PaperlayerView exact revision on arXiv

Source-linked AI summary

Bathtubs, Boundaries, and Sandboxes: AI Regulatory Learning under Legal Uncertainty

Tom Deckenbrunnen, Alessio Buscemi, Marco Almada, Alfredo Capozucca, German Castignani

arXiv:2601.04094v4cs.CYcs.AIcs.HC

TL;DR

AI regulation faces a persistent challenge in translating abstract legal requirements into verifiable technical practice. Using Coleman’s bathtub and boundary concepts to analyse the AI Act, the paper argues that bounded legal uncertainty supports negotiation and learning, while consistent technical frameworks can help preserve flexibility as interpretations stabilise.

  • Problem

    Abstract AI-law requirements are difficult for developers, companies, and auditors to translate into verifiable technical practices, creating operational uncertainty.

    Source: §1 · p. 1

  • Method

    The paper uses Coleman’s bathtub and boundary objects to analyse the AI Act’s socio-technical learning process across governance levels and examines technical frameworks as Boundary Negotiating Artifacts.

    Source: §1 · p. 2, §7 · p. 9, §8 · p. 10

  • Results

    Legal uncertainty cannot be fully removed ex ante, and limited residual uncertainty creates space for boundary negotiation, iterative assessment, and regulatory learning.

    Source: §7 · p. 9

  • Takeaways & Limitations

    A consistent, scalable evidence core without over-specifying detailed metrics or thresholds may support long-term legal certainty while retaining flexibility for context-specific interpretation.

    Source: §7 · p. 10

    The bathtub model is an abstraction that does not represent all interactions among mapped actors.

    Source: The AI Act’s Bathtub · p. 5

Abstract

from arXiv · show

Effective regulation of AI is a defining policy challenge, driven by their integration into all aspects of society. To remain responsive to their rapid development and emergent properties, policymakers across the globe rely on high-level principles and abstract legal requirements. Yet, while this flexibility supports future-proofing human-centred regulations and aligning them with socio-ethical values, it also causes legal uncertainty downstream as developers, companies, and auditors struggle with translating these abstract requirements into verifiable technical requirements. Using the AI Act as an example, this paper draws on Coleman's bathtub to analyse the regulatory learning space in AI governance. It argues that legal uncertainty cannot be fully reduced ex ante and that, within reasonable bounds, it is also necessary for regulatory learning because it creates the space in which boundary negotiation over socio-technical meaning can occur. Building on this analysis, the paper shows how boundary objects and boundary negotiating artifacts help explain the translation of legal requirements into operational practice. By examining technical sandbox frameworks, it further identifies concrete properties that technical infrastructures must possess to function effectively as boundary negotiation artifacts in AI assessment. The paper concludes that legal certainty remains the long-term aim, but that premature closure of regulatory instruments risks undermining the learning processes needed for adaptive governance.

1 Introduction

The introduction frames AI governance as a challenge of translating flexible, abstract legal requirements into verifiable technical practice, a process that creates downstream uncertainty. Using the EU AI Act, the paper treats bounded uncertainty as part of regulatory learning and develops a socio-technical account of how stakeholders negotiate and operationalise requirements.

1 Introduction

  • The EU AI Act adopts a comprehensive, fundamental-rights-based, risk-oriented framework with horizontal ex-ante obligations, including risk management, data governance, and technical documentation.The introduction contrasts this approach with sectoral rules, voluntary standards, and ex-post liability in the United States, and targeted regulatory interventions in China.Source: §1 · p. 1
  • Abstract legal requirements create operational uncertainty as developers, companies, and auditors try to translate them into verifiable technical practices.Studies cited in the introduction associate this uncertainty with investment hesitation, uneven compliance readiness, and fragmented risk management.Source: §1 · p. 1
  • The AI Act combines enforcement with learning mechanisms, including Codes of Practice, regulatory sandboxes, testing environments, and flexibility measures for SMEs.The introduction notes that the Digital Omnibus would further specify amendments to sandboxes, showing uncertainty also extends to the legal framework itself.Source: §1 · pp. 1–2
  • The paper argues that bounded legal uncertainty creates room for stakeholders to negotiate abstract requirements and translate them into operational practice.It uses Coleman’s bathtub and boundary objects to analyse that process, and examines how technical frameworks can function as Boundary Negotiating Artifacts.Source: §1 · p. 2

2 Policy Learning and Coleman’s Bathtub

This section frames AI regulation as adaptive learning across macro, meso, and micro levels, with legal requirements and implementation experience moving in both directions. Coleman’s bathtub models these interactions, while the meso level makes explicit the organisational mediation and aggregation between individual practice and regulatory change.

2 Policy Learning and Coleman’s Bathtub

  • The AI Act sets horizontal essential requirements but delegates technical specifications to standards and implementing or delegated acts, while sector-specific standards remain unadopted.The Act’s sandboxes, reporting mandates, and regular reviews are intended to support future-responsive regulation combining top-down enforcement and bottom-up learning.Source: §2 · p. 2
  • Coleman’s bathtub models top-down enforcement as macro-micro influence and bottom-up feedback as micro-macro interaction.Individuals adapt under regulatory pressure and produce evidence, while interaction among individuals can aggregate learning into signals for the macro level.Source: §2 · p. 2
  • The paper makes the meso level explicit as the organisational layer that translates, mediates, and aggregates between macro and micro learning.This layer addresses the aggregation role that micro-micro transitions alone may not capture.Source: §2 · pp. 2–3

3 Regulatory Learning in the AI Act’s Governance Structure

The section maps the AI Act’s regulatory learning structure as a functional flow of pressure, translation, and evidence aggregation across macro, meso, and micro levels. Its account highlights the complex and overlapping roles of actors, and the need for coherent evidence to support regulatory learning.

3 Regulatory Learning in the AI Act’s Governance Structure

  • The AI Act’s multi-actor governance assigns enforcement, reporting, and coordination tasks that make actors’ roles and interactions complex and sometimes overlapping.The AI Office, for example, has enforcement, coordination, and standardisation responsibilities; its operational discretion does not amount to formal institutional independence, and its autonomy’s scope remains to be clarified.Source: Actors and Mechanisms · p. 3
  • The micro level comprises providers, deployers, developers, and supporting organisations that respond to compliance pressure and generate evidence from practice.Their changed design, development, and assessment practices can provide signals aggregated upward for data-driven adaptation.Source: The AI Act’s Bathtub · p. 3
  • The Commission is the macro-level actor because it alone can legally adapt the AI Act through amendments, delegated acts, or implementing acts.The framework distinguishes legislative, regulatory, and technical levels of specification, with learning potentially driving adaptation at each level.Source: Actors and Mechanisms · p. 3, The AI Act’s Bathtub · p. 4
  • Meso-level actors mediate between macro and micro levels through translation and evidence aggregation, and may occupy multiple functional categories.The bathtub diagram is an idealised mapping of these actors and does not represent every interaction.Source: The AI Act’s Bathtub · pp. 4–5, Figure 1 · p. 4
  • Enforcers monitor conformity, while sandboxes and advisory actors provide guidance and operational support for implementation.In sandboxes, a designated market surveillance authority can provide legal guidance, technical expertise, and resources; advisors can enable experimentation and immediate regulatory feedback.Source: The AI Act’s Bathtub · p. 4
  • Meso-level advisors aggregate micro-level evidence for policy adaptation, while standardisers turn legislative provisions into specifications that can also inform feedback on feasibility.The AI Board, AI Office, and Advisory Forum help synthesise data and stakeholder perspectives; standardisation bodies develop harmonised standards that support conformity.Source: The AI Act’s Bathtub · pp. 4–5
  • The model abstracts from some actor interactions, and coherent micro-level evidence is needed for interoperable analysis and effective aggregation across meso-level actors.The section notes that actors may hold multiple roles and that roles may be shared; formal hierarchy is not uniform across the governance structure.Source: The AI Act’s Bathtub · p. 5

4 Boundary Objects and Negotiating Artifacts

Coleman’s bathtub maps regulatory learning across macro, meso, and micro levels, but leaves the mechanism of translating legal uncertainty into learning signals open. Boundary objects and boundary negotiating artifacts help explain how stakeholders coordinate that translation.

4 Boundary Objects and Negotiating Artifacts

  • The bathtub model identifies where learning occurs and who interacts, but abstracts away real-world interactions and does not explain how actors mediate uncertainty into upward signals.Boundary objects and negotiating artifacts offer analytical tools for examining that mechanism.Source: §4 · p. 5
  • Boundary objects bridge distinct communities through artifacts robust enough to preserve shared understanding yet plastic enough to meet different information needs.In AI governance, the system can be a technical boundary object and the applicable requirements a regulatory one.Source: §4 · p. 5
  • Boundary negotiating artifacts make coordination work visible through documents, models, and processes that stakeholders use to propose, align, and iteratively stabilise meanings.They are useful where an artifact lacks an inherent structure that can standardise coordination.Source: §4 · pp. 5–6
  • Policy-prototyping workshops have translated abstract policies into operational requirements, while raising questions about the scalability of dedicated workshops.Workshops involving over fifty companies identified clarity and feasibility issues and produced recommendations including more AIRS collaboration (Nuno, Andrade, and Zarra 2022).Source: §4 · p. 6
  • The AI Act gives rise to three overlapping settings for boundary negotiation: internal conformity assessment, regulatory sandboxes, and third-party assessment.Internal assessment can keep learning largely within the micro level; the paper focuses on AIRSes as a formally structured setting for regulatory learning.Source: §4 · p. 6

5 AI Regulatory Sandboxes are Environments of Boundary Negotiation

AI Regulatory Sandboxes provide a structured setting for participants and authorities to negotiate what legal requirements mean for a particular AI system. Iterative negotiation can provisionally stabilise interpretations and produce learning artifacts that may inform wider regulatory learning.

5 AI Regulatory Sandboxes are Environments of Boundary Negotiation

  • The literature frames AIRSes as exploratory under significant legal uncertainty, with a possible gradual shift toward confirmatory sandboxes as regulation stabilises and a need for mutual learning.Proposals also identify fragmentation, limited participant incentives, and uncertainties around real-world testing and interactions with other digital regulation (Ahern 2025b; Genicot and Moraes 2025; Chen and Taeihagh 2026; Guio Español and Koenig 2025).Source: §5 · pp. 6–7
  • An AIRS structures boundary negotiation around the AI system and applicable legal requirements, with the SME translating requirements into design and assessment choices and the MSA contributing expertise.The resulting learning signals reflect the system’s socio-technical dimensions and multiple stakeholder perspectives.Source: §5 · p. 7
  • Where disruptive technologies leave grey areas that cannot be resolved ex ante, AIRSes offer a supervised environment for examination through multi-stakeholder collaboration.This is especially relevant when novel technologies fall partly outside existing frameworks.Source: §5 · p. 7
  • Under unresolved requirements, AIRSes support iterative negotiation through which participants may provisionally stabilise meanings such as sufficient robustness, fairness, documentation, or human oversight.Participants may shape bottom-up learning signals as the SME refines its system and assessment methodology and the MSA responds.Source: §5 · p. 7
  • A jointly drafted AIRS exit report can serve as an audit trail and a boundary negotiating artifact for meso-level analysis, making case-specific interpretations potentially reusable beyond the individual sandbox.The draft implementing act calls for dissemination of sandbox results to encourage dialogue among authorities, participants, and other stakeholders (European Commission 2025a).Source: §5 · p. 7

6 Technical Frameworks for Boundary Negotiation

Technical frameworks can operationalise boundary negotiation in AI assessment by structuring shared work while accommodating different stakeholder perspectives. The paper identifies machine-readable specifications, role-specific access, iterative outputs, and traceability as recurring properties that support gradual stabilisation.

6 Technical Frameworks for Boundary Negotiation

  • An open linked-data semantic framework can structure information exchange, but does not by itself provide an artifact for boundary negotiation among stakeholders.The section therefore examines technical frameworks as infrastructure that may support AIRSes.Source: §6 · p. 7
  • The Sandbox Configurator’s declarative DSL encodes compliance requirements, testing objectives, and domain modules as a stakeholder contract, making agreements, divergences, and change across iterations traceable.That traceability can reveal when changes become minimal and the artifact’s meaning stabilises.Source: §6 · pp. 7–8
  • Role-specific dashboards adapt access to stakeholder needs, while container-based deployment supports flexible setup and potential remote collaboration in a federated setting.These communicative capabilities support the framework’s use as a boundary negotiating artifact.Source: §6 · p. 8
  • The proposed MLOps approach organises design, development, and assessment into lifecycle stages with role-based access, traceable outputs, and a workflow that is stable yet flexible for stakeholder negotiation.Repeated engagement with the pipeline can help stakeholders refine systems, requirements, and assessment practices (Gonzalez Torres and Sawhney 2023).Source: §6 · p. 8
  • Technical boundary negotiating artifacts need a machine-readable core, role-specific access, iterative reusable outputs, and traceable results to make negotiation visible and support stabilisation across assessment cycles.Examples include a shared DSL or pipeline, dashboards or staged access, and logs, assessment results, and exit reports.Source: §6 · pp. 8–9

7 Discussion

The paper treats AI regulation as a socio-technical learning process in which bounded legal uncertainty leaves room for stakeholders to negotiate meaning. It argues that flexible technical frameworks can support that negotiation, while premature closure and unequal influence risk undermining it.

7 Discussion

  • Technical frameworks support boundary negotiation when they consolidate evidence and offer a malleable presentation layer for multi-stakeholder collaboration.The paper frames AI systems in context and corresponding legislation as boundary objects, with supporting technical frameworks as boundary negotiating artifacts.Source: §7 · p. 9
  • Prematurely closing regulatory instruments may undermine adaptability and prompt further specifications, increasing fragmentation.The paper notes that the landscape of standards is already fragmented.Source: §7 · p. 9
  • Power asymmetries in standardisation can privilege feasibility or market compatibility over rights protections and risk short-circuiting feedback into checkbox compliance.The authors also warn that stakeholder power can bring premature closure instead of interpretative deliberation.Source: §7 · p. 9
  • Limited residual uncertainty creates space for boundary negotiation and iterative learning, while flexible specification keeps legal certainty as the long-term aim.Consistent sandbox methodologies can help identify common practices without over-specifying metrics and thresholds.Source: §7 · pp. 9–10
  • Because the study uses the EU AI Act as its case, its generalisability to other jurisdictions may be limited.The authors say the bathtub mapping can be adapted to the precise provisions of other frameworks.Source: §7 · p. 10
  • The applicability of boundary objects and boundary negotiating artifacts in regulatory contexts remains undetermined and warrants further interdisciplinary investigation.The authors describe this as their first application of the lens in this context.Source: §7 · p. 10
  • The discussion illustrates technical frameworks for AI Regulatory Sandboxes with only two examples, and those frameworks alone have limited capacity for higher-level aggregation and analysis.Combining them with semantic frameworks for evidence sharing remains an open design challenge.Source: §7 · p. 10

8 Conclusion

The paper reframes AI Act governance as a socio-technical learning process connecting micro, meso, and macro levels. It argues that bounded legal uncertainty and shared technical frameworks can support boundary negotiation, reusable evidence, and eventual legal certainty without premature closure.

8 Conclusion

  • The analysis recasts translation of abstract AI Act requirements into operational practice as a socio-technical process spanning micro, meso, and macro levels.Coleman’s bathtub maps how regulatory pressure, evidence generation, and aggregation connect those levels.Source: §8 · p. 10
  • Legal uncertainty cannot be fully reduced ex ante; within reasonable bounds, it creates interpretative space for stakeholders to negotiate and progressively stabilise legal meaning.The challenge is to structure uncertainty to enable reusable evidence and iterative learning without premature closure.Source: §8 · p. 10
  • Regulatory sandboxes and related technical frameworks can support negotiation through shared artifacts, traceable outputs, and role-specific access to a common assessment environment.The analysis identifies technical BNA properties needed to support AI assessment effectively.Source: §8 · p. 10
Loading 2601.04094v4…