# The Bill opened the regulatory door. The founders who need it most cannot yet walk through it.

**Faraz Rizvi × [Foundry](https://www.spinupforge.com/foundry/)**

*Faraz Rizvi is a UK operator-practitioner writing about the work between a research breakthrough and a fundable company. He took a fintech startup through the FCA regulatory sandbox in 2017, and now runs SpinUp Forge. [Foundry](https://www.spinupforge.com/foundry/) is SpinUp Forge's custom agentic harness.*

---

![Isometric night scene — an ember-lit gateway with an open, glowing doorway stands at the summit of a floating staircase; a lone wayfarer is only part-way up the climb, a gap of empty stairs between the figure and the open door.](figures/sandbox-readiness-gap/sandbox-readiness-hero.png)

The Regulating for Growth Bill named the fifth constraint on 8 July 2026. For a deep-tech academic founder in life sciences, AI-enabled medical devices, or autonomous systems, that means the hardest wall in the commercialisation sequence, regulatory deployment, has just been assigned a mechanism. What has not been assigned is any account of whether the founders who need the mechanism are ready to use it.

This series has named and traced the binding constraints in the UK spinout sequence: IP and equity terms, capital access, the VC bridge, skills and capability selection, and now regulatory deployment. The details of the Bill's statutory sandbox powers were set out by the government on 8 July ([gov.uk, 8 July 2026](https://www.gov.uk/government/news/uk-to-become-worlds-fastest-market-to-commercialise-innovation-with-regulatory-shake-up)), naming a mechanism for addressing that constraint. The mechanism does not yet come with a readiness map.

## What the Bill names

*The sandbox powers are real, and aimed squarely at the sectors where spinout founders hit regulatory deployment as a wall. What is missing is any account of who is ready to walk through the door.*

Announced in the King's Speech on 13 May 2026 and set out in more detail on 8 July, the Bill creates cross-economy statutory sandboxing powers: existing rules can be temporarily modified or disapplied for controlled, live-market trials, with successful trials fast-tracked to permanent embedding via secondary legislation ([King's Speech 2026 background briefing notes](https://assets.publishing.service.gov.uk/media/6a18713db95db968c8f3bbfd/The_King_s_Speech_2026_-_background_briefing_notes.pdf)). The priority sectors named by the government are medicines and medical devices, maritime autonomous systems, defence technology, AI, and others — the same sectors where regulatory deployment is the hardest wall a prototype-stage spinout hits ([Two Birds, July 2026](https://www.twobirds.com/en/insights/2026/ai-in-the-kings-speech-2026-regulating-for-growth-bill-announced)).

This is the first time a cross-economy statutory sandbox has been placed on a legislative footing in the UK. The FCA's regulatory sandbox, launched in 2016 ([FCA, regulatory sandbox overview](https://www.fca.org.uk/firms/innovation/regulatory-sandbox)), was the first of its kind globally ([Latham & Watkins, 2016](https://clsbluesky.law.columbia.edu/2016/06/03/latham-watkins-discusses-world-first-regulatory-sandbox-open-for-play-in-the-uk/)) and has since been emulated across close to sixty jurisdictions ([World Bank data, via PYMNTS, 2022](https://www.pymnts.com/news/regulation/2022/inside-the-uks-regulatory-sandbox-how-it-fosters-fintech-innovation-drives-multisector-growth/)) — the closest working precedent for what the Bill now attempts. It demonstrated that bounded, evidenced testing could accelerate both regulatory learning and investor confidence.

The Bill has not yet been introduced to Parliament, and no clause-level text is published. What exists is the statutory intent and the sector list. For a founder six to eighteen months post-licence, with a working prototype and a first institutional funder in view, that intent matters — and so does the absence of any information on how to prepare for it.

## The critics are right, and that is not the whole argument

*The sandbox will not lighten a deep-tech spinout's regulatory load. Its value is the trial record it forces into existence — the same evidence an institutional funder will ask for, produced sooner and under scrutiny.*

Long Finance's assessment is direct: sandboxes "won't help with the complexity problem and could well exacerbate it" ([Long Finance, 2026](https://www.longfinance.net/news/pamphleteers/the-regulating-for-growth-bill/)). Layering experimental regimes on top of already dense, fragmented rules, they argue, adds to the regulatory system rather than simplifying it.

This is undoubtedly correct. The regulatory burden on a life-sciences spinout developing an AI-enabled medical device is not reduced by the existence of a sandbox. The Medicines and Healthcare products Regulatory Agency still requires a safety case. The MHRA's Innovative Licensing and Access Pathway, the nearest existing analogue, requires a collaboratively developed Target Development Profile mapping the critical path to regulatory approval and patient access ([MHRA, ILAP guidance](https://www.gov.uk/government/publications/innovative-licensing-and-access-pathway-ilap)).

The complexity critique is fair, but it is not the test that matters to a founder. The sandbox earns its place by producing a bounded, evidenced trial record: a safety case, operating procedures, a documented account of how the product was built and tested under scrutiny. For a deep-tech founder, those artefacts are the exact inputs to every serious institutional funding conversation they will have in the next twenty-four months.

The harder question the announcement leaves open is what a founder must have in place before any of this is usable.

## What sandbox entry actually requires

*The FCA sandbox, refined over seven cohorts, makes founders prove readiness before they enter — a tested model, researched rules, an operating plan they can articulate. The new statutory sandboxes publish no such bar yet.*

The nearest published analogue is the FCA's regulatory sandbox, whose eligibility criteria are publicly available and have been refined over seven cohorts. Entry requires meeting five criteria: the activity must fall within scope, demonstrate genuine innovation and consumer benefit, establish a need for sandbox support, and evidence readiness — the criterion that catches deep-tech founders. The applicant must have thought through how the model works, researched the applicable rules, and be able to explain how the business will operate ([FCA, regulatory sandbox eligibility criteria](https://www.fca.org.uk/firms/innovation/regulatory-sandbox/eligibility-criteria)). This is no formality: the FCA expects a documented testing plan — scope, duration, number of users, success criteria — alongside a risk-control framework and a statement of how the firm will manage its obligations during the trial.

For a fintech, that bar is achievable in months, though not trivially. In late 2016 I took my fintech startup through the FCA sandbox: from starting the readiness work to acceptance in June 2017 was about six months, most of it spent diligently documenting the model, the rules, and the operating plan before the door opened, not after. Even at that comparatively light end, readiness was the real work. For a medical-device or autonomous-systems spinout, the bar is heavier still — a safety case, trial operating procedures, a human-factors assessment, and an evidence trail for how the product was designed and validated, none of it produced in a weekend, or even over a summer. That evidence is the output of operational discipline running from the start, which in most spinouts at the six-to-eighteen-month mark it simply is not.

The new statutory sandboxes publish nothing equivalent. The government's announcement describes the sandbox powers and the fast-track to permanent embedding, but says nothing about what a founder in autonomous maritime systems or AI-enabled diagnostics must have built, documented, or demonstrated before an application is viable. That absence is the distance between an announcement and the moment a specific founder can act on it.

## What the support infrastructure leaves unfilled

*The support ecosystem around founders keeps growing: accelerators, venture builders, translation funding. But none of it can hand a founder the operational readiness sandbox entry turns on.*

That readiness gap, between a working prototype and the documented evidence sandbox entry requires, closes through the decisions a founder makes, or fails to make, about how the company is run before it is even a company. A spinout at month twelve that has logged every design decision, kept a version-controlled record of its testing protocols, and can hand over a two-page description of its operating procedures does not need the sandbox to tell it what to prepare. It already has.

One that has skipped this work is not waiting for a support programme or the Bill — it is already six months behind a bar it does not yet know exists.

The diagnostic for a founder in the next ninety days is "can I describe my operating procedures in two pages." If yes, the pathway the Bill opens is live in principle — the readiness work is done, the application is a matter of timing. If no, the Bill has named the destination without providing the map, and the work is operational, not political. No amount of policy advocacy closes that gap faster than the founder closing it themselves.

## Sources

- [gov.uk — UK to become world's fastest market to commercialise innovation with regulatory shake-up (8 July 2026)](https://www.gov.uk/government/news/uk-to-become-worlds-fastest-market-to-commercialise-innovation-with-regulatory-shake-up)
- [King's Speech 2026 background briefing notes (13 May 2026)](https://assets.publishing.service.gov.uk/media/6a18713db95db968c8f3bbfd/The_King_s_Speech_2026_-_background_briefing_notes.pdf)
- [Two Birds — AI in the King's Speech 2026: Regulating for Growth Bill announced (July 2026)](https://www.twobirds.com/en/insights/2026/ai-in-the-kings-speech-2026-regulating-for-growth-bill-announced)
- [Long Finance — The Regulating for Growth Bill (2026)](https://www.longfinance.net/news/pamphleteers/the-regulating-for-growth-bill/)
- [Pinsent Masons — Sandboxes central to Regulating for Growth plans (2026)](https://www.pinsentmasons.com/out-law/news/sandboxes-central-regulating-growth-plans)
- [MHRA — Innovative Licensing and Access Pathway (ILAP) guidance](https://www.gov.uk/government/publications/innovative-licensing-and-access-pathway-ilap)
- [FCA — Regulatory sandbox eligibility criteria](https://www.fca.org.uk/firms/innovation/regulatory-sandbox/eligibility-criteria)
- [FCA — Regulatory sandbox overview](https://www.fca.org.uk/firms/innovation/regulatory-sandbox)
- [Latham & Watkins — World-first regulatory sandbox opens in the UK (CLS Blue Sky Blog, 2016)](https://clsbluesky.law.columbia.edu/2016/06/03/latham-watkins-discusses-world-first-regulatory-sandbox-open-for-play-in-the-uk/)
- [PYMNTS — Inside the UK's regulatory sandbox (2022), citing World Bank data](https://www.pymnts.com/news/regulation/2022/inside-the-uks-regulatory-sandbox-how-it-fosters-fintech-innovation-drives-multisector-growth/)

## Evidence note

- **King's Speech and 8 July dates:** The Bill was announced in the King's Speech on 13 May 2026. The primary gov.uk press release is dated 8 July 2026. Both dates verified against primary sources.
- **FCA sandbox cohort count:** The FCA sandbox ran seven cohorts (2016–2021) before switching to an always-open model in August 2021 ([FCA, regulatory sandbox overview](https://www.fca.org.uk/firms/innovation/regulatory-sandbox)). "Seven cohorts" is used throughout.
- **Author's FCA sandbox experience (first-person):** The author co-founded and was COO of a regulated payroll-and-pensions SaaS fintech that held FCA Innovation Sandbox authorisation ("non-advisory" approval) and filed the FCA's six-monthly Gabriel returns; it was admitted in the FCA's second sandbox cohort (mid-2017), roughly six months after the readiness work began. First-person attestation from lived experience — the company is named on the author's LinkedIn profile — not a public-sourced claim for this piece.
- **FCA eligibility readiness language:** Rendered as paraphrase (not in quotation marks), consistent with the FCA's original question-form language ("Have you thought about how your model works with our rules? Have you carried out any background research..."). The substance is accurate per the FCA eligibility page.
- **MHRA ILAP description:** ILAP is a collaborative pathway that co-develops a Target Development Profile to map the route to regulatory approval — it does not require complete evidence of safe use in humans at entry. Description corrected per fact-check to avoid overstating the entry threshold.
- **Sector list:** The gov.uk primary source names "AI, life sciences, autonomous maritime technology and next-generation delivery services." The Two Birds secondary source lists "medicines and medical devices, maritime autonomous systems, defence technology, and AI." The piece uses "among others" to acknowledge the editorial selection and avoid misrepresenting the full list.
- **Constraint sequence:** The five-constraint framing references the published SpinUp Forge thinking series at spinupforge.com/thinking. Internal reference to the published series is the source for the sequencing claim.