Bathtubs, Boundaries, and Sandboxes: AI Regulatory Learning under Legal Uncertainty

Alessio Buscemi; Alfredo Capozucca; German Castignani; Marco Almada; Tom Deckenbrunnen

REVIEW 2 major objections 4 minor 1 cited by

Bathtubs, Boundaries, and Sandboxes: AI Regulatory Learning under Legal Uncertainty

T0 review · 2 major / 4 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that standardised AI technical sandboxes are the missing micro-foundation for regulatory learning under the EU AI Act.

desk verdict A genuinely useful analytical mapping of the AI Act's learning space, but the central claim that technical sandboxes are the missing micro-foundation rests on an engineering assumption the paper itself concedes is open. read the letter →

arxiv 2601.04094 v3 pith:WBVVXBB7 submitted 2026-01-07 cs.CY

Tom Deckenbrunnen , Alessio Buscemi , Marco Almada , Alfredo Capozucca , German Castignani This is my paper · ORCID

classification cs.CY

keywords regulatorylearningEUAIActtechnicalsandboxesColeman'sbathtubmeso-levelgovernancesemanticinteroperabilitymachine-readableevidenceadaptiveregulation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the EU AI Act's ability to learn and adapt depends on reliable evidence flowing from individual AI developers up to the European Commission, and that the missing piece is a shared technical assessment infrastructure. It models the Act's governance as a three-level 'bathtub'—micro, meso, macro—and identifies AI Technical Sandboxes as the engine that generates comparable, machine-readable evidence at the micro level. The paper claims that if these sandboxes are built with a common specification language, a shared data model, standardised tool documentation, and a reference ontology of metrics, then scattered compliance testing can be aggregated into regulatory signals. This matters because, without that micro-foundation, legal uncertainty persists and the Act's adaptive mechanisms—reviews, standards, and codes of practice—cannot be fed with the evidence they need.

What carries the argument

The argument runs through Coleman's bathtub—macro-to-micro enforcement and micro-to-macro evidence aggregation—extended with an explicit meso layer of intermediary actors such as national authorities, advisory bodies, and standardisation groups. Within that architecture, AI Technical Sandboxes act as boundary negotiating artifacts: the technical infrastructure that translates abstract legal requirements into operational assessment practice. Their load-bearing components are a domain-specific language for structuring assessment logic, an internal unified data model for storing heterogeneous results, standardised documentation of assessment tools, and a reference ontology of metrics to fix the

What would settle it

Run the same high-risk AI system through two independently built sandboxes that both use the proposed DSL, unified data model, and reference ontology, then compare outputs: if the resulting evidence requires substantial human re-interpretation or diverges on the same metric, the claim that AITSes provide a scalable micro-foundation is falsified. A simpler test is to collect real sandbox reports and check whether identical metric names map to identical mathematical definitions.

Watch

Extended reading notes

Core claim

The paper's central claim is that AI Technical Sandboxes (AITSes)—technical environments for assessing accuracy, robustness, and bias—are the missing micro-foundation of EU AI Act learning. Using Coleman's bathtub model of social learning, extended with a meso level, the paper maps how macro-level legal pressure reaches micro-level developers and how evidence should flow back up. It argues that this upward flow currently breaks: evidence is heterogeneous, manual, and non-comparable, so meso actors cannot aggregate it into signals the Commission could use to amend the Act, adopt delegated acts, or shape standards. AITSes are proposed as the standardised, reproducible environments that generat

Load-bearing premise

The central mechanism assumes that micro-level assessment evidence, once encoded in a shared specification language and ontology, stays semantically faithful and comparable across different sandbox instances; the paper itself flags this as unresolved.

Editorial extensions

If this is right

If AITSes adopt the proposed machine-readable formats, the three compliance pathways in the Act—self-assessment, AI regulatory sandboxes, and notified-body conformity assessment—produce comparable evidence rather than isolated reports.
Meso-level actors can aggregate this evidence into structured feedback, reducing the manual burden of interpreting text-based compliance documents.
The European Commission can use aggregated sandbox evidence to decide which standards deserve legal force, design codes of practice, and target amendments of the AI Act, closing the loop from micro-level experience to macro-level adaptation.
Because evidence is normalised at the source, smaller providers gain a lower-cost route to demonstrate compliance and contribute to standard-setting, partially countering the resource advantages of large firms.
The same assessment infrastructure can extend beyond the EU via the Brussels effect, potentially shaping how other jurisdictions collect regulatory evidence.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If legal uncertainty is, as the paper says, partly productive as a space for negotiating socio-technical meaning, then the push for a reference ontology of metrics could backfire by freezing contested definitions too early; the paper's own caution about overly granular thresholds points in this direction.
A direct test of the framework would be to run the same AI system through two independent sandboxes using the proposed DSL and ontology and measure whether the resulting evidence is comparable without human re-interpretation.
The bathtub model, once articulated for the AI Act, applies naturally to other adaptive regulations; the same micro/meso/macro decomposition could expose missing evidence infrastructure in data protection or digital services law.
The argument implies that regulators should invest in standardising the semantic meaning of metrics now, in parallel with technical standardisation, rather than waiting for harmonised standards to settle first.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

What you should know: this paper is worth reading if you work on AI Act implementation. It takes the regulatory learning provisions and builds a three-level bathtub model with an explicit meso layer, then identifies three concrete assessment scenarios where technical sandboxes (AITSes) would generate the evidence that feeds learning. The four functional actor categories (enforcers, meso-micro advisors, meso-macro advisors, standardisers) are carefully derived from the Act text, and the flow diagrams are a real contribution. The three-scenario taxonomy — self-assessment, AIRS, notified body — is new and useful, and it corrects the tendency in prior work to treat sandboxes as the only learning pathway.

The soft spot is exactly where the stress-test note lands. The paper's central claim is that AITSes are the 'missing micro-foundation' for regulatory learning, but that is asserted, not demonstrated. No evidence is given that current mechanisms actually fail in a way that requires this specific infrastructure, and more importantly, the load-bearing assumption — that standardised machine-readable evidence will be semantically comparable across sandbox instances — is flagged by the paper itself as unresolved. Section 4 admits the DSL is susceptible to interpretation errors without a semantic layer and then points to ontologies that are 'high-level' and not yet linked to operational technical requirements. The conclusion calls AITSes the bridge, but the bridge is conditional on an engineering achievement that has not been shown to be feasible. That is not an external objection; it is an internal prerequisite the paper leaves open.

To be fair, the authors are unusually honest about this. They explicitly discuss the semantic-interoperability problem, the risk of regulatory capture, and the incentive problem for firms sharing self-incriminating data. The mapping is coherent and reproducible from the Act's provisions, and there are no circular definitions or fitted parameters. The recommendation to reuse the authors' own DSL from [16] is a self-citation, but the central argument does not reduce to that DSL succeeding; any machine-readable format with a semantic layer would do.

Who this is for: people designing or studying AI sandboxes, AI Act implementation scholars, and anyone interested in regulatory learning theory in concrete institutional settings. It is not an empirical paper; it is a framework proposal with a strong normative push. It deserves a serious referee. The referee should push on the necessity claim and on semantic interoperability, but the paper is substantial enough to warrant that engagement.

Referee Report

2 major / 4 minor

Summary. The paper proposes a theoretical model of the EU AI Act's regulatory learning space, using Coleman's bathtub with an added meso level. It maps actors (Commission, AI Office, AI Board, national authorities, notified bodies, providers/deployers) to micro, meso, and macro levels and distinguishes enforcement and evidence-aggregation flows. The central claim is that AI Technical Sandboxes (AITSes)—a technical layer distinct from AI Regulatory Sandboxes (AIRS)—are the 'missing micro-foundation' that generates the evidence needed for scalable regulatory learning. The paper identifies three assessment scenarios (self-assessment, AIRS engagement, notified-body conformity assessment) and proposes four infrastructural requirements: a domain-specific language (DSL), an internal unified data model, standardised assessment-tool documentation, and a reference ontology of metrics. It concludes with a discussion of socio-political limitations.

Significance. If the central claim is accepted, the paper would provide a useful framework for designing technical sandbox infrastructure and a systematic mapping of the AI Act's learning pathways. The actor-level decomposition (Table 1, Figure 1) is careful and well-grounded in the AI Act; the AIRS/AITS distinction is analytically helpful. The paper also candidly discusses political risks such as regulatory capture and incentives for data sharing. However, the necessity claim that AITSes are essential for regulatory learning is not empirically demonstrated; it is a conjecture that depends on the resolution of the semantic-interoperability problem the paper itself identifies in Section 4. The value is thus primarily conceptual, and the contribution would be strengthened by softening the claim or providing a proof-of-concept.

major comments (2)

[Section 4, 'Reference Ontology of Metrics'] The central micro-macro evidence-aggregation mechanism requires that assessment data from different sandbox instances be semantically comparable. The paper concedes: 'Without this semantic layer, the DSL remains susceptible to interpretation errors across different sandbox instances; for example, if the same metric name is instantiated with divergent mathematical definitions, the resulting evidence becomes incomparable.' The proposed remedy—a reference ontology—is not developed: the paper states that 'the proposed ontologies remain high-level... with a closer link to operational technical requirements still missing,' and Section 6 defers implementation to future work. This is not a peripheral caveat; it is the load-bearing premise for the claim that AITSes are the 'missing micro-foundation.' Unless the ontology is specified or a feasibility argument is provided, the aggregation story rem
[Section 3.2 and Conclusion] The paper asserts that AITSes are 'the essential engine' and 'the missing micro-foundation' for regulatory learning, but the necessity claim is not supported. In the self-assessment scenario, the paper allows that an SME may conduct conformity assessment without an AITS; the argument that a 'consistent, reproducible methodology' requires AITSes is asserted rather than derived from the AI Act or from empirical evidence. The paper also does not consider alternative mechanisms for achieving standardization, such as mandating common machine-readable reporting formats through implementing acts (which Article 43 and Annex VI could enable). To be persuasive, the paper should either demonstrate that existing instruments are insufficient or explicitly present AITSes as one possible (rather than the necessary) technical solution. As it stands, the central contribution overreaches its evidence.

minor comments (4)

[Section 1, first paragraph] 'imposesex-ante' is missing a space; should be 'imposes ex-ante'.
[Section 2.1, paragraph 2] 'themesolevel' should be 'the meso level'.
[Section 4, 'Extensible Formal Configuration Language'] The DSL from [16] is not described in sufficient detail for readers unfamiliar with that prior work. A brief summary (e.g., its core and sector-specific extension layers) would improve accessibility and make the proposal more self-contained.
[Figure 1] The figure is dense and the arrow types are not explained in the caption. A short legend or a sentence in the text describing the meaning of the arrows would help readers follow the flow.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; only a minor non-load-bearing self-citation of the authors' own DSL proposal.

full rationale

The paper is a conceptual and architectural analysis rather than a fitted or predictive derivation. It maps the AI Act's actors onto Coleman's bathtub, identifies three assessment scenarios from Articles 43 and 57, and argues that AI Technical Sandboxes (AITSes) are the micro-level evidence generator needed for regulatory learning. That conclusion is analytic given the paper's own definitions (an AITS is 'a technical environment designed to evaluate system properties such as accuracy, robustness, cybersecurity, energy efficiency, transparency, and bias'); it does not arise from fitting parameters, from an equation that is equivalent to its own inputs, or from a uniqueness theorem. The only self-citation of note is in Section 4, where the Domain-Specific Language from the authors' prior work [16] is recommended as the syntactic core of AITSes. This is a design input, not evidence for the central claim, and the paper explicitly flags the unresolved semantic interoperability prerequisite: 'Without this semantic layer, the DSL remains susceptible to interpretation errors across different sandbox instances.' It also defers implementation to future work in Section 6. These limitations weaken the operational claim but do not make the argument circular. Score 2 reflects one minor self-citation that is not load-bearing.

Assumptions & free parameters 0 free parameters · 5 assumptions · 1 invented entities

The argument rests on interpretive assumptions from policy-learning theory and on the premise that standardized technical infrastructure can solve the evidence-aggregation problem. No free parameters are fitted, but several domain assumptions are load-bearing and would need empirical validation.

assumptions (5)

domain assumption Coleman's bathtub can be extended with an explicit meso level to model AI Act regulatory learning.
Invoked in Section 2.1 via [29, 71] to justify the meso level; this is a modeling choice from policy learning theory, not an empirically validated property of the AI Act.
domain assumption The EU AI Act is intended as an adaptive, learning-oriented framework rather than a fixed command-and-control instrument.
Section 1 and Section 2.1 characterize the Act as 'future-responsive, adaptive regulation'; this interpretive premise underlies the whole analysis.
domain assumption Harmonised standards for AI under the Act have not yet been approved, creating a gap in translating legal requirements.
Section 2.1 relies on [3, 54] for the current absence of approved vertical standards; if standards were completed, the urgency and role of AITSes would change.
domain assumption Aggregated micro-level evidence from conformity assessments can drive macro-level regulatory learning.
Sections 3.1 and 3.2 assume a causal chain from provider evidence through meso actors to Commission adaptation; no empirical support is provided.
domain assumption Machine-readable standardized reporting makes evidence comparable and enables scalable aggregation.
Section 4 argues that DSLs, unified data models, and ontologies will resolve heterogeneity; the paper itself flags semantic interoperability as unresolved.

invented entities (1)

AI Technical Sandbox (AITS) as an analytically distinct technical layer separate from AI Regulatory Sandbox (AIRS)
purpose: Serves as the micro-level evidence generator and technical backbone for regulatory learning under the AI Act.
The paper defines AITS operationally and assigns it a causal role, but it is a conceptual construct with no direct falsifiable handle outside the paper; its effectiveness is not measured.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Bathtubs, Boundaries, and Sandboxes: AI Regulatory Learning under Legal Uncertainty." pith.science (2026). https://pith.science/paper/WBVVXBB7

@misc{pith2026260104094,
  author       = {Pith},
  title        = {Pith review of: Bathtubs, Boundaries, and Sandboxes: AI Regulatory Learning under Legal Uncertainty},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WBVVXBB7}},
  note         = {Machine review of arXiv:2601.04094}
}

read the original abstract

Effective regulation of AI is a defining policy challenge, driven by their integration into all aspects of society. To remain responsive to their rapid development and emergent properties, policymakers across the globe rely on high-level principles and abstract legal requirements. Yet, while this flexibility supports future-proofing human-centred regulations and aligning them with socio-ethical values, it also causes legal uncertainty downstream as developers, companies, and auditors struggle with translating these abstract requirements into verifiable technical requirements. Using the AI Act as an example, this paper draws on Coleman's bathtub to analyse the regulatory learning space in AI governance. It argues that legal uncertainty cannot be fully reduced ex ante and that, within reasonable bounds, it is also necessary for regulatory learning because it creates the space in which boundary negotiation over socio-technical meaning can occur. Building on this analysis, the paper shows how boundary objects and boundary negotiating artifacts help explain the translation of legal requirements into operational practice. By examining technical sandbox frameworks, it further identifies concrete properties that technical infrastructures must possess to function effectively as boundary negotiation artifacts in AI assessment. The paper concludes that legal certainty remains the long-term aim, but that premature closure of regulatory instruments risks undermining the learning processes needed for adaptive governance.

Figures

Figures reproduced from arXiv: 2601.04094 by the authors.

**Figure 1.** The EU AI Act’s bathtub. the AI Act, delegated acts, or implementing acts. As the European Commission is the sole actor with the legal power to exert these adaptations, the Commission represents the macro level. In contrast to the micro and macro levels, the meso level consists of those actors who are tasked with translation of the macro-micro transition on the one hand and evidence aggregation of the micro-macro tr… view at source ↗

**Figure 2.** The flow of information in the self-assessment by an SME. [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

**Figure 3.** Work and information flow in the AIRS scenario. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

AI Sandboxes: A Threat Model, Taxonomy, and Measurement Framework
cs.CR 2026-06 unverdicted novelty 5.0 of 10

The paper presents a threat model, taxonomy, and six-dimension measurement framework for AI sandboxes to clarify valid testing claims for safety, security, and regulatory assurance.

Reference graph

Works this paper leans on

71 extracted references · 16 canonical work pages · cited by 1 Pith paper

[16]

Alessio Buscemi, Thibault Simonetto, Daniele Pagani, German Castignani, Maxime Cordy, and Jordi Cabot. 2025. The Sandbox Configurator: A Framework to Support Technical Assessment in AI Regulatory Sandboxes. arXiv:2509.25256 [cs.CY] https://arxiv.org/abs/2509.25256

arXiv 2025
[1]

d.].Better Regulation: Guidelines and Toolbox

[n. d.].Better Regulation: Guidelines and Toolbox. https://commission.europa.eu/law/law-making-process/better-regulation/better-regulation- guidelines-and-toolbox_en
[2]

[n. d.]. RDF 1.1 Concepts and Abstract Syntax. https://www.w3.org/TR/rdf11-concepts/
[3]

CEN-CENELEC

CEN-CENELEC 2025.Update on CEN and CENELEC’s Decision to Accelerate the Development of Standards for Artificial Intelligence. CEN-CENELEC. https://www.cencenelec.eu/news-events/news/2025/brief-news/2025-10-23-ai-standardization/

2025
[4]

2024. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689. OJ L 2024/1689, 12 July 2024

2024
[5]

CEN-CENELEC

CEN-CENELEC 2025.Small and Medium Enterprises (SMEs). CEN-CENELEC. https://www.cencenelec.eu/get-involved/small-and-medium- enterprises-smes/smes-and-standards/

2025
[6]

Trump Administration. 2025. America’s AI Action Plan. https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf AI regulatory framework emphasizing innovation, free speech, borderless open AI

2025
[7]

Deirdre Ahern. 2021. Regulatory Lag, Regulatory Friction and Regulatory Transition as FinTech Disenablers: Calibrating an EU Response to the Regulatory Sandbox Phenomenon.European Business Organization Law Review22, 3 (2021), 395–432. doi:10.1007/s40804-021-00217-z

work page doi:10.1007/s40804-021-00217-z 2021

Show all 71 references

[8]

Deirdre Ahern. 2025. The New Anticipatory Governance Culture for Innovation: Regulatory Foresight, Regulatory Experimentation and Regulatory Learning.European Business Organization Law Review26, 2 (June 2025), 241–283. doi:10.1007/s40804-025-00348-7

2025 doi
[9]

Deirdre Ahern. 2025. Operationalising AI Regulatory Sandboxes under the EU AI Act: The Triple Challenge of Capacity, Coordination and Attractiveness to Providers | Cambridge Forum on AI: Law and Governance.Cambridge Core(2025), e35. doi:10.1017/cfl.2025.10023

2025
[10]

Marco Almada and Nicolas Petit. 2025. The EU AI Act: Between the Rock of Product Safety and the Hard Place of Fundamental Rights.Common Market Law Review62, 1 (Feb. 2025), 85–120. doi:10.54648/COLA2025004

2025 doi
[11]

Mandepanda Sharmista Appaya, Helen Luskin Gradstein, and Mahjabeen Haji Kanz. 2020. Global experiences from regulatory sandboxes. (2020). https://documents.worldbank.org/en/publication/documentsreports/documentdetail/912001605241080935/Global-Experiences-from- Regulatory-Sandboxes

2020
[12]

Julien Arnal. 2024. AI at Risk in the EU: It’s Not Regulation, It’s Implementation.European Journal of Risk Regulation (2024). https://www.cambridge.org/core/journals/european-journal-of-risk-regulation/article/ai-at-risk-in-the-eu-its-not-regulation-its- implementation/A9FD12...

2024
[13]

2020.The Brussels Effect(1 ed.)

Anu Bradford. 2020.The Brussels Effect(1 ed.). Oxford University PressNew York, 25–66. doi:10.1093/oso/9780190088583.003.0003

2020
[14]

Serrano, and Eduardo Fernández-Medina

Carlos Mario Braga, Manuel A. Serrano, and Eduardo Fernández-Medina. 2025. Towards a Methodology for Ethical Artificial Intelligence System Development: A Necessary Trustworthiness Taxonomy.Expert Systems with Applications286 (Aug. 2025), 128034. doi:10.1016/j.eswa.2025.128034...

2025
[15]

Ullman, Fernando Martinez-Plumed, Joshua B

Ryan Burnell, Wout Schellaert, John Burden, Tomer D. Ullman, Fernando Martinez-Plumed, Joshua B. Tenenbaum, Danaja Rutar, Lucy G. Cheke, Jascha Sohl-Dickstein, Melanie Mitchell, Douwe Kiela, Murray Shanahan, Ellen M. Voorhees, Anthony G. Cohn, Joel Z. Leibo, and Jose Hernandez-Orallo
[17]

Andrea Campagner, Riccardo Angius, and Federico Cabitza. 2023. A Question of Trust: Old and New Metrics for the Reliable Assessment of Trustworthy AI:. InProceedings of the 16th International Joint Conference on Biomedical Engineering Systems and Technologies. SCITEPRESS - Sci...

2023 doi
[18]

Celso Cancela-Outeda. 2024. The EU’s AI Act: A Framework for Collaborative Governance.Internet of Things27 (2024), 101291. doi:10.1016/j.iot. 2024.101291

2024
[19]

Samuel Carey. 2025. Regulating Uncertainty: Governing General-Purpose AI Models and Systemic Risk.European Journal of Risk Regulation (2025). https://resolve.cambridge.org/core/journals/european-journal-of-risk-regulation/article/regulating-uncertainty-governing-generalpurpose...

2025
[20]

Albana Celepija, Alessio Palmero Aprosio, Bruno Lepri, and Raman Kazhamiakin. 2025. AI Product Cards: A Framework for Code-Bound Formal Documentation Cards in the Public Administration.Data & Policy7 (Jan. 2025), e1. doi:10.1017/dap.2024.55

2025 doi
[21]

Xuechen Chen and Lu Xu. 2025. State, Society, and Market: Interpreting the Norms and Dynamics of China’s AI Governance.Computer Law & Security Review59 (Nov. 2025), 106206. doi:10.1016/j.clsr.2025.106206

2025
[22]

James S. Coleman. 1986. Social Theory, Social Research, and a Theory of Action.Amer. J. Sociology91, 6 (1986), 1309–1335. jstor:2779798

1986
[23]

European Commission. 2025. Draft Commission Implementing Regulation Laying down Rules for the Application of Regulation (EU) 2024/1689 of the European Parliament and of the Council as Regards the Establishment, Development, Implementation, Operation and Supervision of AI Regul...

2025
[24]

Ben Crum. 2025. Brussels Effect or Experimentalism? The EU AI Act and Global Standard-Setting.Internet Policy Review14, 3 (2025). doi:10.14763/ 2025.3.2032

2025
[25]

de Carvalho, João Paulo A

Victorio A. de Carvalho, João Paulo A. Almeida, and Giancarlo Guizzardi. 2014. Using Reference Domain Ontologies to Define the Real-World Semantics of Domain-Specific Languages. InAdvanced Information Systems Engineering, Matthias Jarke, John Mylopoulos, Christoph Quix, Colett...

2014 doi
[26]

Deloitte. 2024. EU AI Act Survey: Uncertainty in Implementation.Deloitte Legal Research(2024). https://www.deloitte.com/dl/en/services/legal/ research/umfrage-eu-ai-act-2024.html

2024
[27]

Daan Di Scala, Sophie Lathouwers, and Michael van Bekkum. 2025. Bridging the AI Trustworthiness Gap between Functions and Norms. doi:10.48550/ARXIV.2512.20671

2025 doi
[28]

Mario Draghi. 2024. EU Competitiveness Report (Draghi Report). https://sciencebusiness.net/news/ai/eu-losing-narrative-battle-over-ai-act-says- un-adviser

2024
[30]

Martin Ebers. 2025. Truly Risk-based Regulation of Artificial Intelligence How to Implement the EU’s AI Act.European Journal of Risk Regulation16, 2 (June 2025), 684–703. doi:10.1017/err.2024.78

2025 doi
[31]

European Commission. 2025. Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act). C(2025) 924 final. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-ai-system-definition-facilitate-f...

2025
[32]

2025.Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act)

European Commission. 2025.Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act). Technical Report C(2025) 924 final ANNEX. European Union. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidel...

2025
[33]

Directorate General for Parliamentary Research Services

European Parliament. Directorate General for Parliamentary Research Services. 2018.EU Agencies, Common Approach and Parliamentary Scrutiny. Publications Office. https://data.europa.eu/doi/10.2861/656418

2018 doi
[34]

2025.EU Regulatory Sandboxes for AI (EUSAiR) Roadmap

EUSAiR Consortium. 2025.EU Regulatory Sandboxes for AI (EUSAiR) Roadmap. Project Deliverable. EUSAiR Project. https://eusair-project.eu/app/ uploads/2025/04/EUSAIR_RoadMap_v1_final.pdf

2025
[35]

Financial Conduct Authority. 2017. Regulatory sandbox lessons learned report. (2017). https://www.fca.org.uk/publication/research-and- data/regulatory-sandbox-lessons-learned-report.pdf

2017
[36]

Financial Times. 2025. European CEOs urge Brussels to halt landmark AI Act.Financial Times(3 July 2025). https://www.ft.com/content/a825759e- aec8-4184-bc73-f604f169204c

2025
[37]

Timnit Gebru, Jamie Morgenstern, Briana Vecchione, Jennifer Wortman Vaughan, Hanna Wallach, Hal Daumé, and Kate Crawford. 2021. Datasheets for Datasets. arXiv:1803.09010 [cs] doi:10.48550/arXiv.1803.09010

2021 doi arXiv
[38]

2024.From Blueprint to Reality: Implementing AI REgulatory Sandboxes under the AI Act

Nathan Genicot. 2024.From Blueprint to Reality: Implementing AI REgulatory Sandboxes under the AI Act. Technical Report. FARI & LSTS Research Group (VUB), Brussels. Manuscript submitted to ACM The Bathtub of European AI Governance: Identifying Technical Sandboxes as the Micro-...

2024
[39]

Nathan Genicot and Thiago Guimaraes Moraes. 2025. Exploring the Boundaries of AI Regulatory Sandboxes under the AI Act: Flexibility and Real-World Testing.Cambridge Forum on AI: Law and Governance1 (Jan. 2025), e36. doi:10.1017/cfl.2025.10013

2025
[40]

Ahmad Ghazawneh and Ola Henfridsson. 2013. Balancing Platform Control and External Contribution in Third-Party Development: The Boundary Resources Model.Information Systems Journal23, 2 (2013), 173–192. doi:10.1111/j.1365-2575.2012.00406.x

2013
[41]

Pandit, Sven Schade, Declan O’Sullivan, and Dave Lewis

Delaram Golpayegani, Isabelle Hupont, Cecilia Panigutti, Harshvardhan J. Pandit, Sven Schade, Declan O’Sullivan, and Dave Lewis. 2024. AI Cards: Towards an Applied Framework for Machine-Readable AI and Risk Documentation Inspired by the EU AI Act. InPrivacy Technologies and Po...

2024 doi
[42]

Pandit, and Dave Lewis

Delaram Golpayegani, Harshvardhan J. Pandit, and Dave Lewis. 2022. AIRO: An Ontology for Representing AI Risks Based on the Proposed EU AI Act and ISO Risk Management Standards. InTowards a Knowledge-A ware AI. IOS Press, 51–65. doi:10.3233/SSW220008

2022 doi
[43]

Mélanie Gornet and Winston Maxwell. 2024. The European Approach to Regulating AI through Technical Standards.Internet Policy Review13, 3 (July 2024). doi:10.14763/2024.3.1784

2024 doi
[44]

2025.Interplay between the AI Act and the EU Digital Legislative Framework

Hans Graux, Krzysztof Garstka, and Nayana Murali. 2025.Interplay between the AI Act and the EU Digital Legislative Framework. Technical Report. Policy Department for Transformation, Innovation and Health Directorate-General for Economy, Transformation and Industry

2025
[45]

Gstrein, Noman Haleem, and Andrej Zwitter

Oskar J. Gstrein, Noman Haleem, and Andrej Zwitter. 2024. General-Purpose AI Regulation and the European Union AI Act.Internet Policy Review 13, 3 (Aug. 2024). doi:10.14763/2024.3.1790

2024 doi
[46]

Julio Hernandez, Delaram Golpayegani, and Dave Lewis. 2025. An Open Knowledge Graph-Based Approach for Mapping Concepts and Requirements between the EU AI Act and International Standards.AI and Ethics5, 5 (Oct. 2025), 4463–4474. doi:10.1007/s43681-025-00708-6

2025 doi
[47]

Ari Holtzman, Peter West, and Luke Zettlemoyer. 2025. Generative Models as a Complex Systems Science: How Can We Make Sense of Large Language Model Behavior?Journal of Social Computing6, 2 (June 2025), 75–94. doi:10.23919/JSC.2025.0009

2025
[48]

Chawla, Jian Pei, Jianfeng Gao, Michael Backes, Philip S

Yue Huang, Chujie Gao, Siyuan Wu, Haoran Wang, Xiangqi Wang, Yujun Zhou, Yanbo Wang, Jiayi Ye, Jiawen Shi, Qihui Zhang, Yuan Li, Han Bao, Zhaoyi Liu, Tianrui Guan, Dongping Chen, Ruoxi Chen, Kehan Guo, Andy Zou, Bryan Hooi Kuen-Yew, Caiming Xiong, Elias Stengel-Eskin, Hongyang...

2025 doi arXiv
[49]

Isabelle Hupont, David Fernández-Llorca, Sandra Baldassarri, and Emilia Gómez. 2024. Use Case Cards: A Use Case Reporting Framework Inspired by the European AI Act.Ethics and Information Technology26, 2 (March 2024), 19. doi:10.1007/s10676-024-09757-7

2024 doi
[50]

Ronald Jepperson and John W. Meyer. 2011. Multiple Levels of Analysis and the Limitations of Methodological Individualisms. 29, 1 (2011), 54–73. doi:10.1111/j.1467-9558.2010.01387.x

2011
[51]

Robert Kilian, Linda Jäck, and Dominik Ebel. 2025. European AI Standards – Technical Standardisation and Implementation Challenges under the EU AI Act.European Journal of Risk Regulation16, 3 (Sept. 2025), 1038–1062. doi:10.1017/err.2025.10032

2025
[52]

Noam Kolt, Michal Shur-Ofry, and Reuven Cohen. 2025. Lessons from Complex Systems Science for AI Governance.Patterns6, 8 (Aug. 2025), 101341. doi:10.1016/j.patter.2025.101341

2025
[53]

Dave Lewis, Maria Lasek-Markey, Donya Golpayegani, and Harshvardhan J. Pandit. 2025. Mapping the Regulatory Learning Space for the EU AI Act. arXiv preprint arXiv:2503.05787. https://arxiv.org/abs/2503.05787

2025 arXiv
[54]

Andrew Leyden. 2025. Standards and the EU AI Act: Legitimacy, State of Play, and Future Challenges.Information & Communications Technology Law0, 0 (Oct. 2025), 1–31. doi:10.1080/13600834.2025.2570966

2025
[55]

Marjan Mernik, Jan Heering, and Anthony M. Sloane. 2005. When and How to Develop Domain-Specific Languages.Comput. Surveys37, 4 (Dec. 2005), 316–344. doi:10.1145/1118890.1118892

2005
[56]

Thomas Metcalf. 2025. AI Safety and Regulatory Capture.AI & SOCIETY(Aug. 2025). doi:10.1007/s00146-025-02534-0

2025 doi
[57]

Krzysztof Miksa, Pawel Sabina, and Marek Kasztelnik. 2010. Combining Ontologies with Domain Specific Languages: A Case Study from Network Configuration Software. InReasoning Web. Semantic Technologies for Software Engineering: 6th International Summer School 2010, Dresden, Ger...

2010 doi
[58]

Margaret Mitchell, Simone Wu, Andrew Zaldivar, Parker Barnes, Lucy Vasserman, Ben Hutchinson, Elena Spitzer, Inioluwa Deborah Raji, and Timnit Gebru. 2019. Model Cards for Model Reporting. InProceedings of the Conference on Fairness, Accountability, and Transparency. ACM, Atla...

2019
[59]

Stéphane Moyson, Peter Scholten, and Christopher M Weible. 2017. Policy Learning and Policy Change: Theorizing Their Relations from Different Perspectives.Policy and Society36, 2 (2017), 161–177. doi:10.1080/14494035.2017.1331879

2017
[60]

Jessica Newman. [n. d.]. A Taxonomy of Trustworthiness for Artificial Intelligence. ([n. d.])
[61]

Claudio Novelli, Philipp Hacker, Jessica Morley, Jarle Trondal, and Luciano Floridi. 2025. A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities.European Journal of Risk Regulation16, 2 (2025), 566–590. doi:10.1017/err.2024.57 Manu...

2025 doi
[62]

2025.Regulatory Sandbox Toolkit

Organisation for Economic Co-operation and Development (OECD). 2025.Regulatory Sandbox Toolkit. Technical Report. https://www.oecd.org/ content/dam/oecd/en/publications/reports/2025/06/regulatory-sandbox-toolkit_cc8d3e50/de36fa62-en.pdf

2025
[63]

Papazoglou

M.P. Papazoglou. 2003. Service-Oriented Computing: Concepts, Characteristics and Directions. InProceedings of the Fourth International Conference on Web Information Systems Engineering, 2003. WISE 2003.3–12. doi:10.1109/WISE.2003.1254461

2003 arXiv
[64]

DLA Piper. 2025. The European Commission Considers Pause on AI Act’s Entry into Application.AI Outlook Report(2025). https://www.dlapiper. com/en/insights/publications/ai-outlook/2025/the-european-commission-considers-pause-on-ai-act-entry-into-application

2025
[65]

Lavista Ferres

Anthony Cintron Roman, Jennifer Wortman Vaughan, Valerie See, Steph Ballard, Jehu Torres, Caleb Robinson, and Juan M. Lavista Ferres. 2024. Open Datasheets: Machine-readable Documentation for Open Datasets and Responsible AI Assessments. arXiv:2312.06153 [cs] doi:10.48550/arXi...

2024 doi arXiv
[66]

Hannah Ruschemeier. 2025. Experimental Regulation for AI Governance with Regulatory Sandboxes.Cambridge Forum on AI: Law and Governance 1 (Jan. 2025), e38. doi:10.1017/cfl.2025.10035

2025
[67]

Thibault Schrepel. 2025. Adaptive Regulation. social science research network:5416454 doi:10.2139/ssrn.5416454

2025 doi
[68]

Michael Veale and Frederik Zuiderveen Borgesius. 2021. Demystifying the Draft EU Artificial Intelligence Act. social science research network:3896852

2021
[69]

Koen Verhoest. 2018. Agencification in Europe. InThe Palgrave Handbook of Public Administration and Management in Europe, Edoardo Ongaro and Sandra Van Thiel (Eds.). Palgrave Macmillan UK, 327–346. doi:10.1057/978-1-137-55269-3_17

2018 doi
[70]

Welch, Hallie Eakin, Nadine Methner, Yamini Yogya, and Jinghuan Ma

Eric W. Welch, Hallie Eakin, Nadine Methner, Yamini Yogya, and Jinghuan Ma. 2025. Conceptualizing Meso-Level Organizations and Their Relations to Catalyze Transformative Climate Adaptation.WIREs Climate Change16, 6 (2025), e70034. doi:10.1002/wcc.70034

2025 doi
[71]

Bishoy Zaki. 2025. Conceptualising Organisational Policy Learning: Triggers, Processes, Outcomes, and Implications for Policy and Governance Change.Australian Journal of Public Administration(Nov. 2025). doi:10.1111/1467-8500.70031 Manuscript submitted to ACM

2025
[2023]

doi:10.1126/science.adf6369

Rethink Reporting of Evaluation Results in AI.Science380, 6641 (April 2023), 136–138. doi:10.1126/science.adf6369

2023 doi

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.

[1] [16]

Alessio Buscemi, Thibault Simonetto, Daniele Pagani, German Castignani, Maxime Cordy, and Jordi Cabot. 2025. The Sandbox Configurator: A Framework to Support Technical Assessment in AI Regulatory Sandboxes. arXiv:2509.25256 [cs.CY] https://arxiv.org/abs/2509.25256

arXiv 2025

[2] [1]

d.].Better Regulation: Guidelines and Toolbox

[n. d.].Better Regulation: Guidelines and Toolbox. https://commission.europa.eu/law/law-making-process/better-regulation/better-regulation- guidelines-and-toolbox_en

[3] [2]

[n. d.]. RDF 1.1 Concepts and Abstract Syntax. https://www.w3.org/TR/rdf11-concepts/

[4] [3]

CEN-CENELEC

CEN-CENELEC 2025.Update on CEN and CENELEC’s Decision to Accelerate the Development of Standards for Artificial Intelligence. CEN-CENELEC. https://www.cencenelec.eu/news-events/news/2025/brief-news/2025-10-23-ai-standardization/

2025

[5] [4]

2024. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689. OJ L 2024/1689, 12 July 2024

2024

[6] [5]

CEN-CENELEC

CEN-CENELEC 2025.Small and Medium Enterprises (SMEs). CEN-CENELEC. https://www.cencenelec.eu/get-involved/small-and-medium- enterprises-smes/smes-and-standards/

2025

[7] [6]

Trump Administration. 2025. America’s AI Action Plan. https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf AI regulatory framework emphasizing innovation, free speech, borderless open AI

2025

[8] [7]

Deirdre Ahern. 2021. Regulatory Lag, Regulatory Friction and Regulatory Transition as FinTech Disenablers: Calibrating an EU Response to the Regulatory Sandbox Phenomenon.European Business Organization Law Review22, 3 (2021), 395–432. doi:10.1007/s40804-021-00217-z

work page doi:10.1007/s40804-021-00217-z 2021