LIABILITY TRANSITION AFTER REGULATORY SANDBOX APPROVAL EXPIRES

1. INTRODUCTION

A regulatory sandbox is a controlled environment in which businesses test innovative products, services, or technologies under specified regulatory conditions. It is commonly used in financial technology, digital health, artificial intelligence, and other emerging sectors. Sandbox approval is generally temporary and subject to conditions concerning duration, customer protection, operational limits, reporting, and risk management.

Liability transition after sandbox approval ends refers to the legal consequences that arise when a participant moves from experimental operation to ordinary commercial activity, obtains a full licence, discontinues the product, or continues operating without valid authorization. The expiry of sandbox approval does not automatically extinguish liability for harm caused during testing. Nor does successful testing necessarily authorize unrestricted commercial deployment.

The central legal principle is that regulatory permission, civil liability, and consumer protection are distinct matters. The participant remains responsible for its conduct according to applicable law, while the regulator's responsibilities depend on its statutory powers and the circumstances of the case.

2. LEGAL FRAMEWORK GOVERNING LIABILITY TRANSITION

In India, the Reserve Bank of India (RBI) Regulatory Sandbox Framework provides that temporary regulatory relaxations expire at the end of the sandbox period and that participants must exit the sandbox. Following successful experimentation, the entity must comply with applicable regulatory requirements. The framework also requires existing customer obligations to be fulfilled or addressed before exit. <Cite refs={["turn339929search3","turn339929search7"]}/>

The Securities and Exchange Board of India (SEBI) Regulatory Sandbox Framework similarly addresses the expiry of testing permission, wider-market authorization, exit procedures, and the settlement of obligations to users. <Cite refs={["turn339929search4","turn339929search8"]}/>

These frameworks illustrate three important legal rules:

Expiry of temporary permission: Regulatory relaxations ordinarily end on the prescribed date unless a valid extension is granted.

Continuing liability: Outstanding contractual, consumer, data-protection, and compensation obligations do not automatically disappear when testing ends.

Separate commercial authorization: A successful experiment may still require a full licence, registration, product approval, or other regulatory authorization before wider deployment.

The precise rules depend on the sector-specific framework and the terms of the participant's approval.

3. PRINCIPAL GROUNDS OF LIABILITY

A. UNAUTHORIZED OPERATION AFTER EXPIRY

A participant that continues a regulated activity after its sandbox permission expires may face regulatory directions, penalties, licence-related consequences, or other sanctions under applicable legislation. The legal issue is not merely whether the technology performed successfully, but whether the business possesses the authorization required for continued operation.

B. LIABILITY FOR LOSSES INCURRED DURING TESTING

A participant may remain liable for losses caused by negligence, misrepresentation, contractual breach, defective products, or other actionable conduct during the testing period. The applicable sandbox framework may also require compensation arrangements or indemnity insurance.

C. FAILURE TO SETTLE EXISTING OBLIGATIONS

Outstanding refunds, unresolved complaints, pending transactions, customer claims, and contractual commitments must be addressed according to the applicable framework and agreements. An entity cannot ordinarily avoid an accrued obligation simply by announcing its exit.

D. DATA AND CONFIDENTIALITY BREACHES

Personal data, confidential information, and records collected during sandbox testing may remain subject to applicable privacy, cybersecurity, confidentiality, and retention requirements after approval expires. Closure procedures should address lawful retention, deletion, transfer, and security of information.

E. REGULATORY AND THIRD-PARTY RESPONSIBILITY

The participant normally bears responsibility for its own operations. A regulator's involvement does not automatically make it liable for losses arising from the experiment. However, any separate claim against a public authority must be assessed under the relevant statutory framework and principles governing public-law liability, negligence, or judicial review.

4. RELEVANT CASE LAWS

The following decisions provide direct or analogous principles for analyzing post-sandbox liability. None of the listed judgments establishes a universal rule specifically governing liability transition after every regulatory sandbox expires.

1. Rachana Gangu v. Union of India, W.P. (C) No. 1220/2021, judgment dated 10 March 2026 — ANALOGOUS AUTHORITY

The Supreme Court addressed serious adverse events following COVID-19 vaccination and directed the Union Government to formulate a no-fault compensation policy. It also directed continuation of existing adverse-event monitoring mechanisms and clarified that the policy would not constitute an admission of fault or liability.

Relevance: The decision illustrates that regulatory oversight and compensation arrangements may continue to matter even after a particular approval or programme has ended. It does not establish automatic compensation for every loss arising from sandbox testing or create a general no-fault regime for sandbox participants.

2. Pfizer Limited v. Union of India, W.P. (C) No. 2212/2016 and connected matters, Delhi High Court, judgment dated 1 December 2016 — ANALOGOUS AUTHORITY

The litigation concerned the legality of approvals and licensing of certain fixed-dose combination drugs. The proceedings addressed the statutory requirements governing drug approval and regulatory authority.

Relevance: The case illustrates why an experimental success or limited authorization cannot substitute for legally required approvals. A sandbox participant entering a regulated market must obtain the authorizations applicable to its activity.

3. Lalankumar Singh v. State of Maharashtra, Criminal Appeal No. 1757 of 2022, Supreme Court, 11 October 2022 — ANALOGOUS AUTHORITY

The Supreme Court considered criminal liability of company directors under the Drugs and Cosmetics Act and emphasized the need for specific averments establishing their responsibility for the company's business.

Relevance: Expiry of sandbox approval does not automatically make every director personally liable for subsequent violations. Personal criminal liability must satisfy the requirements of the applicable statute and the individual's established role.

4. Jacob Mathew v. State of Punjab, (2005) 6 SCC 1 — ANALOGOUS AUTHORITY

The Supreme Court explained the principles governing medical negligence and the standard applicable to professional conduct.

Relevance: Where a sandbox involves digital health or clinical technology, the transition to ordinary operation requires appropriate professional safeguards. A participant's regulatory status does not eliminate liability for independently established negligence.

5. V. Kishan Rao v. Nikhil Super Speciality Hospital, (2010) 5 SCC 513 — ANALOGOUS AUTHORITY

The Supreme Court considered the assessment of medical negligence in consumer proceedings and rejected an inflexible requirement that expert evidence must be obtained in every such case.

Relevance: Users harmed by a sandbox-tested product or service may seek consumer remedies where the statutory requirements are satisfied. The end of testing does not itself defeat a claim, although the claimant must establish the necessary elements of liability.

6. Indian Medical Association v. V.P. Shantha, (1995) 6 SCC 651 — ANALOGOUS AUTHORITY

The Supreme Court examined the application of consumer-protection law to medical services, including the circumstances in which those services fall within consumer jurisdiction.

Relevance: When experimental healthcare services are discontinued, qualifying consumer claims and service-related obligations may survive. Whether the decision applies depends on the nature of the service and the applicable statutory framework.

5. PRACTICAL COMPLIANCE MEASURES

Organizations approaching the end of sandbox approval should adopt a documented transition plan covering the following:

Authorization review: Identify the exact expiry date, conditions of approval, and licences or registrations required for continued operation.

Customer protection: Notify affected users, settle outstanding transactions, process refunds where due, and maintain accessible complaint mechanisms.

Liability and insurance: Review indemnities, insurance coverage, contractual obligations, and procedures for claims arising during testing.

Data governance: Secure, retain, transfer, or delete personal and confidential data according to applicable law.

Incident reporting: Investigate outstanding safety, cybersecurity, financial, or operational incidents and make mandatory disclosures to the relevant authorities.

Evidence preservation: Retain testing records, consent documents, audit logs, risk assessments, and customer communications for the legally required period.

Formal exit: Obtain written confirmation of closure where required and document the discharge or transfer of outstanding responsibilities.

A business should not continue regulated operations merely because it has applied for an extension or expects to obtain full authorization. Any continued activity must be supported by valid legal permission.

6. CONCLUSION

Liability transition after sandbox approval ends is governed by the distinction between temporary regulatory permission and continuing legal responsibility. Expiry generally terminates the sandbox-specific relaxations, but it does not automatically extinguish existing customer claims, contractual duties, compensation obligations, or liability for unlawful conduct.

The RBI and SEBI frameworks demonstrate the importance of orderly exit procedures and independent authorization for wider deployment. The cited judicial decisions provide analogous principles concerning regulatory approval, negligence, consumer remedies, and individual responsibility. Effective transition therefore requires lawful authorization, transparent communication, protection of users, and documented settlement of outstanding obligations. The precise outcome ultimately depends on the applicable sectoral law, the sandbox conditions, the nature of the alleged loss, and the evidence establishing liability.