Codes, standards, sandboxes and innovation measures are four different tools in the AI Act, and they must not be confused. Harmonised standards under Article 40 can give a presumption of conformity where their references are published in the Official Journal. Codes of practice under Article 56 can help general purpose model providers demonstrate compliance until a harmonised standard is published. Codes of conduct under Article 95 are voluntary, for the voluntary application of defined requirements to AI systems. Regulatory sandboxes under Articles 57 to 59 provide supervised testing under a sandbox plan, and real world testing under Article 60 provides a separate route outside sandboxes. Innovation measures under Articles 62 and 63 support SMEs, startups and microenterprises. Each tool has its own legal basis, its own effect and its own limits, and this cluster deals with each one separately.
What are the four tools, and why must they be kept apart?
The four tools are standards, codes of practice, codes of conduct and sandboxes, with innovation measures as a supporting framework. Standards are technical specifications developed by European standardisation organisations under a Commission request, which can give a presumption of conformity when cited in the Official Journal. Codes of practice for general purpose models are voluntary instruments facilitated by the AI Office, which can be used to demonstrate compliance with Chapter V obligations until a harmonised standard is published. Codes of conduct are voluntary instruments for the voluntary application of specific requirements, including ethical guidelines, environmental sustainability, AI literacy, inclusive design and protection of vulnerable persons, to AI systems generally. Sandboxes are supervised testing frameworks established by competent authorities, with a sandbox plan, supervision and an exit report. Innovation measures are the support duties in Articles 62 and 63 for SMEs, startups, SMCs and microenterprises. Keeping the tools apart matters because each has a different legal effect. A standard can give a presumption of conformity. A code of practice can support a demonstration of compliance for general purpose models. A code of conduct does not give a presumption of conformity for high risk requirements. A sandbox does not authorise placing on the market. A reader who treats a code of conduct as a standard, or a sandbox as a certification, will misunderstand the file it needs to produce.
How do standards relate to the legal requirements?
Standards relate to the legal requirements through the presumption of conformity in Article 40. High risk AI systems and general purpose AI models that are in conformity with harmonised standards, or parts of them, whose references have been published in the Official Journal, are presumed to be in conformity with the requirements in Chapter III, Section 2 or, as applicable, with the obligations in Chapter V, Sections 2 and 3, to the extent that the standards cover those requirements or obligations. The presumption is therefore limited by coverage. A standard that covers quality management does not give a presumption for data governance, and a standard that covers one requirement in part gives a presumption only for the part it covers. Where no harmonised standard exists, is delayed or is insufficient, the Commission can adopt common specifications under Article 41, which can also give a presumption to the extent they cover the requirements. Where neither a standard nor a common specification covers a requirement, the provider must demonstrate compliance by other means, with the reasoning and evidence recorded. The provider must therefore map each requirement to the standard, specification or other means relied on, with gaps noted. A file that lists standards without a coverage map does not show that the presumption applies.
How do codes of practice and codes of conduct differ?
Codes of practice under Article 56 and codes of conduct under Article 95 differ in subject, in author and in effect. Codes of practice are for general purpose AI models, are facilitated by the AI Office, and are intended to allow providers to demonstrate compliance with Articles 53 and 55 until a harmonised standard is published. The General Purpose AI Code of Practice, published in July 2025, is the instrument for that purpose, with transparency and copyright and safety and security chapters. Codes of conduct are for AI systems generally, are facilitated by the AI Office and Member States, and concern the voluntary application of specific requirements, including the elements listed in Article 95(2), on the basis of clear objectives and key performance indicators. Codes of conduct can be drawn up by individual providers or deployers or by organisations representing them, with stakeholder involvement. Adherence to a code of conduct does not give a presumption of conformity with the high risk requirements, and a provider should not present it as such. A provider can use both instruments, for different purposes, but the record should state which instrument is relied on for which duty, with the version and the coverage recorded separately.
How do sandboxes and real world testing differ?
Regulatory sandboxes under Articles 57 to 59 and real world testing outside sandboxes under Articles 60 and 61 are two routes for testing in real world conditions, with different initiators, different approvals and different safeguards. A sandbox is established by a competent authority, operates under a sandbox plan agreed with the authority, involves other relevant authorities including data protection authorities, and ends with an exit report. Real world testing outside a sandbox is proposed by the provider or prospective provider, requires a real world testing plan approved by the market surveillance authority, requires informed consent from participants where Article 61 requires it, and is limited in duration, in outline to no longer than necessary and for a maximum of six months, extendable for the same period subject to prior notification. Both routes require risk assessment, safeguards, monitoring and reporting, and both are subject to the prohibited practices in Article 5. A provider that wishes to test in real world conditions must choose the route that fits its situation, check the conditions for that route, and record the approval, the plan and the safeguards. Testing that is described as a sandbox without a competent authority sandbox, or as real world testing without a market surveillance authority approval, does not meet the conditions for either route.
What innovation measures support smaller firms?
Innovation measures in Chapter VI, Articles 57 to 63, include sandboxes, real world testing, measures for SMEs including startups in Article 62, derogations for specific operators in Article 63, and the AI Office information and template work. Article 62 requires Member State measures for SMEs including startups, including priority sandbox access, awareness and training, communication channels and standardisation participation, and proportionate conformity assessment fees. Article 63 allows microenterprises to meet quality management requirements in a simplified manner, subject to the partner and linked enterprise condition. Regulation (EU) 2026/1744 extends defined SME measures to SMCs. Those measures are dealt with in detail in the SME cluster of this site and in the sandbox and innovation guides in this cluster. For the present overview, the point is that innovation measures are support and proportionality measures, not exemptions from substantive requirements. A small firm that uses a sandbox, a template or a simplified form must still meet the requirements that apply to its system, and must record how the support was used and what evidence it produced. Support that is used without a record will be difficult to show to an authority or a customer.
Continue with harmonised standards process.
What should a reader do with this cluster?
A reader should use this cluster to identify the tool that fits the question, to check the legal basis and the effect of that tool, and to build the record that the tool requires. A reader with a standards question should start with the harmonised standards guides. A reader with a general purpose model question should start with the codes of practice guide. A reader with a voluntary commitment question should start with the codes of conduct guide. A reader with a testing question should start with the sandbox and real world testing guides, and should choose the route before designing the test. A reader with a support question should start with the innovation measures guide and the SME cluster. Each guide states its limits and its checking route, including the Official Journal for standards, the AI Office for codes of practice, and the national competent authority for sandboxes. No guide in this cluster decides whether a standard, a code or a sandbox applies to a named system, and each guide instructs the reader to confirm the position with the authority or adviser concerned. That instruction is part of the guidance, not a disclaimer added to it.
Frequently asked questions
Does following a standard guarantee AI Act compliance?
No. A harmonised standard whose reference is published in the Official Journal gives a presumption of conformity only to the extent that the standard covers the requirement concerned. A standard that covers only part of a requirement gives a presumption only for that part. Requirements not covered must be demonstrated by other means, with the coverage map recorded.
Is a code of conduct the same as a code of practice?
No. Codes of practice under Article 56 are for general purpose models and can support a demonstration of compliance with Chapter V until a harmonised standard is published. Codes of conduct under Article 95 are voluntary instruments for the voluntary application of defined requirements to AI systems generally, and do not give a presumption of conformity for high risk requirements.
Does a sandbox authorise placing a system on the market?
No. A sandbox is a supervised testing framework under a sandbox plan, ending with an exit report. It does not authorise placing on the market or putting into service, and it does not replace conformity assessment. Real world testing outside a sandbox has its own approval and safeguards under Articles 60 and 61.
Are SMEs exempt from the requirements through innovation measures?
No. Innovation measures in Articles 62 and 63 provide support and proportionality, such as sandbox priority access, proportionate fees and simplified quality management in defined cases. They do not exempt SMEs, startups, SMCs or microenterprises from the substantive requirements that apply to their systems.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission AI Act standardisation ↗