Islands as Regulatory Sandboxes for AI: What Works

The case for islands as regulatory sandboxes for AI is not romantic. It is arithmetic. A regulator who governs a bounded population, a short list of institutions and a coastline that doubles as a jurisdictional edge can watch a rule travel through the whole system and come back with a result. A continental regulator writing for hundreds of millions of people rarely gets that luxury, and so tends to legislate first and learn afterwards.

This piece looks at why islands keep turning up in the sandbox conversation, compares four live instruments in Malta, Mauritius, Spain and Bali, and is candid about where the island advantage stops being an advantage.

Why islands keep showing up in the sandbox conversation

What a sandbox actually is

The clearest legal definition now sits in the European Union's AI Act. Article 57 requires every Member State to establish at least one AI regulatory sandbox at national level, and defines it as a controlled framework set up by a competent authority in which providers can develop, train, validate and test an innovative AI system, where appropriate in real world conditions, for a limited time and under regulatory supervision. The terms are fixed in a sandbox plan agreed between the provider and the authority. The same article allows a sandbox to be established jointly with the authorities of other Member States, which matters more for small jurisdictions than it first appears.

A sandbox, in other words, is not an exemption. It is supervision with the lights on and a clock running.

Four structural advantages of an island

A short distance between rule and consequence. On an island, the regulator, the hospital, the utility and the ministry of finance are often a few streets apart. When a pilot misbehaves, the people who wrote the rule hear about it quickly.

A natural boundary for data. An island has an obvious answer to the question of where a dataset lives and whose law applies to it. That makes it easier to define what is inside the test and what is not.

Few enough regulators to coordinate. Overlapping competences are the usual reason AI pilots stall. A small state has fewer agencies to align, and can write the coordination into the instrument itself.

A reason to move first. Islands rarely win on scale, so many compete on legal agility instead. A sandbox is a cheap way to signal that a jurisdiction is open to new activity without rewriting its entire statute book.

Four island sandboxes, compared

Malta: an EU island with its own AI sandbox

Malta shows what an island looks like when it has to implement a continental law. Its Legal Notice 226 of 2025, gazetted on 10 October 2025, is the national implementing instrument for the AI Act. It makes the Malta Digital Innovation Authority the default market surveillance authority for AI systems, the notifying authority for conformity assessment bodies, and the operator of the national AI regulatory sandbox. It also requires the authority to coordinate with the Information and Data Protection Commissioner and sectoral regulators such as the Malta Financial Services Authority, with formal referral procedures between them.

That last point is the island advantage in legal form. The coordination problem that paralyses larger systems is written down as a procedure among a handful of named bodies.

Mauritius: a licence for what the law has not imagined yet

Mauritius takes a broader route that predates the AI boom. Its Regulatory Sandbox Licence, issued by the Economic Development Board, lets a company carry out a business activity for which there are no, or no adequate, provisions under any enactment, within agreed terms and for a defined period. The eligibility test is strict in an interesting way: the applicant must show evidence that a legal framework is missing, and where provisions already exist the applicant is not eligible.

Mauritius is now layering an AI specific instrument on top. A Bill introduced on 24 July 2026 proposes an AI City Scheme under which the EDB alone decides applications, with no statutory minimum investment, and certificate holders receive incentives, faster permits and regulatory facilitation. The qualifying activities and the incentives themselves are left to be prescribed later. Until the Bill passes and the guidelines appear, it is a signal of intent rather than a working sandbox.

The Canary Islands and Spain's first EU AI sandbox

Las Palmas, one of the two rooms of this summit, sits inside the jurisdiction that ran the European Union's first AI sandbox. To be precise about it: this is a Spanish national scheme, not a Canary Islands one. Royal Decree 817/2023 of 8 November created a controlled testing environment for AI Act compliance, open to entities resident in Spain or with a permanent establishment there.

When the first call closed, the government reported 44 applications and 12 high risk AI systems selected, spanning essential services, biometrics, employment, critical infrastructure, machinery and medical devices. The stated output was not a licence to operate but technical guidelines for everyone else. That is the most useful thing a sandbox can produce, and it is a lesson for islands: the point is the public learning, not the private permission.

Bali: digital residency as a policy pilot lane

Bali is the fourth case and the one closest to this summit. Bali Province's digital residency sandbox grants a ninety day residency, a policy pilot lane and access to municipal data, with a cohort opening at the summit. It fuses two things most jurisdictions keep separate: who may stay, and what they may test. If you are new to the first half of that pairing, start with what digital residency is.

Island governments are also working on the data layer beneath all of this. A working group of small island states has been finalising a sovereign data framework for climate adaptation designed to stay in public ownership even when the compute is leased. That is a sandbox principle applied to infrastructure, and it connects directly to what sovereign AI can mean for a small state.

Where the island advantage breaks

It would be easy to stop at the flattering part. Islands have real weaknesses as testbeds, and a policymaker should weigh them before borrowing the model.

Small samples travel badly. A system that behaves well among one island's population, languages and institutions may not behave well elsewhere. The speed that makes an island a good laboratory also makes its results local.

Sandbox shopping. A jurisdiction competing for capital can be tempted to make its sandbox the easiest door rather than the most informative one. The Mauritius design guards against part of this by requiring a genuine regulatory gap, but no eligibility test fixes a regulator that is under pressure to say yes.

Legal certainty ends at the shoreline. A pilot approved in one small state proves little to a regulator in a large one unless the two agreed in advance on what would count as evidence. Article 57's allowance for joint sandboxes is the obvious remedy, and it is still underused.

Thin institutional capacity. A small authority can coordinate quickly, but it may have only a few people able to audit a complex model. That is a reason to import expertise, not a reason to skip the audit.

None of these is fatal. Each is an argument for designing the sandbox around its own blind spots.

How to design an island AI sandbox that teaches something

For governments considering the model, the four instruments above suggest a short checklist.

1. Write the plan before the pilot. The AI Act's sandbox plan, with objectives, conditions, timeframe and methodology, is a good template whether or not you are bound by it.
2. Name the exit. Every participant should know what happens when the clock runs out: authorisation, adjustment or closure.
3. Publish what you learned. Spain's pilot produced guidelines for the whole market. An island sandbox that produces only permits has wasted its best asset.
4. Keep the data public even when the compute is not. The island data framework above shows the design choice is available.
5. Build a twin. Pair with another jurisdiction, ideally one with a different legal tradition, so a result proven in one place can be checked in another.
6. Map the obligations that follow. A sandbox ends, compliance does not. Participants should leave knowing what AI regulatory compliance actually demands once the supervision stops.

Where this is being worked out in person

The EX Future Summit runs a Government track built on exactly this ground: sovereign compute, digital residency and the island treated as a policy sandbox. It sits alongside tracks on research, finance, health technology and AI ethics.

The format follows the argument. The summit runs from 18 to 20 November 2026 as a single continuous thirty hour broadcast between Las Palmas in the Canary Islands and Bali, two islands twelve hours apart, so regulators and founders can join from any timezone. Online attendance is free for verified researchers, students and the EX community. For readers still separating the policy vocabulary, it helps to understand the difference between sovereign AI and data sovereignty before arguing about where a sandbox's data should live.

FAQ

Does the EU AI Act require every country to have an AI sandbox?

Yes. Article 57 requires each Member State to establish at least one AI regulatory sandbox at national level, and allows it to be set up jointly with other Member States.

Can a foreign company join Spain's AI sandbox?

Only through a Spanish presence. Royal Decree 817/2023 limits participation to entities resident in Spain or with a permanent establishment there, including groupings led by such an entity.

Who runs Malta's AI regulatory sandbox?

The Malta Digital Innovation Authority, under Legal Notice 226 of 2025, coordinating with the data protection commissioner and sectoral regulators where their competences overlap.

Is a regulatory sandbox a way to avoid regulation?

No. It is time limited supervision under an agreed plan. In Mauritius the sandbox licence is only available where no adequate legal framework exists, so it cannot be used to sidestep rules that already apply.