Implementing the AI Act means translating regulatory requirements into design choices, technical measures and verifiable responsibilities. The EUSAiR experience demonstrates the value of collaboration between providers and experts in embedding transparency, traceability and human oversight from the earliest stages of AI system design.

The implementation of the AI Act raises an increasingly practical question for those developing and integrating Artificial Intelligence solutions: how can regulatory requirements be translated into technology choices, technical measures and verifiable responsibilities? 

DGS contributed to the “Towards AI Regulatory Sandboxes: EUSAiR Experience and Pilots” workshop, held on 30 October 2026 at the DAMA Technopole in Bologna. The final event of the European EUSAiR project brought together technology providers, regulatory authorities, innovators and research centres to share the outcomes of the pilots and discuss the implementation of the AI Act. 

EUSAiR is a two-year project funded by the European Union through the Digital Europe Programme. The initiative supports the coordinated implementation of AI regulatory sandboxes across Member States, contributing to the development of common frameworks, the strengthening of technical and legal expertise, and cooperation between national authorities. 

AI regulatory sandboxes are controlled environments that facilitate the development, regulatory testing and validation of AI systems before they are placed on the market. Their purpose is to support innovation, increase legal certainty, and help providers and authorities identify applicable requirements, risks and measures at an early stage. 

SMC, DGS Open Source Excellence Center, participated in the project as a pilot with OpenK9, the open-source cognitive enterprise search and conversational AI platform. The solution aggregates and indexes fragmented data from different sources, transforming it into a unified knowledge base that users can query using natural language. 

The pilot was conducted through the EUSAiR Advice and Guidance service, based on expert-led sessions focusing on specific regulatory questions, with the support of technical and regulatory specialists. This approach includes a plan tailored to the individual use case and a final report summarising the main findings, lessons learned and recommendations that emerged during the pilot. 

During the workshop, Alessandro Cecconi, Pre-sales & Delivery Manager at DGS, presented the work carried out and the main findings of the assessment.

The assessment examined three evolving configurations of OpenK9: a search engine with machine learning capabilities, a chatbot connected to a Large Language Model, and an Agentic RAG configuration. The experience showed that risk classification and applicable obligations depend not only on the technology itself, but also on its intended purpose, level of autonomy and deployment context. 

The search engine has limited implications under the AI Act. Introducing an LLM-based chatbot, by contrast, requires specific transparency measures, including informing users that they are interacting with an AI system and ensuring that AI-generated content can be identified. Although the Agentic RAG configuration does not automatically result in a higher risk classification, it requires greater attention to human oversight, data governance, traceability and auditing. 

The pilot also confirmed the value of conducting assessments for each technology layer and specific deployment. Measures such as source citation, audit logging, access control and human oversight are more effective when embedded from the design stage, supporting the solution’s evolution towards new use cases.

The experience gained through the EUSAiR project reinforces DGS’s vision of Trustworthy AI and AI Governance: developing governable and verifiable systems in which technological innovation, transparency, traceability and accountability are treated as integral parts of the same design process.