Government AI Sandboxes Need a Constitutional Makeover, Study Warns

The conceptual origins of the regulatory sandbox help explain why its migration into the public sector is not straightforward. When the United Kingdom’s Financial Conduct Authority introduced the model in the mid-2010s, it was addressing a specific problem: fintech firms with promising products were deterred from entering regulated markets because compliance costs and legal uncertainty were highest before a product had any track record. The sandbox allowed a firm to test a product with real consumers under a regulator’s supervision, sometimes with temporary waivers of specific rules, so that both the firm and the regulator could learn what risks actually materialized. The state, in this arrangement, sits outside the experiment. It is the referee, the data collector, and the rule-writer, while the private innovator is the subject of observation. Every design feature of the conventional sandbox, from entry criteria to exit strategies, presumes this division of roles between a regulating state and a regulated market entrant.

Public sector AI experimentation inverts that division of roles. When a tax authority pilots an algorithm to detect suspected fraud, or a welfare agency deploys machine learning to prioritize benefit claims, the state is simultaneously the innovator, the regulator, the evaluator, and often the sole affected counterparty for citizens. There is no external firm whose market entry must be facilitated, and no conventional consumer making a voluntary purchase decision. Instead, the people affected are frequently captive audiences: taxpayers, benefit claimants, asylum seekers, and patients who cannot opt out of interacting with the state. This means that the consumer protection rationale at the heart of the traditional sandbox translates only imperfectly. Protecting a consumer from a faulty financial product is meaningfully different from protecting a claimant from a biased eligibility algorithm, because the claimant’s interaction with the state implicates constitutional rights to due process, equal treatment, and administrative justice rather than market fairness alone.

The experimentalist governance tradition offers a useful lens for understanding what sandboxes are meant to accomplish, and also where they fall short. Experimentalist frameworks, as developed in the scholarship the article engages with, are characterized by a recursive loop: broad framework goals are set, local actors are given discretion to pursue those goals through experimentation, results are monitored and reported upward, and the framework goals are then revised in light of what was learned. Peer review, benchmarking, and iterative revision are central. A sandbox fits this logic naturally, because it generates evidence about an innovation under controlled conditions and feeds that evidence back into regulation. But experimentalism also presupposes a degree of independence between the experimenting unit and the monitoring unit. When the state experiments on its own administrative processes, the monitoring function risks becoming self-review, which is precisely the structural weakness that administrative law doctrines such as impartial decision-making and independent appeals were designed to counteract.

The pacing problem that motivates sandbox adoption is particularly acute for AI in government. Legal scholarship has long observed that innovation outpaces regulation, but AI compresses development cycles to a degree that reactive, statute-by-statute lawmaking cannot match. An algorithmic system can be retrained, redeployed, and materially altered in behavior within weeks, while legislative amendment takes years. Moreover, the technical properties of AI systems strain established legal categories. Opacity complicates the duty to give reasons for administrative decisions, a cornerstone of administrative law across many jurisdictions. Statistical bias complicates equality guarantees, because discrimination may emerge from training data rather than from any identifiable discriminatory intent. Distributed development pipelines complicate liability attribution, since a government agency, a commercial vendor, and an open-source model developer may each contribute to a harmful outcome. These are not merely compliance hurdles; they are challenges to the conceptual architecture of public law itself.

The EU AI Act adds an important institutional dimension to this landscape. By mandating that member states establish AI regulatory sandboxes, the Act embeds experimentalist governance into binding European law, and it explicitly contemplates testing before market entry or operational deployment. This is significant because it signals legislative recognition that supervised experimentation can serve both innovation policy and regulatory learning simultaneously. Yet the Act’s sandbox provisions, like the national sandboxes in the United Kingdom, Norway, and Finland that preceded them, were largely conceived with private developers in mind: companies seeking to bring AI products to European markets under conditions of legal uncertainty. The extension of sandbox logic to public sector deployment, where the state itself is the deployer, stretches a framework built around market entry toward institutional contexts it was never designed to govern.

One way to see the mismatch clearly is to compare the seven parameters along which the article distinguishes public sector sandboxes from their private sector predecessors. The primary purpose of a conventional sandbox is innovation promotion balanced against consumer protection; a public sector sandbox must instead balance administrative improvement against legality, fundamental rights, and democratic legitimacy. The legal basis differs because public authorities cannot simply be granted waivers from the constitutional and statutory obligations that bind them; a waiver that suspends due process in the name of experimentation would itself be unlawful in most legal systems. The risk model differs because the relevant harms are not market harms but rights harms, including wrongful denial of benefits, discriminatory enforcement, and erosion of procedural fairness. Each of these parameters requires deliberate redesign rather than straightforward transplantation.

Accountability structures illustrate the redesign problem concretely. In a private sector sandbox, remedies typically include compensation for affected consumers, withdrawal of the product, and enforcement action against the firm. In a public sector sandbox, the affected population may be an entire category of benefit recipients, and the remedy may require not merely withdrawing a tool but unwinding thousands of individual decisions made with its assistance. The Dutch childcare benefits scandal, frequently cited in the literature on algorithmic government, demonstrated how algorithmic decision-making at scale can generate mass injustice that ordinary complaint mechanisms were never equipped to remediate. A public sector sandbox must therefore build remediation capacity into the experimental design itself, including mechanisms for identifying affected individuals, reversing erroneous decisions, and providing redress, rather than treating remedies as an afterthought to be addressed at exit.

Transparency and participation raise parallel difficulties. Conventional sandboxes involve confidentiality arrangements that protect the commercial interests of participating firms, on the theory that firms will not disclose proprietary innovations to a regulator without assurance that trade secrets will be safeguarded. Public sector experimentation cannot rest on the same premise, because the public has a democratic interest in knowing how its government makes decisions about it. Meaningful participation requires more than publication of a final evaluation report; it requires engaging affected communities, civil society organizations, and independent experts at the design stage, when the objectives and risk tolerances of the experiment are being set. Without such participation, a public sector sandbox risks becoming a mechanism by which the state legitimizes decisions it has already made, rather than a genuine forum for democratic deliberation about the proper role of AI in governance.

Data governance is a further parameter where public sector sandboxes demand distinct treatment. Private sector sandboxes typically involve firms processing consumer data under relaxed regulatory supervision, with data protection law operating as one of the rule sets that may be flexibly interpreted. Public sector AI systems, by contrast, often depend on administrative datasets, such as tax records, social security files, and immigration data, that were collected for purposes unrelated to the proposed AI application. Linking such datasets for experimental purposes raises questions of purpose limitation, data minimization, and the legality of secondary use that go well beyond consumer privacy. A well-designed public sector sandbox must specify what data may be used, under what legal authority, with what safeguards against re-identification and function creep, and with what arrangements for deleting or archiving data once the experiment concludes.

Evaluation design and transfer pathways complete the picture. The point of a sandbox is not experimentation for its own sake but the generation of transferable knowledge: either the innovation is institutionalized into ordinary administration, or it is abandoned, and in either case the regulatory framework should be updated in light of what was learned. For private sector sandboxes, the transfer pathway is market entry followed by standard regulatory oversight. For public sector AI, the transfer pathway is institutionalization into administrative practice, which raises questions about whether the safeguards that applied during the experiment, such as human review of algorithmic outputs, enhanced documentation, and periodic audits, will persist after the sandbox closes. Experience with government algorithm deployments suggests that safeguards often erode after pilots end, as budget pressures and operational demands mount. A credible public sector sandbox framework must therefore specify binding conditions for institutionalization, not merely criteria for entry into testing.

Taken together, these considerations support the article’s central claim that adaptation, not adoption, is the appropriate posture toward sandboxes for public sector AI. The sandbox remains an attractive instrument because it preserves what experimentalist governance does best: structured, time-bound, evidence-generating experimentation under supervision, with feedback into the regulatory framework. But the normative foundations must be rebuilt around public law values rather than market values. This entails anchoring public sector sandboxes in explicit statutory authority, defining rights-protective risk thresholds that cannot be traded away for efficiency gains, establishing independent oversight that is institutionally separate from the experimenting agency, guaranteeing transparency and participation rights for affected populations, imposing strict data governance conditions, and designing evaluation and transfer mechanisms that carry safeguards forward into institutionalized deployment. Where these conditions are met, the sandbox can serve as a legitimate bridge between the pace of AI innovation and the stability that legality and democratic accountability require. Where they are not, the same instrument risks becoming a vehicle for normalizing practices that would not survive ordinary administrative law scrutiny.

Subject of Research: Adapting regulatory sandboxes as experimentalist governance frameworks for public sector artificial intelligence experimentation

Article Title: Adapting regulatory sandboxes as experimentalist governance frameworks for public sector artificial intelligence experimentation

Article References: Okonjo, J. (2026). Adapting regulatory sandboxes as experimentalist governance frameworks for public sector artificial intelligence experimentation. Global Public Policy and Governance, 6(2), 259-281. https://doi.org/10.1007/s43508-026-00147-x

Image Credits: AI Generated

DOI: 10.1007/s43508-026-00147-x

Keywords: artificial intelligence, regulatory sandboxes, public sector experimentation, experimentalist governance, publicness theory, administrative law, democratic accountability, rule of law, EU AI Act, algorithmic governance, transparency, innovation policy