# Recital (140)

This Regulation should provide the legal basis for the providers and prospective providers in the AI regulatory 
sandbox to use personal data collected for other purposes for developing certain AI systems in the public interest 
within the AI regulatory sandbox, only under specified conditions, in accordance with Article 6(4) and Article 9(2), 
point (g), of Regulation (EU) 2016/679, and Articles 5, 6 and 10 of Regulation (EU) 2018/1725, and without 
prejudice to Article 4(2) and Article 10 of Directive (EU) 2016/680. All other obligations of data controllers and 
rights of data subjects under Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 remain 
applicable. In particular, this Regulation should not provide a legal basis in the meaning of Article 22(2), point (b) of 
Regulation (EU) 2016/679 and Article 24(2), point (b) of Regulation (EU) 2018/1725. Providers and prospective 

providers in the AI regulatory sandbox should ensure appropriate safeguards and cooperate with the competent 
authorities, including by following their guidance and acting expeditiously and in good faith to adequately mitigate 
any identified significant risks to safety, health, and fundamental rights that may arise during the development, 
testing and experimentation in that sandbox.

---
Source: Regulation (EU) 2024/1689 (Artificial Intelligence Act) as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026 (Official Journal of the EU). This page is AI-generated legal information, not legal advice. Verify against the Official Journal.
Canonical: https://euaiactlaw.com/recital/140