Signal Scanner · REGULATION, STANDARDS & POLICY CHANGE · 12 October 2026

Regulatory Sandboxes Are Multiplying as Statutory Exemptions Give Way to Regulator Discretion

The EU, UK and Australia are adding sandboxes while offering participants advice or discretionary relief, not a right to exemption. Firms should treat a place as guidance, not cover, through 2028.

Produced using Shaping Tomorrow’s six-stage process for converting external change into decision-ready intelligence.
Scanned and filtered by AI. Stress-tested and judged by humans.

The consensus calls regulatory sandboxes the pro-innovation tool of 2026: the Commission counts 132 at national level across 15 Member States, up from 40 in 2021 (European Commission, 09/09/2026). Beneath the count, the power to waive a rule is not spreading with them. The EU's instrument is a non-binding Recommendation that allows derogations only where a Union act already provides them, the UK's new AI Growth Lab grants no exemptions, and Australia is repealing its statutory sandbox in favour of regulator discretion. Firms should treat a sandbox place as advice.

Signal Identification

A regulatory pivot: the sandbox is changing from a legal exemption into a supervised conversation. Participants gain access to regulators and evidence, not a waiver. On the available evidence only some US states still write waivers into statute (Emerging Technology Observatory, 23/07/2026).

Time horizon: 1-5 years, and it binds 2027 to 2028, shown when a regulator enforces against a sandbox participant for conduct its sandbox advice covered, or a government legislates a power to waive rules. (Milestones: Australia's response 7 September 2026; EU Recommendation proposed 9 September 2026; UK lab applications closed 27 September 2026.)
binds 2027 to 2028202620282029
Probability band: Medium (40 to 60%)
Probability band: Medium, 40 to 60%, the chance the signal binds within the window shown above.LowMediumHigh
Geographic / Jurisdictional Scope: Primary: the EU, UK and Australia. Spillover: US states with waiver sandboxes.
PrimaryEUUKAustralia
SpilloverUS states
Sectors exposed:
Fintech and payments firmsAI developers and adoptersLegal services firmsFinancial regulatorsCorporate compliance and legal teams

What's Changing

The count is rising but the instrument is weak. The Commission found 132 regulatory sandboxes at national level across 15 Member States, up from 40 in the 2021 survey, and proposes a Council Recommendation, which its own memorandum calls non-binding, under which derogations from applicable Union secondary law are envisaged only where Union acts already provide for them (European Commission, 09/09/2026). The UK's advisory AI Growth Lab opened to applicants in August and states that participation does not provide regulatory approval, endorsement or exemptions from legal obligations (GOV.UK, 03/08/2026).

Australia has gone furthest. Of the applications since 2020, ASIC accepted 19 entities (18% of applicants) and only one former participant has obtained an AFSL after exiting (Gilbert + Tobin, 15/09/2026). The Government agrees to progress repeal of the current ERS legislation and regulations and rely on ASIC's existing relief powers (Australian Treasury, 07/09/2026), a change FinTech Australia calls "a positive step" (Financial Standard, 09/09/2026). The test for the UK lab, one trade report notes, is whether regulator advice given inside it carries weight outside it (Resultsense, 06/08/2026).

More sandboxes, few places, and no right to exemption

National sandboxes, EU Commission surveys 2021 40 2025 132 The count rises; the power to waive does not Australian ERS since 2020 Entities Applications 103 Accepted 19 (18%) Licensed after exit 1

Sources: European Commission (09/09/2026) for the EU survey counts; Gilbert + Tobin (15/09/2026) for the Australian figures. Panels use different scales.

Disruption Pathway

Stage one, to 2027, is design: the Commission's proposal goes to the Council, Australia legislates repeal through a future prioritisation process (Financial Standard, 09/09/2026), and applications to the UK lab closed on 27 September (GOV.UK, 03/08/2026). Stage two, 2027 to 2028, is first use: advice given inside sandboxes meets real enforcement. Stage three, from 2029, is either settlement on advice-only sandboxes or the return of statutory waivers where firms lobby for them.

Stress concentrates in three places. Participants carry the legal risk, since the UK lab confers no exemption (GOV.UK, 03/08/2026). Access is narrow, as 18% of Australian applicants were admitted (Gilbert + Tobin, 15/09/2026). And the rules differ by state: Texas lets participants test for three years without authorisation and shields them from enforcement for waived laws (Emerging Technology Observatory, 23/07/2026). Two adaptations follow. Operationally, firms should record regulator advice in writing and map each rule to an owner before entering. Financially, launch budgets should assume full compliance and count the sandbox as time-to-market only.

Why This Matters Now

Chief compliance officers, general counsel and heads of product at fintech and AI firms own this. A market-entry plan that counts a sandbox place as legal cover will be wrong in the EU, UK and Australia, where on the available evidence no current instrument entitles a participant to a waiver. Regulators gain evidence and firms gain access, which has value, but neither cuts the compliance bill or the enforcement exposure. Boards should require every sandbox application to carry a full-compliance budget and a written record of what the regulator said, and should reserve waiver-dependent plans for the US states whose statutes provide them.

Decision-action posture for this signal: Prepare — apply where access matters, but commit capital only to launch plans that survive full compliance.

Counter-Argument

The strongest objection is that waivers were never the point. Industry reads the Australian repeal as a gain (Financial Standard, 09/09/2026), the Commission measures progress by the rise in sandboxes (European Commission, 09/09/2026), and where firms want exemptions the statutes exist: Utah agreements include waived regulations and Texas shields participants from enforcement for waived laws (Emerging Technology Observatory, 23/07/2026). On this view advisory access is what innovators need and nothing is withdrawn.

The reply is that waiver statutes are the exception: the source names Delaware, Utah and Texas, and no EU, UK or Australian instrument grants an entitlement. Even access is narrow in the one regime with data, 19 entities from 103 applications (Gilbert + Tobin, 15/09/2026). This report's reading is that firms price sandboxes as exemptions the law does not give.

Implications

On the available evidence the shift is durable in the jurisdictions covered: the EU instrument is non-binding (European Commission, 09/09/2026), the UK lab is advisory by design, and Australia has agreed to replace statute with discretion. The inflection window is 2027 to 2028, when the first sandbox advice meets the first enforcement decision. Regulators gain evidence at low legal cost; firms with documented advice and full-compliance budgets stand to gain; firms that read a place as cover stand to lose.

Early Indicators to Monitor

Disconfirming Signals

Strategic Questions

Keywords

Regulatory sandbox; AI Growth Lab; Enhanced Regulatory Sandbox; ASIC relief powers; Council Recommendation on regulatory sandboxes; derogation; regulatory exemption; Texas TRAIGA; Utah AI Policy Act; regulator discretion

Bibliography

Source tiers: Tier 1, governments, regulators and intergovernmental bodies. Tier 2, think-tanks, academic institutes, major consultancies and quality data providers. Tier 3, quality journalism and specialist trade press. Tier 4, vendor, company and practitioner sources, used only as directional corroboration.

How this was made

The Decision-Grade Intelligence Method

Shaping Tomorrow’s six-stage process for converting external change into decision-ready intelligence.

Scan · Filter · Stress-test · Judge · Trigger · Actionable Intelligence

See full methodology → · How we verify → · Track record →

This Signal Scan is one component of a Shaping Tomorrow intelligence cycle on Regulation, Standards & Policy Change. Every monitored topic also includes monthly Change Trackers that assess what is materially shifting in momentum, and a quarterly Decision Intelligence briefing that converts the cycle into board-level strategic implications. Cycles may also close with Action Triggers, an end-of-cycle synthesis that reads across the three formats and surfaces patterns no single deliverable carries on its own. Continuous intelligence on this topic is available as a Single-Topic or Multi-Topic programme.

Discuss a Tailored Programme

Prepared by Shaping Tomorrow: 12 October 2026