What happens when a startup tells EU AI regulators what it is really like to build under the AI Act? Six lessons from our time in the EUSAiR sandbox, from risk-based evaluation and better rubrics to why startups should not carry the burden of certifying frontier models.
Allan Tan
Chief AI Scientist at Better-ed
It is not every day that a startup founder gets to stand in front of the people writing the rules for AI and tell them, candidly, what it is like to build under those rules. Recently I had that chance. I was invited to speak to EU AI regulators about our experience going through the EUSAiR regulatory sandbox with better-ed, our voice-first oral assessment platform for schools.
Overall, it was a great experience. But the most valuable part of a sandbox is not the certificate at the end. It is what you learn, and what you get to feed back. Here is what we shared.
The single biggest benefit of the sandbox was clarity. Before joining, the EU AI Act felt like open water with no visible shore. The audit guidance we received changed that. It showed us what "good" looks like, which evidence matters, and where to focus.
Think of it as a lighthouse. It does not steer the ship for you, but without it you cannot move fast in any direction, because every move risks running aground. With it, we gained the confidence to move faster, not slower. That is the opposite of what most founders expect from regulation.
Our first mistake was a very engineering-minded one. We structured our evaluation in the sequential order of our model operations. In better-ed, that meant we first evaluated the quality of the questions and the checking criteria, and only then evaluated how accurately the AI checked student answers.
In hindsight, the evaluation should have been risk-based: start with the step where an error does the most harm to a learner, and prioritize what matters most.
The results were still illuminating. When we measured our AI assessment metrics, the model's checking performance ended up on par with human graders. That told us something important. The bottleneck was no longer the model. The best way to improve grading was to improve the writing of the checking criteria, making them clearer and easier for the AI (and frankly, for humans too) to verify.
In short: better rubrics beat bigger models.
A pleasant surprise was how much of what the regulation asks for, such as evaluations, data lineage, and documentation of training data, we were already doing.
That should not be surprising. If you are a serious model developer, you need evals to know whether your model works, and you need to know where your training data came from to improve it. The steps regulators ask for are largely the same steps developers must take to build a performant model in the first place. Compliance, done right, is not a tax on good engineering. It is a description of it.
Here is where we hit a real wall. Like most AI startups, we build on top of third-party frontier models. We cannot provide the training data behind OpenAI or Gemini models. We simply do not have it. Their benchmarks are public, but the traceable artifacts behind those models are not ours to give.
The burden of providing traceable documentation for frontier models should not fall on startups. Instead, we proposed that:
This split matches who actually holds the information, and it keeps the compliance burden proportionate for small companies.
One of the most interesting discussions was about low-resource data representing minorities and vulnerable groups. Today's models are often biased against these groups for a simple reason: there is not enough data about them.
Yet the same guidelines that push for less bias also make it harder to collect data, especially data about children. That is a genuine paradox. How can AI address bias when gathering the data needed to correct it keeps getting harder?
Our suggestion: if the EU wants to tackle these biases, the proper authorities should collect this data, ethically and with the right safeguards, and release it as open data. That way, many startups can build fairer and more general solutions, instead of each company hitting the same wall on its own.
The honest question: did the sandbox give us more credibility and help us win clients? Not yet.
The reason is simple. Our clients are not familiar with EUSAiR to begin with, and a badge nobody recognizes cannot open doors. Sandbox programs need to invest in awareness, so that schools, companies, and public buyers across the EU know the sandbox exists and understand that participating companies have gone through stringent testing. Do that, and the sandbox becomes more than a compliance tool. It becomes a real market signal, and a reason for more startups to join.
What I appreciated most was the chance to share our experience and opinions directly with the regulators. Regulation works best when it is shaped by the people who build under it, and the EU deserves credit for creating a space where that conversation can happen.
To fellow founders considering a regulatory sandbox: go in. You will move faster, learn things about your own system you did not expect, and earn a seat at the table while the rules are still being written.
