As part of the government’s digitalisation strategy, the Danish Data Protection Agency, in collaboration with the Danish Agency for Digitisation, is establishing a regulatory sandbox for AI, where companies and authorities can access relevant expertise and guidance on GDPR when developing or using AI solutions.

It can be difficult for companies and authorities to navigate what is possible and permitted within the regulatory framework and where the boundaries lie when it comes to developing and using AI solutions.

Therefore, the Danish Data Protection Agency and the Danish Agency for Digitisation have established a regulatory sandbox for AI, where companies and authorities can get free access to relevant expertise and guidance on the current legal framework, initially with a focus on GDPR.

“Developments in AI are moving fast. Therefore, it can benefit everyone if companies, organisations and regulators join forces to find a fast, legal and practical path from idea to operation of new solutions. In addition to helping companies and authorities along the way in specific projects, we ourselves will learn more along the way and will of course share our knowledge and experience with other interested parties,” says Cristina Angela Gulisano, Director of the Danish Data Protection Agency.

A sandbox programme provides, among other things

• Free access to relevant expertise and guidance
• Increased confidence in the finished project, product or service
• Better understanding of regulatory requirements, our expectations and the impact of regulations on business
• Increased perception of the organisation or authority as responsible and proactive in approaching the ethical and responsible use of AI
• Opportunity to inform and contribute to future guidance efforts from the Danish Data Protection Agency and the Danish Agency for Digitisation

The sandbox aims to support innovation and the use of good AI solutions through project- and practice-oriented guidance on specific regulatory requirements, thereby helping to ensure responsible and legal use of AI solutions.

The purpose of the regulatory sandbox is also to help reduce the time from development to operation and ensure that fewer projects fail or are cancelled due to uncertainty about the regulatory framework.

What is it like to be part of a sandbox programme?

All types of companies, authorities and other organisations can apply to participate in the sandbox.

The length of a sandbox programme is flexible and will depend on the scope and complexity of the specific project. We expect a typical project programme to last between 3 and 6 months. For each sandbox programme, an individual project plan is drawn up that describes what each sandbox programme will consist of.

Some months can be intense with multiple meetings or workshops. It is important that all project participants are able to set aside time to attend the meetings and to drive the work forward between meetings. In the final part of the process, a report will be produced in collaboration with the participating organisation based on the lessons learned from the sandbox process so that others can benefit from them.

https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2024/mar/ny-regulatorisk-sandkasse-for-ai