AI Act · Enforcement
Who enforces the EU AI Act, by member state
Nine of twenty-seven member states completed their Article 70 designation. Six have named nobody. The full table, by country.
Article 70 of the AI Act required every member state to designate a national competent authority and a single point of contact by 2 August 2025. That date passed more than a year ago.
On the 17 June 2026 tracker, nine of twenty-seven member states had completed the step. Twelve more had named a body in a bill that was not yet law. Six had done neither — no designation, no published legislation.
The list has moved since that snapshot. Poland's Act on Artificial Intelligence Systems of 3 July 2026 is now in force, naming a new commission, KRiBSI, whose complaints, inspections and fining powers start on 28 October 2026. The Poland page covers it in detail.
The point most summaries miss. A missing regulator is not a missing obligation. The AI Act is a Regulation, not a Directive: it applies directly in every member state without national transposition. A deployer in Belgium carries the same duties on 2 December 2027 as a deployer in Spain. What differs is who turns up, and when.
Designated — nine states
| Member state | Authority | Status |
|---|---|---|
| Cyprus | Commissioner of Communications | Designated |
| Denmark | Danish Agency for Digital Government | Designated |
| Finland | Finnish Transport and Communications Agency (Traficom) | Designated |
| Hungary | Minister for Enterprise Development | Designated |
| Ireland | 15 sectoral bodies; Minister for Enterprise, Tourism and Employment as single point of contact | Designated |
| Italy | National Cybersecurity Agency (ACN) | Designated |
| Lithuania | Communications Regulatory Authority | Designated |
| Malta | Malta Digital Innovation Authority (MDIA) | Designated |
| Slovenia | Agency for Communication Networks and Services | Designated |
Named in draft legislation — twelve states
A bill names the authority, but it had not completed passage as of the tracker date. The body that eventually takes the role can change.
| Member state | Expected authority | Stage |
|---|---|---|
| Czech Republic | Telecommunication Office | Legislative proposal |
| France | Directorate-General for Competition, Consumer Affairs and Fraud Control | Legislative proposal |
| Germany | Federal Network Agency (Bundesnetzagentur) | Draft legislation, February 2026 |
| Luxembourg | National Commission for Data Protection (CNPD) | Draft law, December 2024 |
| Netherlands | State Inspectorate for Digital Infrastructure (RDI) | Draft legislation, April 2026 |
| Norway (EEA) | Norwegian Communications Authority (Nkom) | Proposed; law expected summer 2026 |
| Poland | Commission for the Development and Safety of AI (KRiBSI) | Draft at the snapshot date; the Act of 3 July 2026 has since entered into force, with enforcement powers from 28 October 2026 |
| Portugal | National Communications Authority (ANACOM) | Announced September 2025 |
| Romania | National Authority for Administration and Regulation in Communication | Government memorandum, March 2026 |
| Slovakia | Office for Digital Integrity | Draft legislation |
| Spain | Spanish AI Supervisory Agency (AESIA) | Agency established 2023 |
| Sweden | Post and Telecom Authority | Government proposal |
No designation — six states
| Member state | Authority | Status |
|---|---|---|
| Austria | — | No designation, no published bill |
| Belgium | — | No designation, no published bill |
| Bulgaria | — | No designation, no published bill |
| Croatia | — | No designation, no published bill |
| Estonia | — | No designation, no published bill |
| Greece | — | No designation, no published bill |
Why the choice of authority matters to you
Article 70 leaves the choice to each member state, and the choices have been strikingly different. Several picked the telecoms regulator. Italy picked its national cybersecurity agency. Luxembourg picked the data protection authority. Spain built a dedicated AI agency and did it in 2023, before the Act was in force. Ireland declined to pick one at all and spread the function across fifteen sectoral bodies.
These are not interchangeable. A telecoms regulator reads a technical file differently from a consumer-protection directorate, and a data protection authority arrives with a decade of GDPR enforcement practice and an existing view of automated decision-making. If you operate in several member states, you are preparing for several supervisory cultures, not one.
Questions
How many member states have designated an AI Act authority?
Nine of twenty-seven had completed designation as of the 17 June 2026 tracker. Twelve more had named a body in draft legislation that was not yet law. Six had done neither.
What was the deadline?
2 August 2025, under Article 70 of Regulation (EU) 2024/1689. Most member states missed it.
Does a missing authority delay my obligations?
No. The AI Act is a Regulation, so it applies directly in every member state without national transposition. High-risk obligations arrive on 2 December 2027 for stand-alone systems and 2 August 2028 for embedded ones, whether or not a supervisor has been named.
Why do the authorities differ so much between countries?
Article 70 lets each member state choose. Some picked the telecoms regulator, some the cybersecurity agency, some the data protection authority, and Spain built a dedicated AI agency. Ireland distributed the function across fifteen sectoral bodies. The supervisory culture you meet therefore depends on which door your member state chose.
Related
Agent Trust Cloud
We publish this because the deployer side of the AI Act is widely misread. Agent Trust Cloud is building a control plane for AI agents — identity, policy, evidence. The platform is in development and is not sold as a subscription today; what is available now is a fixed-scope assessment of the agents and machine identities you already have.