General rights and obligations of the regulatory sandbox coordinators
1. Regulatory sandbox coordinators shall manage the operations in the interoperability regulatory sandbox and its related projects throughout the lifespan of the interoperability regulatory sandbox.
2. Regulatory sandbox coordinators are specifically responsible for the following tasks:
(a)
to invite regulators to the interoperability regulatory sandbox;
(b)
to steer the regulatory dialogue with the regulators involved around the set-up of and the learnings from the projects;
(c)
to decide on the number of projects running sequential or in parallel during the lifespan of the interoperability regulatory sandbox;
(d)
to publish calls for participation in the interoperability regulatory sandbox on the Interoperable Europe Portal and admit participants to the interoperability regulatory sandbox, as referred to in Article 10;
(e)
to select projects to run in the interoperability regulatory sandbox, while verifying that each projects remains in the scope of the interoperability regulatory sandbox with particular attention to the following aspects:
—
to support the cross-border interoperability of trans-European digital public services involving participants from at least two different Member States, or from at least one public sector body and one Union entity,
—
to contribute to the development, testing and validation of an innovative interoperability solution, and
—
to identify the specific regulatory issues at stake and the guidance that is expected from the authorities supervising the interoperability regulatory sandbox;
(f)
to ensure that participation is based on a specific plan;
(g)
to determine a time-limit for participation in a project;
(h)
to decide on extension of a project, as referred to in Article 12(2) of Regulation (EU) 2024/903;
(i)
to end a project, as referred to in Article 15;
(j)
to ensure periodic and final reporting to the Commission and the Interoperable Europe Board;
(k)
to set up a risk management framework, as referred to in Article 12.
3. In case it is necessary to process personal data in the context of projects running in the interoperability regulatory sandbox, regulatory sandbox coordinators shall take the necessary measures to allow for the competent data protection authorities to effectively carry out their supervision tasks, as provided for in Article 11(1) of Regulation (EU) 2024/903.
Admission of participants and other actors
1. Regulatory sandbox coordinators shall publish on the Interoperable Europe Portal information on the eligibility and selection criteria for participation in the interoperability regulatory sandbox. Those criteria shall include the provision of information on the possibility for GovTech actors, including national or European standardisation organisations, notified bodies, research and experimentation labs, innovation hubs and companies wishing to test innovative interoperability solutions, in particular SMEs and start-ups, to be involved in the interoperability regulatory sandbox, as provided for in Article 12(1) of Regulation (EU) 2024/903.
2. Regulatory sandbox coordinators shall decide on requests from other Union entities, public sector bodies or GovTech actors seeking to join the interoperability regulatory sandbox as participants or other actors, based on the rules for the respective interoperability regulatory sandbox, published on the Interoperable Europe Portal according to paragraph 1.
3. The participants or other actors shall submit a declaration of commitment to the regulatory sandbox coordinators that provides for the assumption of obligations and the commitment for the candidate to meet financial, organizational, human resources and any other conditions that are relevant for this purpose.
General rights and obligation of participants
1. Participants that have been admitted to an interoperability regulatory sandbox according to Article 10 shall have the following obligations:
(a)
to contribute to the specific plan;
(b)
to assume full responsibility, as set out in Article 12(5) Regulation (EU) 2024/903, for the legality of the development, training, testing and validation of the interoperability solution;
(c)
to ensure that the interoperability solutions tested within the interoperability regulatory sandboxes comply with all applicable legal requirements and have obtained any necessary authorisations or approvals from competent authorities before they start the projects or that the competent authorities are involved in the interoperability regulatory sandbox;
(d)
to ensure, if personal data is processed within an interoperability regulatory sandbox, that such processing is in full compliance with applicable data protection law and to agree with the relevant data protection authorities, referred to in in Article 12(1) of Regulation (EU) 2024/903, on their expected involvement in the interoperability regulatory sandbox and its projects;
(e)
to adhere to the risk management framework, as set out in Article 12;
(f)
to regularly report on learnings in the interoperability regulatory sandbox, as specified in Article 13;
(g)
to ensure lawful handling of personal data processed in the projects as specified in Article 15(3).
2. Participants may exit the interoperability regulatory sandbox under the conditions set out in Article 14.
Risk management
1. Regulatory sandbox coordinators shall establish the risk management process for the interoperability regulatory sandbox covering the risk management process referred to in Article 12(3), point (d), of Regulation (EU) 2024/903. Regulatory sandbox coordinators shall define, implement, and monitor overarching risk management objectives for the interoperability regulatory sandbox, including specific risk management standards applicable to all projects therein, with due consideration of any mandatory risk management requirements pursuant to other applicable law. Regulatory sandbox coordinators shall ensure effective communication on risk management between participants, competent authorities, and other stakeholders.
2. Regulatory sandbox coordinators shall develop a specific risk management plan for each project that follows the risk management process referred to in paragraph 1.
3. Regulatory sandbox coordinators shall appoint one among them as risk manager for each project. The risk manager shall ensure that the project complies with the specific risk management plan referred to in paragraph 2 of this Article. Where risks are identified, the risk manager shall ensure that appropriate mitigation measures are taken.
4. In the case where appropriate risk mitigation is not feasible, the risk manager may temporarily suspend any project or participant’s involvement within the interoperability regulatory sandbox as an immediate safeguard. The risk manager shall promptly inform the regulatory sandbox coordinators and the relevant authorities. The single point of contact shall report this temporary suspension to the Commission.
5. The risk manager shall maintain records of risk management activities for the respective projects and make those records available for review by all regulatory sandbox coordinators and the Commission.
Reporting obligations
1. Regulatory sandbox coordinators shall establish a mechanism for periodic reporting that covers at least the topics referred to in Article 12(8) of Regulation (EU) 2024/903. In the case of processing of personal data in the projects, the reporting shall include metrics assessing the effectiveness of the innovative interoperability solution in qualifying personal data, along with the accuracy and fairness of the output and usability of the results produced by the solution for the relevant authorities.
2. The mechanism shall include collecting data from all projects on an ongoing basis that ensures that progress is tracked, risks are managed, and compliance with the interoperability regulatory sandboxes’ objectives and legal requirements is maintained. The mechanism shall cover reporting on the learnings from the dialogue with the regulators.
3. Regulatory sandbox coordinators shall submit the periodic reports to the Commission and the Interoperable Europe Board referred to in Article 12(8) of Regulation (EU) 2024/903 at least once every six months from the date of establishment of the interoperability regulatory sandbox.
4. All reports shall be published on the Interoperable Europe Portal. The reports shall not contain confidential information.
Exiting of participants
1. If a participant wants to exit the interoperability regulatory sandbox before the termination of the project that the participant is involved in, as referred to in Article 15, or the termination of the assigned task in the specific plan, the participant shall provide a detailed explanation to the regulatory sandbox coordinators and to the Commission of the reasons for exiting.
2. Participants exiting an interoperability regulatory sandbox shall have the following obligations:
(a)
to complete any outstanding requirements linked to the monitoring and reporting of their activity;
(b)
to ensure that the data collected and any interoperability solutions developed during the lifespan of the interoperability regulatory sandbox are managed in accordance with the applicable legislation, and with the conditions for admission to the interoperability regulatory sandbox, as defined by the sandbox coordinators; and
(c)
to take all necessary steps to mitigate potential risks for the success of the interoperability regulatory sandbox project and for public services and their delivery linked to the exiting the interoperability regulatory sandbox and its specific projects.
3. Upon the exiting of a participant from an interoperability regulatory sandbox, the regulatory sandbox coordinators shall assess the necessary measures with regard to the obligations set out in Article 9.
Termination of a project
1. Regulatory sandbox coordinators shall terminate a project in the interoperability regulatory sandbox in any of the following cases:
(a)
the project has fulfilled the objectives before the maximum initial duration is reached;
(b)
the regulators involved in the interoperability regulatory sandbox or other competent authorities have requested the termination of the project and no mitigation is possible;
(c)
the necessary funding to continue the activities is not available;
(d)
the project no longer fulfils the minimum criteria in terms of scope and participation set out in its specific plan and no mitigation is possible.
2. In case the regulatory sandbox coordinators plan to terminate a project before the initially scheduled ending date, the regulatory sandbox coordinators shall inform all participants in due time.
3. Personal data that was exceptionally processed in order to reach the objectives of a projects shall not be used as operative data outside the projects, unless there is a proper legal basis authorising a change of purpose.
4. Within three months following the termination of the projects, regulatory sandbox coordinators shall:
(a)
publish on the Interoperable Europe portal or a portal, catalogue or repository connected to the Interoperable Europe portal the interoperability solutions and related materials developed during the project, including documentation, version history, documented source code and references to open standards or technical specifications used, if such solutions and material are in line with the applicable quality criteria for the Interoperable Europe Portal;
(b)
where solutions are issued as open source, use the EUPL or another appropriate open source licence;
(c)
clearly indicate, if sharing restrictions apply due to:
—
intellectual property rights held by third parties,
—
sensitive critical infrastructure protection,
—
protection of defence interests or public security.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
