The Spanish artificial intelligence sandbox: who can enter, what is tested and how long it lasts under RD 817/2023

A regulatory sandbox is a controlled space where companies and the administration test together how a rule is complied with before it is applied on a large scale. Spain created its own for artificial intelligence through Royal Decree 817/2023 of 8 November, published in the BOE on 9 November 2023. It came into force the day after its publication.

For firms that advise technology companies, knowing this instrument is useful. And so it is for those developing their own tools.

What it is for

Under its Article 1, the royal decree creates a controlled test environment to trial compliance with certain requirements by AI systems that may pose risks to safety, health and fundamental rights. It also regulates how the systems and participating entities are selected.

The competent body, under Article 3, is the Secretariat of State for Digitalisation and Artificial Intelligence.

Who can take part

• AI providers, who develop a system and market it or put it into service under their own name or brand.
• Users, who use a system under their authority. Under Article 5.2, they can only join together with the provider.

Both must be resident in Spain, have a permanent establishment in Spain or be part of a group of entities with their main domicile in Spain.

Excluded systems

Article 5.6 excludes, among others, military or defence and national security systems, and those that use subliminal techniques, exploit vulnerabilities, carry out social scoring or real-time remote biometric identification in public spaces for law enforcement, except for the exceptions provided.

How selection works

1. The Secretariat of State approves a call for applications.
2. Applications are submitted within twenty working days.
3. Each application covers a single system.
4. Criteria assessed include innovation, social impact, explainability, alignment with the Charter of Digital Rights, system maturity and provider size.
5. The decision must be issued within sixty working days of the call's publication. If it is not issued, the application is deemed rejected.

What participants must do

Articles 11 to 13 require implementing, under an agreed plan, requirements such as risk management, data quality, technical documentation, automatic logs, transparency, human oversight and accuracy, robustness and cybersecurity.

At the end, the participant carries out a self-assessment and submits a declaration of compliance. If it does not pass, it has three months to correct. That self-assessment has no effects outside the test environment. A gender impact report must also be prepared.

Article 14 adds the obligation to document a post-market monitoring system, proportionate to the risks.

Guarantees and conditions

• Data protection: the General Data Protection Regulation and Organic Law 3/2018 apply (Article 16).
• Liability: participants answer for damage they cause through breach, fault, negligence or wilful misconduct (Article 17).
• Confidentiality: the information provided is confidential, although anonymised data may be used to draw up guides (Article 18).
• No consideration: participants receive no payment in money or in kind (Article 4.3). In return, they may receive technical guides and advice, and those who complete the phases obtain a certificate and an assessment report.

Exit and early termination

Voluntary exit is requested through the designated channel and resolved within fifteen working days, with no right to compensation. Participation can also end early for breaches, loss of requirements, serious incidents or failing the compliance declaration.

Validity of the rule

The second final provision sets a maximum validity of thirty-six months from the royal decree's entry into force, or until the European Artificial Intelligence Regulation becomes applicable in Spain. It is worth bearing in mind: the instrument was born as temporary and the duration of each experience depends on its call.

What it offers a firm

• For technology clients, the sandbox offers a route of contact with the supervisor and a reference on how to document compliance.
• For compliance practice, the requirements being trialled anticipate what companies will have to prove. The dates of those obligations have changed, as we explain in the new AI Act timetable.

The state agency that supervises AI has among its aims promoting these environments, as we report in the article on the Spanish Agency for the Supervision of AI. More analysis in Legal AI.