The gap between what a government promises to explain and what it actually delivers is where a market sits.
Two companies. Both medical device manufacturers. Neither one made it to an actual test. That is the complete participant list of the pilot project that German industry has spent months referring to as the country's AI regulatory sandbox, according to the closing report from ZEVEDI, the Hesse state centre for responsible digitalisation, published in March 2026 and running to twenty pages. The report was commissioned by the Bundesnetzagentur itself, together with the Federal Data Protection Commissioner and the Hesse Ministry for Digitalisation. It is not a critique from outside. It is the agency's own accounting of what happened.
The detail that matters most is not the participant count. It is a selection criterion buried in the methodology: applications reflecting general advisory needs were excluded. The pilot was never designed to answer the question most managing directors are actually asking. It was designed to simulate a narrow procedural mechanism under Article 57 of the AI Act, with two firms in a regulated product category, in a format that stopped short of live testing. And under the current timeline, the national sandbox that eventually follows will not be operational before 2027.
What the state actually provides, and what it does not
Germany has real, live, free AI compliance infrastructure, and it would be dishonest to pretend otherwise. The Bundesnetzagentur runs an AI Service Desk. There is a KI-Compliance Kompass. There is an SME factsheet. Since the implementing act took effect on 29 July 2026, the country has a named AI supervisory authority with a defined penalty framework, including fines up to fifty thousand euros for failures to cooperate. A company that wants to know which obligations apply to it can find that out without paying anyone.
What none of these things do is sit down with a firm and work through its specific case. The service desk gives information. The Kompass gives a checklist logic. The factsheet gives orientation. All three are documents that describe a legal landscape. None of them is accompanied guidance through a particular deployment in a particular plant with a particular data situation and a particular works council.
That distinction sounds academic until you watch it play out. A plant manager reads the factsheet, identifies that a predictive maintenance model probably falls outside Annex III, and then discovers he has no way to confirm that reading against anyone who carries authority. The agency will tell him what the rules say. It will not tell him whether he has read them correctly. That is not a failure on the agency's part. It is the legally correct boundary between public information and legal advice, and every regulator draws it in the same place.
The silent assumption that costs the most
The most common quiet belief in a mid-sized German company right now is that the authorities will eventually explain all of this. That belief is doing a lot of work. It justifies waiting. It makes a budget line unnecessary this year. It converts a compliance question into someone else's scheduling problem.
The ZEVEDI report retires that belief with unusual clarity, because it comes from the institution the belief is aimed at. The pilot excluded general advisory needs by design. The national sandbox is a 2027 question at the earliest, and when it arrives it will be a structured procedure for specific high-risk deployments, not a help desk for anyone with a question. Between now and then, the gap between what the state publishes and what a company needs is not going to be filled by the state.
Independent data suggests the gap is widest exactly where the industrial base sits. KfW Research, in Fokus Volkswirtschaft No. 554 from 29 July 2026, found construction to be last among German SME sectors on every single AI technology measured. The ifo Institute, surveying solo self-employed and micro firms in May 2026, found 51.2 percent using AI overall, against 8.1 percent in construction. A sector six times below the general rate is not going to close that distance by reading a PDF.
What free actually competes with
There is a real argument that free public infrastructure crowds out paid help, and it deserves a straight answer rather than a defensive one. If the state offers the same service description at zero cost, no commercial version survives. But the ZEVEDI report changes what the state's service description is. It is not accompanied compliance work. It is published material plus a phone line that stops before your specific case begins.
Free factsheets and paid accompaniment are not the same product competing on price. They are different products, and one of them is not currently available from anyone with a coat of arms.
The KfW report contains an uncomfortable counter-signal worth keeping in view. It found that the technologies actually spreading through the German SME base are the easy, broadly applicable ones, and that low-threshold information offerings are what firms respond to. That points away from specialised, expensive engagements and toward accessible entry points. Anyone building in this space should read it as an instruction about packaging rather than a refutation of the need.
The practical move is to stop treating the regulator as a future explainer and instead draw one honest line through your own AI deployments now, marking which ones you can defend with published guidance alone and which ones need someone who will put their name on the reading.
There is one more thing in the ZEVEDI report worth watching. It recommends that findings from sandbox participation be published in generalised form, with a publishable summary attached to each exit report, so other companies can reuse the knowledge. If that recommendation survives into the national sandbox, Germany starts generating free, official, generalised regulatory knowledge as a byproduct of supervision.
That would be the genuinely useful thing. It is also still a year away, at least, and it depends on a sandbox that has so far had two participants and no completed test.