Source: EURLEX
Language: en
Format: md

COMMISSION IMPLEMENTING REGULATION (EU) …/...

of XXX

laying down rules for the application of Regulation (EU) 2024/903 of the European Parliament and of the Council, as regards the establishment and the operation of the interoperability regulatory sandboxes

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act)
[1](#footnote3)
, and in particular Article 12(10) thereof,

Whereas:

(1)Regulation (EU) 2024/903 introduced the interoperability regulatory sandboxes as an innovation support measure to enhance the development of innovative interoperability solutions and the cross-border interoperability of trans-European digital public services.

(2)In order to address the specific cross-border innovation and interoperability-related needs of public sector authorities, public sector bodies or Union entities may establish an interoperability regulatory sandbox pursuant to Article 11 of Regulation (EU) 2024/903. Interoperability regulatory sandboxes are fora to create regulatory learnings that are enabled through the development, training, testing and validation of innovative interoperability solutions in the frame of regulatory sandbox projects. In accordance with Article 11 (4) of Regulation (EU) 2024/903, interoperability regulatory sandboxes are by default joint endeavours of several Union entities and/or public sector bodies. In that sense, interoperability regulatory sandboxes are established through specific agreements between the different collaborating entities (such as a Memorandum of Understanding). Cooperation within the interoperability regulatory sandboxes can build on existing cross-border cooperation mechanisms. For this reason, public sector bodies or Union entities forming a consortium (e.g. a European Digital Infrastructure Consortium or European Grouping Territorial Cooperation) are eligible to establish an interoperability regulatory sandbox as well.

(3)To foster innovation, several national and Union wide regulatory sandboxes have been established or are in the process of being established under various Union legislative instruments, such as, but not limited to, the EU Blockchain Regulatory Sandbox, the setting up of AI regulatory sandboxes under Regulation (EU) 2024/1689
[2](#footnote4)
, and the Net-zero regulatory sandboxes to promote innovation in the field of net zero technologies under Regulation (EU) 2024/1735
[3](#footnote5)
. While some regulatory sandboxes may be sectorial, the interoperability regulatory sandboxes established under Regulation (EU) 2024/903 specifically focus on innovative solutions for Trans-European digital public services. To ensure alignment with the objectives of Regulation (EU) 2024/903, these sandboxes must adhere to specific eligibility criteria. Such criteria serve to determine which regulatory sandboxes will be featured on the Interoperable Europe Portal and monitored by the Interoperable Europe Board, established in accordance with Article 15 of Regulation (EU) 2024/1735. The checklists provided in the Annex to this Regulation and the guidance referred to in Article 11(3) of Regulation (EU) 2024/903 support public sector bodies and Union entities in assessing their compliance with these criteria. This enables the Commission to fulfil its task under Article 12(9) of Regulation (EU) 2024/903 of ensuring that information on the interoperability regulatory sandboxes is available on the Interoperable Europe portal. The eligibility check and authorisation of interoperability regulatory sandboxes by the Commission does not constitute an assessment of the legality of activities within such sandboxes. All participants remain fully liable for their activities as set out in Article 12(5) of Regulation (EU) 2024/903. The supervisory and corrective powers of competent authorities over these sandboxes remain unaffected, in accordance with Article 12(4) of Regulation (EU) 2024/903.

(4)While interoperability regulatory sandboxes can entail different forms of collaboration, the agreement establishing the interoperability regulatory sandbox serves the purpose to clearly set out which working methods between the participants and other actors are envisioned. The agreement should make transparent which type of other actors are eligible to join the regulatory sandbox projects, at which point in the lifespan of the interoperability regulatory sandbox and under which conditions, as there could be detrimental factors to the objectives of the interoperability regulatory sandbox and its projects. The agreement establishing the interoperability regulatory sandbox should also create transparency vis-à-vis the planned interactions with actors that have to be involved in the process pursuant to applicable law, such as Article 11(1) of Regulation (EU) 2024/903, which provides that interoperability regulatory sandboxes entailing the processing of personal data are to be operated under the supervision of the national data protection authorities or the European Data Protection Supervisor. The necessary engagement of the data protection supervisory authorities depends on different factors such as the complexity of the data processing operations in the envisioned regulatory sandbox projects, the categories and amount of data concerned as well as the risks associated with the processing. The operation of the interoperability regulatory sandboxes under the supervision of data protection authorities, where the interoperability regulatory sandboxes entail personal data processing, should be understood as an additional task for the data protection authorities, conferred on them by Regulation (EU) 2024/903, and a condition for the proper operation of the interoperability regulatory sandboxes. Following the application of Union data protection law to any personal data processing in the context of the implementation of Regulation (EU) 2024/903, data protection authorities should be provided the necessary resources for the performance of their new tasks. In the case that data protection authorities from different Member States and from EU level are involved in the interoperability regulatory sandbox, the cooperation of these authorities can also build on the respective mechanisms, referred to in Article 61 of Regulation (EU) 2016/679 of the European Parliament and of the Council
[4](#footnote6)
, in Article 61 and Article 62 of Regulation (EU) 2018/1725 of the European Parliament and of the Council
[5](#footnote7)
.

(5)To initiate the operational work within the interoperability regulatory sandbox, the regulatory sandbox coordinators need to initiate one or more regulatory sandbox projects. In order to proceed with this initiation, the regulatory sandbox coordinators ought to set up a specific plan for each regulatory sandbox project in accordance with Article 12 (3) of Regulation (EU) 2024/903. This plan must clearly define the specific deliverables aligned with the objectives of the overall interoperability regulatory sandbox, outline the open regulatory issue the project intends to address, and provide a comprehensive description of the innovative interoperability solution to be tested, along with some key additional elements.

(6)Whether the regulatory sandbox project plan is developed by the regulatory sandbox coordinators or by other participants invited by them will depend on the governance structure employed for the interoperability regulatory sandbox. What ought to be clearly established by the regulatory sandbox coordinators throughout the lifespan of the interoperability regulatory sandbox and of its regulatory sandbox projects, is how the specific deliverables will feed into the regulatory learning objectives of the interoperability regulatory sandbox.

(7)To support such objectives, Article 11(3) of Regulation (EU) 2024/903 foresees the issuing of guidance from the Commission, to help guide the regulatory sandbox participants towards a constructive creation of regulatory sandbox projects. Pursuant to Article 11(3), the Commission shall create a dedicated interface for information on the interoperability regulatory sandboxes, that will make public pertinent details regarding the established interoperability regulatory sandboxes and specific regulatory sandbox projects. To promote broad and equitable access to the interoperability regulatory sandboxes, information on how to initiate an interoperability regulatory sandbox should be made readily and easily accessible to the potential regulatory sandbox coordinators on the Interoperable Europe Portal in accordance with Article 11(9) of Regulation (EU) 2024/903. The Portal will also serve as a critical tool for ensuring effective regulatory learning outcomes—final reports and related regulatory insights will be published here, as well as the related recommendations from the Interoperable Europe Board.

(8)In order to accommodate the specific needs of the regulatory sandbox projects, regulatory sandbox coordinators may include other natural or legal persons as participants, such as other public sector actors, actors from the AI ecosystem, Union entities, research institutions, and SMEs, provided they meet the criteria specified in Article 12(1) of Regulation (EU) 2024/903. This does not entail changes on the responsibilities of the interoperability regulatory sandbox coordinators, nor of the participants who ought to uphold the specific agreement conditions upon entering a regulatory sandbox project. The purpose of including the GovTech actors specified in Article 12(1) is to enable a richer regulatory dialogue within the regulatory sandbox project, facilitating the sharing of lessons learned, identifying learnings from innovation experimentation, risks, and best practices on standardisation. The participants could also help to gain insight and access support from testing and experimentation facilities and from the European Digital Innovation Hubs. Innovative procurement approaches can work in synergy with and support interoperability regulatory sandboxes by enabling timely access to resources, expertise, and technologies for controlled experimentation. This ensures the flexibility needed to test innovative solutions while remaining aligned with regulatory goals.

(9)To ensure that regulatory sandboxes projects are environments that respect data privacy, the regulatory sandbox coordinators and the participants have to set out a well-defined approach towards further processing of personal data in the regulatory sandbox projects, that is to say, personal data initially lawfully collected for other purposes. This approach should be compliant with all requirements set out in Regulation (EU) 2024/903 and all other obligations pursuant to Union data protection law. Specifically, the agreement on the establishment of the interoperability regulatory sandbox should already specify, where appropriate, the elements set out in Article 11(4) of Regulation (EU) 2024/903. The approach should give specific attention to following a hierarchical approach to the use of personal data, ensuring that the data processed is limited to what is necessary for the functioning of the interoperability solution to be developed or tested in the interoperability regulatory sandbox, and that functioning cannot be effectively achieved by processing anonymised, synthetic or other non-personal data, as set out in Article 12(6)(b) of Regulation (EU) 2024/903. Where personal data processing may lead to new inferences about data subjects, participants must demonstrate a valid legal basis for the operational use of sandbox results. This legal basis shall be specified in the project plan pursuant to Article 12(3)(g) of Regulation (EU) 2024/903, and all conditions under Article 12(6) must be met. Without such legal basis, operational personal data from the sandbox cannot be further processed. This limitation prevents the use of interoperability regulatory sandboxes primarily for data exchange or comparison between authorities without proper legal grounds.

(10)A structured approach to evaluation and monitoring is essential for fostering a safe and productive environment for innovation, while maintaining accountability and regulatory integrity within the interoperability regulatory sandbox. For this purpose, pursuant to Article 12(8) of Regulation (EU) 2024/903, regulatory sandbox coordinators are to provide regular reports to the Commission and the Interoperable Europe Board summarising project progress, outcomes, and challenges. The reporting should also cover the evaluation of data quality aspects, such as the accuracy and fairness of assessments, data, or inferences generated during the sandbox's operation. This evaluation is crucial to ensure the reliability and trustworthiness of the sandbox's outputs to be used operationally (e.g. for fraud detection, subsidy allocation, or civil status registration). Regulatory sandbox projects should also evaluate the sustainability, energy and resource efficiency of the innovative interoperability solutions developed in the context of the interoperability regulatory sandbox To ensure continuous oversight, the process should require establishing a mechanism for ongoing data collection from individual projects, allowing for regular tracking of progress, risk management, and adherence to the sandbox’s standards. Templates and examples available on the Interoperable Europe Portal could in the future support the streamlining of reporting, to make it easier for all parties to fill out and comprehend the results of the interoperability regulatory sandboxes and its projects.

(11)The agreement on the interoperability regulatory sandboxes may need to be renewed in cases of substantial changes to the original agreement. Such changes may include, among others, modifications to the composition of the regulatory sandbox coordinators, or the extension of the initially agreed timeframe necessary to achieve the sandbox objectives.

(12)Upon successful termination of a regulatory sandbox project, the sharing of interoperability solutions through the Interoperable Europe portal should comply with the open-by-default principles established in Regulation (EU) 2024/903, promoting the use of the European Union Public Licence (EUPL) while not excluding other open source licenses where appropriate, as open source enables users to actively assess and inspect the interoperability and security of solutions.

(13)Any significant risks identified during the development and testing of interoperability solutions in an interoperability regulatory sandbox should result in adequate mitigation and, failing that, in the suspension of the development and testing process. The requested multi-level risk management approach, balancing the role of project risk managers and the oversight by the regulatory sandbox coordinators and competent authorities, should ensure a safe environment for the testing, training, development or validation of interoperability solutions in the interoperability regulatory sandbox. Regulatory sandbox coordinators should decide on the risk management process, managing communication between competent authorities and project-level risk managers, and ensure that each project within the interoperability regulatory sandbox complies with the established risk management plan. The risk management should build on and ensure full compliance with other applicable risk management procedures, e.g. in the field of cyber security or personal data protection. Guidance on the Interoperable Europe Portal can in the future help regulatory sandbox coordinators to find the appropriate set-up.

(14)The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on [XX/XX/2025].

(15)The measures provided for in this Regulation are in accordance with the opinion of the Committee established by Article 22(1) of Regulation (EU) 2024/903,

HAS ADOPTED THIS REGULATION:

Chapter I
  
GENERAL PROVISIONS

Article 1
  
Definitions

For the purpose of this Regulation, the following definitions shall apply:

(1)‘regulatory sandbox project’ means a specific project running in the controlled environment of an interoperability regulatory sandbox according to a specific plan as referred to in Article 12 (3) of Regulation (EU) 2024/903;

(2)‘regulatory sandbox coordinators’ means Union entities or public sector bodies that jointly establish an interoperability regulatory sandbox and assume responsibility during the entire lifespan of the interoperability regulatory sandbox and its projects, including overseeing their setup, coordinating participation, monitoring progress, reporting on the activities and termination.

Chapter II
  
ESTABLISHMENT OF AN INTEROPERABILITY REGULATORY SANDBOX

Article 2
  
General provisions

1.An interoperability regulatory sandbox shall be established through a specific agreement between at least three Union entities or public sector bodies (‘future regulatory sandbox coordinators’).

2.Before formalising the specific agreement, the future regulatory sandbox coordinators shall ensure that:

(a)the interoperability regulatory sandbox meets the eligibility criteria set out in Article 3 by performing the eligibility check based on the checklist set out in the Annex;

(b)the interoperability regulatory sandbox was authorised by the Commission pursuant to Article 11(4) of Regulation (EU) 2024/903 and Article 5 of this Regulation, if applicable.

3.An interoperability regulatory sandbox shall be established for an initial period that should not exceed three years. An interoperability regulatory sandbox may be renewed, following the procedure set out in Article 7. All regulatory sandbox projects within the interoperability regulatory sandbox have to be started and terminated within the lifespan of the interoperability regulatory sandbox, not exceeding the maximum duration of participation set out in Article 12 (2) of Regulation (EU) 2024/903.

Article 3
  
Eligibility for the establishment of interoperability regulatory sandboxes

1.Any public sector body or Union entity may take part in establishing an interoperability regulatory sandbox, subject to the conditions laid down in this Regulation. Legal entities forming a consortium may establish an interoperability regulatory sandbox, provided the consortium involves at least three eligible entities and meets all conditions set out in this Regulation.

2.An interoperability regulatory sandbox shall involve public sector bodies from different Member States or public sector bodies and Union entities.

3.The future regulatory sandbox coordinators shall sign a specific agreement on the establishment of an Interoperability regulatory sandbox that shall contain the following elements:

(a)description of the interoperability regulatory sandbox objective, scope and deliverables, in particular how the interoperability regulatory sandbox, including its projects, effectively contributes to the objectives set out in Article 11(2) of Regulation (EU) 2024/903, the innovative interoperability solutions that may be developed, trained, tested or validated in the regulatory sandbox projects and the open regulatory issues covered in the interoperability regulatory sandbox, as well as its planned duration;

(b)a governance plan outlining how the interoperability regulatory sandbox will operate, including the management of regulatory sandbox projects, setting out clear and transparent arrangements for collaboration between the participants, regulatory authorities, and any other actor involved in the interoperability regulatory sandbox, and outlining roles and responsibilities of the participants entering or exiting the regulatory sandbox projects;

(c)description of a risk management mechanism to supervise, monitor, and mitigate risks, ensuring the protection of fundamental rights, health, safety and personal data protection supported by clear policies and procedures to address potential violations of these fundamental rights, health and safety standards and personal data protection;

(d)description of a framework for evaluation and reporting across the regulatory sandbox projects, including mechanisms for monitoring progress, addressing challenges, documenting lessons learned and potential follow-up, and ensuring alignment with regulatory objectives;

(e)where the processing of personal data in the regulatory sandbox projects under the interoperability regulatory sandbox is envisioned, specifying the information referred to in in Article 11(4) of Regulation (EU) 2024/903.

4.The future regulatory sandbox coordinators shall agree on initiating at least one regulatory sandbox project, subject to the conditions set out in the specific agreement and Chapter III. The agreement shall cover:

(a)at least one specific innovative interoperability solution that is sufficiently advanced for development, training, testing or validation in a regulatory sandbox project; and

(b)the specific regulatory issues at stake and the guidance that is expected from the authorities supervising the interoperability regulatory sandbox.

Article 4
  
Single contact point

The regulatory sandbox coordinators shall designate, from among themselves, a single contact point for the purposes of the communication with the Commission throughout the entire lifespan of the interoperability regulatory sandbox.

Article 5
  
Authorisation of an interoperability regulatory sandbox

1.In the case that public sector bodies want to establish an interoperability regulatory sandbox without the involvement of a Union entity, they shall address a join request for an authorisation of the establishment of an interoperability regulatory sandbox to the Commission through the Interoperable Europe Portal.

2.The joint request of public sector bodies for establishing an interoperability regulatory sandbox shall include all information necessary for the Commission to assess the compliance with the eligibility criteria set out in Article 3 of this Regulation.

3.After following the procedure set out in Article 11 (4) of Regulation (EU) 2024/903, the Commission shall notify the single contact point of its decision on the request. In case of a negative decision, the regulatory sandbox coordinators may submit a reasoned review request within 30 days of receiving the Commission’s decision. The Commission shall examine the review request within 30 days and shall notify the single contact point of its decision on that review request.

4.In the case that the public sector bodies decide to renew the interoperability regulatory sandbox, as set out in Article 7, they shall request again the authorisation of the Commission.

Article 6
  
Transparency

1.The Commission shall create a single, dedicated interface for information on interoperability regulatory sandboxes and their regulatory sandbox projects within the Interoperable Europe Portal, including:

(a)general information and guidance for Union entities and public sector bodies interested in establishing an interoperability regulatory sandbox;

(b)dedicated information on each of the established interoperability regulatory sandboxes, covering information on running and closed regulatory sandbox projects, including possibilities for participation in regulatory sandbox projects.

2.The single contact point shall provide the available information, specified in paragraph (1)(b), at least 10 days before the starting of the operations of the interoperability regulatory sandbox to the Commission. The single contact point shall regularly update the information on the regulatory sandbox projects.

Article 7
  
Renewal of the interoperability regulatory sandbox

1.Regulatory sandbox coordinators may decide to renew the interoperability regulatory sandbox in the following cases:

(a)before ending of its planned duration pursuant to Article 2(3);

(b)if the regulatory sandbox coordinators want to make substantial changes to the specific agreement, referred to in Article 2(1).

2.The single contact point shall notify the Commission of the decision to renew the interoperability regulatory sandbox and provide the necessary information for the Interoperable Europe Portal, as specified in Article 6.

Article 8
  
Closing of an interoperability regulatory sandbox

1.Regulatory sandbox coordinators shall close the interoperability regulatory sandbox in one of the following cases:

(a)the interoperability regulatory sandbox has fulfilled its objectives prior to the determined end date;

(b)the interoperability regulatory sandbox has reached its determined end date and the regulatory sandbox coordinators have not reached an agreement on its renewal; or

(c)the necessary funding to continue the activities of the interoperability regulatory sandbox is not available.

2.Upon closing of the interoperability regulatory sandbox, the regulatory sandbox coordinators shall ensure that all regulatory sandbox projects are properly terminated, as set out in Article 15.

3.Regulatory sandbox coordinators shall submit the final report referred to in Article 12(8) of Regulation (EU) 2024/903 within three months following the closing of the interoperability regulatory sandbox.

Chapter III
  
OPERATION OF INTEROPERABILITY REGULATORY SANDBOXES

Article 9
  
General rights and obligations of the regulatory sandbox coordinators

1.Regulatory sandbox coordinators shall manage the operations in the interoperability regulatory sandbox and its relative projects throughout the lifespan of the interoperability regulatory sandbox.

2.Regulatory sandbox coordinators are specifically responsible of the following tasks:

(a)to invite regulators to the interoperability regulatory sandbox;

(b)to steer the regulatory dialogue with the regulators involved based on the outcomes of the regulatory sandbox projects;

(c)to decide on the number of regulatory sandbox projects running sequential or in parallel during the lifespan of the interoperability regulatory sandbox;

(d)to publish calls for participation in the regulatory sandbox projects on the Interoperable Europe Portal;

(e)to select regulatory sandbox projects, making sure each project remains in the scope of the interoperability regulatory sandbox with particular attention to the following aspects:

–to support the cross-border interoperability of trans-European digital public services;

–to contribute to the development, testing and validation of an innovative interoperability solution; and

–to identify the specific regulatory issues at stake and the guidance that is expected from the authorities supervising the interoperability regulatory sandbox;

(f)to ensure that participation in each regulatory sandbox project is based on a specific plan as referred to in Article 12(3) of Regulation (EU) 2024/903;

(g)to determining a time-limit for each regulatory sandbox project in accordance with Article 12(2) of Regulation (EU) 2024/903;

(h)to admit participants to a regulatory sandbox project as set out in Article 10;

(i)to end regulatory sandbox projects, as referred to in Article 15;

(j)to ensure periodic and final reporting to the Commission and the Interoperable Europe Board;

(k)to set up a risk management framework, as referred to in Article 12.

3.In case it is necessary to process personal data in the context of regulatory sandbox projects, regulatory sandbox coordinators shall take the necessary measures to allow for the competent data protection authorities to effectively carry out their supervision tasks, as provided for in Article 11(1) of Regulation (EU) 2024/903.

4.The regulatory sandbox coordinators may agree in the specific agreement establishing the regulatory sandbox pursuant to Article 2 (1) on the division of the tasks set out in this article among them.

Article 10
  
Admission of participants to regulatory sandbox projects

1.Regulatory sandbox coordinators shall publish on the Interoperable Europe Portal information on the conditions for participation in regulatory sandbox projects. Those conditions shall include the provision of information on the possibility for other GovTech actors to be involved in the interoperability regulatory sandbox, as provided for in Article 12(1) of Regulation (EU) 2024/903.

2.Regulatory sandbox coordinators shall decide on requests from other Union entities, public sector bodies or GovTech actors seeking to join the regulatory sandbox projects as participants, based on the rules for the respective interoperability regulatory sandbox, published on the Interoperable Europe Portal according to paragraph 1.

3.Regulatory sandbox coordinators are eligible to join all regulatory sandbox projects in interoperability regulatory sandbox as participants. Regulatory sandbox coordinators joining a project shall be subject to the rights and obligations set out in Article 11.

Article 11
  
General rights and obligation of participants in regulatory sandbox projects

1.Participants that have been admitted to a regulatory sandbox project according to Article 10 shall have the following obligations:

(a)to contribute to the plan and its elements referred to in Article 12(3) of Regulation (EU) 2024/903;

(b)to assume full responsibility, as set out in Article 12 (5) Regulation (EU) 2024/903, for the lawfulness of the development, training, testing and validation of the interoperability solution;

(c)to ensure that the interoperability solutions tested within the interoperability regulatory sandboxes comply with all applicable legal requirements and have obtained any necessary authorisations or approvals from competent authorities before they start the project;

(d)to ensure, if personal data is processed within a regulatory sandbox project, that such processing is in full compliance with applicable data protection law and an agreement with the relevant data protection authorities, referred to in in Article 12(1) of Regulation (EU) 2024/903, on their expected involvement in regulatory sandbox projects has been reached;

(e)to adhere to the risk management framework, as set out in Article 12;

(f)to regularly report on learnings in the regulatory sandbox projects, as specified in Article 13;

(g)to ensure lawful handling of personal data processed in the regulatory sandbox project , as specified in Article 15(3).

2.Participants may exit the regulatory sandbox projects under the conditions set out in Article 14.

Article 12
  
Risk management

1.Regulatory sandbox coordinators shall establish a risk management process for the interoperability regulatory sandbox and its projects. Regulatory sandbox coordinators shall define, implement, and monitor overarching risk management objectives for the interoperability regulatory sandbox, including specific risk management standards applicable to all regulatory sandbox projects therein taking into account risk management mandatory pursuant to other applicable law. Regulatory sandbox coordinators shall ensure effective communication on risk management between participants, competent authorities, and other stakeholders.

Regulatory sandbox coordinators shall develop a specific risk management plan for each regulatory sandbox project that follows the risk management process referred to in paragraph 1 and takes into account risk management mandatory pursuant to other applicable law.

2.Regulatory sandbox coordinators shall appoint one among them as project risk manager for each regulatory sandbox project. The project risk manager shall ensure that the regulatory sandbox project complies with the risk management plan referred to in paragraph 2. Where risks are identified, the project risk manager shall ensure that appropriate mitigation measures are taken.

3.Where appropriate mitigation is not feasible, the project risk manager may suspend any regulatory sandbox project or participant’s involvement within the interoperability regulatory sandbox and consult the relevant authorities. The project risk manager shall report to the Commission and the Board on the decision to suspend a regulatory sandbox project.

4.The project risk manager shall maintain records of risk management activities for the respective regulatory sandbox project and make those records available for review by all regulatory sandbox coordinators and the Commission.

Article 13
  
Reports

1.Regulatory sandbox coordinators shall establish a mechanism for periodic reporting that covers at least the topics referred to in Article 12(8) of Regulation (EU) 2024/903. In the case of processing of personal data in the regulatory sandbox projects, the reporting shall also cover the sandbox's effectiveness in qualifying personal data and the accuracy and fairness of the output and usability of its results by the relevant authorities.

2.The mechanism shall include collecting data from individual regulatory sandbox projects on an ongoing basis that ensures that progress is tracked, risks are managed, and compliance with the interoperability regulatory sandboxes’ objectives and legal requirements is maintained.

3.Regulatory sandbox coordinators shall submit the periodic reports to the Commission and the Interoperable Europe Board referred to in Article 12(8) of Regulation (EU) 2024/903 at least once every six months from the date of establishment of the interoperability regulatory sandbox.

4.All reports shall be published on the Interoperable Europe Portal. The reports shall not contain confidential information.

Article 14
  
Exiting of participants

1.If a participant wants to exit the regulatory sandbox project before the termination of the regulatory sandbox project, the participant shall provide a detailed explanation to the regulatory sandbox coordinators of the reasons for exiting.

2.Participants exiting a regulatory sandbox project shall have the following obligations:

(a)to complete any outstanding requirements linked to the monitoring and reporting of their activity;

(b)to ensure that the data collected and any interoperability solutions developed during the lifespan of the interoperability regulatory sandbox are handled in accordance with the applicable legislation, and with the conditions for admission to the sandbox, as defined by the sandbox coordinators; and

(c)to take all necessary steps to mitigate potential risks for the success of the regulatory sandbox projects and for public services and their delivery linked to the exiting the regulatory sandbox project.

3.Upon the exiting of a participant from a regulatory sandbox project, the regulatory sandbox coordinators shall assess the necessary measures with regard to the obligations set out in Article 9.

Article 15
  
Termination of regulatory sandbox projects

1.Regulatory sandbox coordinators shall terminate the interoperability regulatory sandbox projects in one of the following cases:

(a)the related regulatory sandbox projects have fulfilled the objectives before the maximum initial duration is reached;

(b)the necessary funding to continue the activities is not available;

(c)the regulatory sandbox projects no longer fulfil the minimum criteria in terms of scope and participation set out in its plan and no mitigation is possible.

2.In case the regulatory sandbox coordinators plan to terminate a regulatory sandbox project before the initially scheduled ending date, the regulatory sandbox coordinators shall inform all participants in due time.

3.Personal data that was exceptionally processed in order to reach the objectives of a regulatory sandbox project, shall not be used as operative data outside the regulatory sandbox project, unless there is a proper legal basis authorising a change of purpose.

4.Within three months following the termination of the regulatory sandbox projects, regulatory sandbox coordinators shall:

(a)make available on the Interoperable Europe portal the interoperability solutions and related materials developed during the lifespan of the interoperability regulatory sandbox, including documentation, version history, documented source code and references to open standards or technical specifications used, if such solutions and material are in line with the applicable quality criteria for the Interoperable Europe Portal;

(b)where solutions are issued as open source, use the EUPL or another appropriate open source license;

(c)clearly indicate, if sharing restrictions apply due to:

–intellectual property rights held by third parties;

–sensitive critical infrastructure protection;

–protection of defence interests or public security.

Chapter V
  
FINAL PROVISIONS

Article 16
  
Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels,

For the Commission

   The President
  
   Ursula VON DER LEYEN

[Top](#document1)

ANNEX

Checklist for an interoperability regulatory sandbox (referred to in Article 2(2), point (a))

|  |  |  |  |
| --- | --- | --- | --- |
| No. | Criteria | Description | Description |
| 1 | Participants | -Please list the name and contact information for each participating public entity that will be involved in the interoperability regulatory sandbox.  -Specify the designated role for each public entity within the interoperability regulatory sandbox (regulatory sandbox coordinator, observer, or regulator).  -Please specify the single contact point. | Please provide the required information.  Keep in mind that the interoperability regulatory sandbox must be established by at least three regulatory sandbox coordinators, either public sector bodies and/or Union entities. |
| 2 | Scope, objectives and deliverables | Scope:  -legislation and sector(s) covered by the interoperability regulatory sandbox;  -if not EU wide scope, cross-border region covered by the interoperability regulatory sandbox;  -duration of the interoperability regulatory sandbox.  Objectives:  -list the interoperability regulatory sandbox objectives;  -specify how the interoperability regulatory sandbox effectively contributes to the objectives set out in Article 11(2) of Regulation (EU) 2024/903.  Deliverables:  -Clearly identify the specific regulatory issues that the interoperability regulatory sandbox should help to clarify;  -specify the innovative interoperability solutions that the interoperability regulatory sandbox should help to develop, train, test or validate;  -specify the number and timeframe of regulatory sandbox projects that are envisioned under the interoperability regulatory sandbox;  -outline the content of at least one regulatory sandbox project, including the concrete innovative interoperability solution and the regulatory issue at stake. | Please provide the required information. |
| 3 | Governance | -Please set out how the interoperability regulatory sandbox will operate:  odetailing clear and transparent arrangements for collaboration between the participants, regulatory authorities, and any other actor involved in the interoperability regulatory sandbox and its regulatory sandbox projects, and  ooutlining roles and responsibilities of all participants entering or exiting the regulatory sandbox projects.  -Please specify which type of other actors are eligible to join the regulatory sandbox projects, at which point in the lifespan of the interoperability regulatory sandbox and under which conditions.  -Please be specific on the involvement of actors with supervisory or advisory capacity, such as national data protection authorities, regional or local supervisory bodies, and other relevant regulatory authorities.  -Please specify if the involvement of other GovTech actors is foreseen. | Please provide the required information.  The description should demonstrate that relevant regulators and other stakeholders have been clearly identified and considered, and, where applicable, include evidence of their readiness to participate in the interoperability regulatory sandbox. |
| 4 | Risk management | -Please list the initial potential risks identified for the interoperability regulatory sandbox.  -Please list the risk management objectives for the interoperability regulatory sandbox, including specific risk management standards applicable to all regulatory sandbox projects therein. | Please provide the required information. |
| 5 | Evaluation and reporting | -Please specify, when the periodic reports and final report will be available.  -Please specify the topics to be covered by the report. | Please provide the required information.  Keep in mind: the mechanism should include collecting data from individual regulatory sandbox projects on an ongoing basis to ensure that progress is tracked, risks are managed, and compliance with the framework’s objectives and legal requirements is maintained. |
| 6 | Further processing of personal data | -If the interoperability regulatory sandbox allows for the set-up of regulatory sandbox projects that entail further processing of personal data, please, confirm that the competent data protection supervisory authorities are adequately involved.  -Please specify the information set out in Article 11(4), second sentence, of Regulation (EU) 2024/903:  oin case the further processing falls within Directive 2016/680, the legal basis of further processing pursuant to national or Union law;  owhy the further processing of personal data in the interoperability regulatory sandbox is necessary;  othe concrete purpose of the further processing of personal data;  othe actors involved and their roles;  othe categories of personal data intended to be further processed in the interoperability regulatory sandbox;  othe envisaged retention period for the personal data, ensuring that data is not kept longer than necessary for the specified purposes.  -Please set out, how the alignment of the regulatory sandboxes with the conditions set out in Article 12(6) of that Regulation will be ensured. | Please provide the required information. |

[Top](#document2)