The essence of the sandbox concept is found in the literal metaphor of the “sandbox”. In the sandbox, children are free to build and innovate in a safe environment, while parents give up strict control and adopt an attitude of collaborative supervision and mutual learning. The same principle applies to sandbox video games (such as Minecraft or Roblox), where players are given the tools to become creators, generating solutions that even the developers did not initially anticipate, and the video game can be updated and improved for all players. Beyond playful, the concept is fundamental in IT and cybersecurity: an antivirus does not block a suspicious file, but isolates it in a simulated environment (sandbox) to see how it behaves, thus protecting the system from possible infection.
Translated into public policies, the sandbox or “regulatory (innovative) testing space” is a space where regulations (laws, norms and their interpretations) are tested and experimented with alongside technological innovations. The state relinquishes total control in favor of flexibility, experimentalism and anticipation, bringing together regulators, the private sector, administrations and citizens. This duality, testing technology and law at the same time, is the truly revolutionary element that transformed the sandbox from a niche solution pioneered in the financial sector in 2015, into a global multi- and cross-sectoral tool in 2026.
UK: global pioneer, Spain: European pioneer, Republic of Moldova: regional pioneer
Romania: pioneerless
The UK became the global pioneer of the sandbox concept in 2015, as a direct response to the limitations imposed on the private sector following the 2008 global financial crisis. Under the coordination of the Financial Conduct Authority, the UK government created the first testing ground dedicated exclusively to financial technology (FinTech). In its first year of operation alone, 42 companies were able to test their innovations along with the associated regulations, a success that contributed decisively to London’s transformation into the main global financial technology center. The efficiency of this approach led to an accelerated adoption of the instrument by over 50 states worldwide. Romania was not among the countries that adopted this tool.
As the tool has proven successful, the use of sandboxes has expanded to a range of other sectors, with Spain establishing itself as the leading European pioneer in artificial intelligence (AI) testing. In 2023, a special legal framework was adopted by Royal Decree to create a testing environment for AI systems. The focus was on systems considered to be high-risk, with 12 companies selected from key sectors such as biometrics, critical infrastructure and medical products. Following this co-creation process, Spain published 16 practical guides aimed at facilitating compliance with the new European Union Regulation on Artificial Intelligence, which requires member states to have at least one operational AI sandbox by August 2026. It is unlikely (to the point of impossible) that Romania will meet its obligation to have such a sandbox operational within the time frame assumed.
At the regional level, the remarkable actor is the Republic of Moldova, which has become a pioneer by implementing an energy sandbox. By adopting Law no. 225/2024, the neighboring state directly modified the regulation of the energy sector to explicitly allow temporary derogations necessary for testing innovations. The instrument is already operational and has reached the second round of project selection. A detail that underlines the acute need for such spaces in the region is the fact that half of the last six applications submitted to the Moldovan sandbox came from innovative companies from Romania.
Although the Romanian state has a European obligation to implement at least one operational sandbox for artificial intelligence by August 2, 2026, Romania still remains a passive observer dominated by severe cross-cutting blockages. The most recent analyses record that the state has not designated its key actors, has not built a legal framework for implementation and does not have an operational structure. Moreover, Romania is in the small subgroup of states without pre-existing sandbox experience in financial technology (fintech), which hinders the transfer of knowledge and procedural practices. Thus, with the exception of isolated technical or academic initiatives, the notion of a testing space remains, from a state point of view, strictly at the stage of prospective strategy.
At the level of official documents, the National Strategy for Artificial Intelligence 2024–2027 mentions the development of sandboxes – testing spaces in regulatory matters. However, the responsibility for implementation is placed on a “National Authority for the Supervision of Artificial Intelligence”, an entity that is still at the stage of an institution “to be defined/created”. Given that the strategy expires at the end of next year, it is unlikely that the objectives will be undertaken in a timely manner by a still non-existent authority. A similar vulnerability is also observed in the National Strategy for Innovation in the Public Sector 2026–2030: although the term “sandbox” is mentioned 17 times, the operationalization method raises questions, and the chances of real iterative testing are minimal from both a strategic and operational point of view.
The limitations for the materialization of the sandbox tool are aggravated by fragmented coordination, with responsibility for the action being divided between institutions such as the Romanian Digitalization Authority (ADR) and the General Secretariat of the Government (SGG). Even the strategic documents recognize the existence of major systemic barriers: current processes and regulations are inflexible, the necessary innovation expertise is limited, and the capacity of public institutions to implement innovations is low. An eloquent example of this administrative capacity deficit is the very “Innovation Laboratory” within the SGG, a structure officially recognized in the National Innovation Strategy 2026-2030 as not having resources, staff, sufficiently stable governance or technical expertise to carry out collaborative innovation projects.
Philosophy and practice – what kind of state should Romania be and how do we get to a sandbox?
The sandbox is the latest public policy tool in an avant-garde regulatory repertoire (and, more broadly, mode of governance) that the specialized literature describes as flexible, experimentalist, and anticipatory – that is, the type of state that Romania needs to start practicing.
Flexibility involves adapting regulation to emerging technologies and regulated actors, by involving all parties in the regulatory process: it is achieved through mechanisms such as more permissive legal interpretations, explicitly granted exemptions or discretionary flexibility allowed by the European framework, combining the authorities’ commitment to developing their regulatory capacity with the competitiveness of the private sector in innovation.
Experimentalism embraces flexibility and seeks to manage uncertainty through learning and participation: objectives are set provisionally and revised recursively based on testing. In the form of a sandbox, this approach allows for the testing of hypotheses about the impact of technologies and the effectiveness of policies, as well as reflexivity on the part of authorities and innovators, accelerating the learning cycle compared to the traditional pace of public policies.
Anticipation derives from the first two principles and involves the integration of future-oriented thinking into public decision-making, in order to identify plausible trajectories of technologies in advance and intervene proactively. In practice, it involves prospecting and monitoring trends, followed by internal experimentation, the use of data to assess opportunities and risks, iterative testing, and the integration of lessons into state capabilities.
Transposed into the practice of forming the sandbox instrument, the latest OECD guidance, together with Law 225/2024 of the Republic of Moldova, provides Romania with a structure and an ideally applied sectoral example. Starting from these global guidelines and local applicability, Romania can create the sandbox instrument and apply it in most important sectors of the state.
Although we are required to implement an AI sandbox by August 2026, the potential of the tool is much broader and can be essential for any emerging technology that changes our lives and brings risks that classical legislation cannot anticipate. Another critical European example is the European Digital Identity Wallet (EUDI Wallet) – to manage the challenges related to biometric data and security, European states are already using sandboxes to test these wallets before their use is available to the general public (where the deadline is the end of 2026).
Similarly, in the context of minors’ safety on the internet, the sandbox becomes the ideal environment to test specific innovations, such as the digital wallet for children (kid’s wallet). Challenges such as age verification without exposing personal data can be overcome precisely by co-creating regulations and completing the necessary tests by companies, regulatory authorities and civil society, and Romania could contribute to innovation in the entire European space – if it overcomes its institutional-governmental blockages.
