlled environment, authorized by a regulatory agency, in which companies and developers can test innovative solutions under supervision. Temporary, more flexible rules apply, and participants do not have to comply in full with the existing regulatory framework during the experimental period.

The logic behind this mechanism is fairly simple. Instead of banning or ignoring new technologies until the law catches up with them, the regulator creates a safe space where innovation can be observed up close. Both the public and private sectors benefit. The regulator gains technical knowledge about the technology’s risks and potential, while participating companies gain clarity about legal limits and can adjust their products before a large-scale launch.

In the field of artificial intelligence, the regulatory sandbox matters even more. AI systems often operate in sensitive areas (health care, credit, public safety, human resources) and involve complex risks, such as algorithmic bias, opacity in automated decisions, and potential privacy violations. Controlled experimentation allows these risks to be identified, measured, and mitigated before a product reaches millions of users, significantly reducing the likelihood of collective harm.

International Experience and Brazil’s Model in the Making

Looking at international experience, the regulatory sandbox has already become well established in several sectors. The United Kingdom was a pioneer with the Financial Conduct Authority (FCA) sandbox, launched in 2016 for the financial sector, and later extended the model to other areas, including the regulation of AI-based technologies. The European Union, through the AI Act (the Artificial Intelligence Regulation), expressly provided for the creation of AI regulatory sandboxes in its member states, recognizing that supervised experimentation is essential to ensure compliance without stifling innovation.

Singapore, Canada, and Australia have also adopted variations of the model, each adapted to the particulars of its legal system and the priorities of its industrial policy. What all of these experiences have in common is a set of essential elements: a fixed time limit for testing, clear eligibility criteria, transparency and accountability obligations, mechanisms to protect affected consumers, and a commitment by the regulator to use the data collected to improve the regulatory framework.

In Brazil, the debate over regulatory sandboxes for AI has gained momentum alongside legislative discussions on a regulatory framework for artificial intelligence. The bill moving through the National Congress contemplates the creation of these experimental environments and delegates to sector-specific regulators the authority to implement them. It is worth remembering that the country already has hands-on experience with sandboxes in other sectors: the Central Bank of Brazil established a regulatory sandbox in the financial system, the Securities and Exchange Commission (CVM) created one for the capital markets, and the Superintendence of Private Insurance (Susep) has also implemented its own model for the insurance sector.

A regulatory sandbox is not a license to deregulate. It is a sophisticated tool for regulating better, based on evidence gathered through supervised practice.

These sector-specific experiences show that Brazil’s legal system can already accommodate the mechanism and that the country’s regulators have the institutional capacity to run it. Bringing it into the field of artificial intelligence, however, requires significant adaptations, given the cross-cutting nature of the technology and the many rights it may affect.

Key Legal Aspects of an AI Sandbox

From a legal standpoint, implementing a regulatory sandbox for artificial intelligence raises questions that call for careful handling. The first concerns the legal basis. For an experimental environment to operate with legal certainty, there must be legislative authorization or, at the very least, express regulatory authority granted to the responsible agency. A sandbox created without an adequate legal foundation could be challenged in court, both by competitors who feel harmed and by people affected by the technologies being tested.

The second question involves civil liability. When an AI system causes harm during the sandbox testing period, who is responsible? The participating company, the regulator that authorized the experiment, or both? In our view, participation in the sandbox cannot serve as a defense that eliminates liability. The developer remains responsible for the harm its product causes, even while operating in an experimental environment. The regulator, for its part, may be held liable if it acted negligently in its supervision or authorized manifestly risky tests without requiring proportionate safeguards.

Personal data protection is another sensitive point. AI systems often depend on large volumes of data for training and operation. The sandbox does not waive compliance with the LGPD (Brazil’s General Data Protection Law). Participants must show that they have adequate legal bases for processing data, that they have put proportionate security measures in place, and that they safeguard data subjects’ rights. The ANPD (Brazil’s National Data Protection Authority) plays an important role here and may work together with the sector regulator to define protection parameters.

Algorithmic transparency inside the sandbox is also important. Participants must give the regulator detailed information about how their systems work, including the training data used, performance metrics, bias testing carried out, and mitigation measures implemented. This transparency does not necessarily mean opening up the full source code (which could compromise trade secrets). It means providing enough information for the regulator to assess the risks on a well-founded basis.

Practical Challenges and Prospects for Brazil

When we look at the practical challenges of implementing AI sandboxes in Brazil, we find obstacles that go beyond the legal framework. The first is the technical capacity of regulators. Evaluating artificial intelligence systems requires specialized expertise in computer science, statistics, algorithmic ethics, and data engineering. Many Brazilian regulatory agencies do not yet have teams with this training, which can undermine the quality of supervision and the credibility of the mechanism.

The second challenge is coordination among regulators. Artificial intelligence is a cross-cutting technology that can affect multiple regulated sectors at once. An AI system used to grant credit, for example, concerns the Central Bank, the ANPD, the Administrative Council for Economic Defense (CADE), and consumer protection agencies. A lack of coordination among these bodies can lead to overlaps, regulatory gaps, or contradictory requirements that make it impossible for companies to take part in the sandbox.

Another point that deserves attention is the inclusion of small and medium-sized businesses. If the costs and red tape of participating in the sandbox are excessive, the mechanism may end up benefiting only large corporations with robust legal and compliance departments, deepening market concentration instead of promoting diversity and competition. The sandbox should be designed with simplified procedures and, where appropriate, technical support for smaller participants.

Despite these challenges, the outlook is promising. Brazil has a fast-growing AI innovation ecosystem, with startups, research centers, and technology companies that stand to gain enormously from an experimental regulatory environment. The experience built up with sandboxes in the financial sector provides a valuable institutional repertoire that can be adapted to artificial intelligence. The AI regulatory framework under discussion in the National Congress is likely to consolidate this tool, giving it the legal basis needed for safe and comprehensive implementation.

Public Participation and Sandbox Governance

One aspect often underestimated in debates over regulatory sandboxes is the role of civil society in the process. In our view, the governance of these experimental environments cannot be limited to a two-party relationship between regulator and company. Citizens potentially affected by the technologies being tested, rights advocacy organizations, academia, and other relevant stakeholders should have channels for participation and access to information about ongoing experiments.

Publishing periodic reports on sandbox results, holding public consultations on selection and evaluation criteria, and creating accessible complaint and reporting mechanisms all strengthen the tool’s democratic legitimacy. Without this layer of social accountability, the sandbox risks being seen as a privilege handed to technology companies rather than a public policy tool geared toward the collective interest.

The sandbox’s internal governance also requires attention. The regulator should set up independent technical committees to evaluate applications, monitor experiments, and issue opinions on the results. Separating the team that authorizes participation from the team that supervises the tests reduces conflicts of interest and increases the credibility of the conclusions. At the end of the experimental period, the lessons learned should be systematized and built into the regulatory process, so that the sandbox serves its ultimate purpose: producing smarter regulation grounded in concrete evidence.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.