AI Act · Enforcement
EU AI Act national authorities: contacts by member state
The AI Act is enforced mainly by national authorities that each Member State designates, plus the Commission’s AI Office for general-purpose AI models. Use the dated table below to find the Commission’s published point of contact for each Member State. Pending designations and missing entries are marked.
Two quick answers
Who enforces the EU AI Act?
Each Member State designates national competent authorities: market surveillance authorities, which enforce the Act in that country, and notifying authorities, which oversee the bodies that assess high-risk systems. The AI Office, part of the European Commission, enforces the rules for general-purpose AI models.
When did Member States have to designate their authorities?
Member States had to designate their national competent authorities by 2 August 2025, under Article 70 of the AI Act.
How enforcement is structured
The AI Act is a Regulation, so it applies directly in every Member State. What each Member State decides is who supervises it. Article 70 of the Act requires each one to designate national competent authorities of two kinds:
- Market surveillance authorities, which check that AI systems on the market meet the Act and can act when they do not.
- Notifying authorities, which set up and run the procedures for assessing and notifying the conformity assessment bodies that check high-risk systems.
Article 70 also requires Member States to name a single point of contact and to tell the Commission who their authorities are. Member States choose their own arrangements, so the supervisor you deal with in one country may be a different kind of body from the one in another. The date by which this had to be done was 2 August 2025.
The AI Office
The AI Office is the Commission’s body for the AI Act (see Article 64). It supervises providers of general-purpose AI models, and it coordinates the national authorities. For general-purpose AI models you deal with the Commission, not with a national authority.
National authorities, by Member State
This directory follows the European Commission’s single points of contact for AI Act market surveillance. It identifies a contact route, not every regulator with a sectoral or notifying role.
Source updated ; checked . * means the Commission marks final national designation as pending. A dash means no contact is listed there; it does not establish that the country has no authority.
| Member State | Contact listed by the Commission |
|---|---|
| Austria | — |
| Belgium | — |
| Bulgaria | — |
| Croatia | — |
| Cyprus | *Commissioner of Communications |
| Czech Republic | *Czech Telecommunication Office |
| Denmark | Agency for Digital Government |
| Estonia | *Consumer Protection and Technical Regulatory Authority |
| Finland | Traficom |
| France | *DGCCRF |
| Germany | *Bundesnetzagentur |
| Greece | Hellenic Data Protection Authority |
| Hungary | — |
| Ireland | AI Office of Ireland |
| Italy | National Cybersecurity Agency |
| Latvia | Consumer Rights Protection Centre |
| Lithuania | Communications Regulatory Authority |
| Luxembourg | *National Commission for Data Protection |
| Malta | Malta Digital Innovation Authority |
| Netherlands | *Dutch Authority for Digital Infrastructure |
| Poland | KRiBSI |
| Portugal | *ANACOM |
| Romania | *ANCOM |
| Slovakia | — |
| Slovenia | *AKOS |
| Spain | *AESIA |
| Sweden | *Swedish Post and Telecom Authority |
For the authority’s remit and current contact details, check the Member State’s own publication. Notifying authorities are a separate Article 70 role.
Country guides on this site
We have separate guides for some Member States. Each is a reference on that country’s arrangements, not a substitute for the Member State’s own publication.