EU AI Act Art.59: Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox

Article 59 of the EU AI Act binds the provider and authorities. It requires Where personal data lawfully collected for other purposes is processed in an AI regulatory sandbox solely to develop, train and. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.

Specifics

Who does Art.59 bind?

The article binds the provider and authorities. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.

Application is set by Article 113, as amended by Regulation (EU) 2026/1744; check the timeline. See the full timeline.

What does Art.59 require?

Where personal data lawfully collected for other purposes is processed in an AI regulatory sandbox solely to develop, train and test an AI system, every one of the Art.59(1) conditions must be met cumulatively: the system is developed to safeguard a substantial public interest in one of the listed areas; the personal data is necessary because anonymised, synthetic or other non-personal data cannot effectively fulfil the Chapter III Section 2 requirement in question; effective monitoring mechanisms identify high risks to the rights and freedoms of data subjects and response mechanisms promptly mitigate them and stop the processing where necessary; the data sits in a functionally separate, isolated and protected processing environment under the prospective provider's control with access limited to authorised persons; originally collected data is shared further only in accordance with Union data protection law and personal data created in the sandbox is not shared outside it; the processing leads to no measures or decisions affecting the data subjects and does not affect their rights; appropriate technical and organisational measures protect the data and it is deleted once sandbox participation ends or the retention period expires; processing logs are kept for the duration of participation; a complete and detailed description of the process and rationale behind training, testing and validation is kept with the test results as part of the Annex IV technical documentation; and a short summary of the project, its objectives and expected results is published on the competent authority's website. Law enforcement processing must in addition rest on a specific Union or national law and meet the same cumulative conditions.

This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.59 (Regulation (EU) 2024/1689 on EUR-Lex).

What evidence should we keep for Art.59?

What does a linked control mean here?

A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.

Which NIST AI RMF controls line up with Art.59?

No NIST AI RMF control is recorded as a match for this obligation in the held rule set. It is left unlinked and marked, never guessed.

Which ISO/IEC 42001 controls line up with Art.59?

1 control in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.

What does the conformance kit add for Art.59?

The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.