The UK regulator says an AI sandbox with real data needs an Act of Parliament

The Information Commissioner’s Office published research on 30 July 2026 concluding that a statutory data protection sandbox — one that would let companies test AI and other emerging technologies under time-limited exemptions from data protection law — is feasible, but cannot be built by the regulator on its own. It would require primary legislation, together with safeguards protecting the ICO’s independence and the rights of the individuals whose data is involved.

The distinction matters. A conventional regulatory sandbox offers supervision and guidance, but participants must still comply with the UK GDPR and the Data Protection Act 2018 throughout. A statutory sandbox is different in kind: it uses legislation to permit limited, supervised departures from specific legal requirements while testing is under way. Only Parliament can grant that.

This lands next to DSIT’s AI Growth Lab, a cross-economy sandbox launched on 8 June 2026 in which specific rules can be temporarily and conditionally relaxed for licensed firms testing AI deployments, with legal services and conveyancing named as the first focus area.

The finding is a useful corrective to a common assumption in AI policy — that a willing regulator can simply create room to experiment. Where the constraint is statutory, regulatory goodwill does not reach it, and the fix is legislative time rather than guidance.