On 29 September 2026, Ukraine's Digital Transformation Minister Oksana Ferchuk told Euronews that Europe should "use Ukraine as an AI sandbox." Her case rests on scale. Diia is used by more than 24 million Ukrainians, offers more than 30 digital documents and about 250 online public services, according to the Euronews interview. That is a population-scale deployment that few European governments can match. The pitch is credible, but it only works if the testing produces evidence others can use.
The case for caution
The strongest argument against treating a state platform as an AI testbed is that citizens did not consent to being test subjects. Public services are where errors cost the most, since a wrong benefits decision or a mis-issued document falls on a person with little recourse. This is why the EU's Artificial Intelligence Act (Regulation 2024/1689) puts the heaviest obligations on high-risk systems, a category that includes AI used to evaluate eligibility for public services. A war-time government, under pressure to deliver quickly, is exactly where safeguards tend to slip.
That concern deserves a serious answer. It does not follow that Ukraine should stay out of AI deployment. The question is whether the experimentation is structured, bounded and reported.
What Ukraine has actually built
Ferchuk said Ukraine "is now required to harmonise our legislation with the so-called AI Act." This is the more important half of her statement. Ukraine is not offering a lawless zone. It is offering a place to test AI against a framework it is already committed to adopting. Euronews quotes her saying the registers behind Diia are protected and that information is "never stored in one central database." She also said the ministry is building its own sovereign AI factory infrastructure and "mostly use[s] open models" trained for specific tasks.
These design choices are worth backing. Decentralised registers limit the damage from a single breach. Open models give auditors and researchers something they can inspect, which a proprietary black box does not. Both are consistent with proportionate regulation: they build safeguards into the architecture rather than relying on after-the-fact enforcement.
There is also an institutional vehicle. The Ministry of Digital Transformation and the Ukrainian Startup Fund run an AI and blockchain sandbox. In its first year it drew more than 80 applications and selected 15 companies for its first cohort. The ministry says it offers legal, technology and business audits, preparation for EU AI Act compliance, and a human rights impact assessment using the Council of Europe's HUDERIA methodology. That is a structured pipeline, not a free-for-all, and it is the part of the offer Europe should find most useful.
Where the pitch needs discipline
Three conditions would turn the slogan into something Europe can rely on.
- Publish the results. A sandbox that does not publish what it tested, what failed and what was changed is a pilot programme, not a source of evidence. The 80-plus applications are a start, but outcomes matter more than intake.
- Define the boundary between sandbox and service. Diia is a live platform. Ukraine's own materials show that its user base has grown from 23 million in October 2025, when it offered 33 digital documents and 70-plus digital public services, to more than 24 million now. Citizens should be told when an AI feature is experimental and have a non-AI route.
- Treat trust channels as attack surfaces. The most recent incidents did not hit Diia itself. In early November, according to PrivacyAffairs' report, attackers used the Kyiv Independent's content management system and newsletter service to send fake nuclear-strike warnings. The outlet called it a suspected Russian operation, though no group has claimed it. The same report notes a separate 1 November hack of the Air Alert app and says no link between the two incidents is confirmed. Ukraine's decentralised registers are a good defence for data at rest, but AI-driven public services will also be judged on how well they resist spoofing and impersonation.
What Europe should take from this
The sandbox label can be misleading. A regulatory sandbox usually means supervised testing with temporary flexibility and a regulator watching closely. It does not mean exemption. If Ukraine wants Europe to learn from its experience, it should treat the AI Act as the standard it is testing against, and report where that standard is hard to meet in practice. That kind of feedback is what lawmakers need as they refine implementation. The consolidated text of the AI Act now shows amendments dating from July 2026, which suggests the rulebook is still being adjusted and real-world data would help.
The pro-innovation reading of Ferchuk's pitch is this: Europe has more to gain from a country that deploys AI in public services under real constraints than from endless theoretical debate. The pro-rights reading is equally fair: deployment without transparency erodes the trust that makes digital government work. Both are satisfied by the same thing, which is open reporting, opt-outs for citizens, and design choices such as decentralised data and open models that keep failures contained.
Ukraine has the scale, the political motivation and the architecture to be useful here. Whether it becomes Europe's AI sandbox will depend less on how many people use Diia than on what the ministry is willing to publish about what worked and what did not.