National Enforcement Bodies

The EU AI Act creates a multi-layered governance architecture — EU-level coordination through the AI Office and AI Board, national enforcement through designated competent authorities, and sector-specific oversight through market surveillance bodies. Knowing who enforces what, where, is essential for any organisation operating AI systems in the EU.

EU-Level Bodies

European coordination and oversight

Four EU-level bodies coordinate AI Act enforcement, manage the AI database, and provide technical expertise for GPAI evaluation.

European AI Office

Active

Established within the European Commission. Oversees GPAI model compliance, coordinates between national authorities, develops codes of practice, and manages the EU AI database. The central coordination point for cross-border AI governance.

EU AI Database

Active

The EU database for high-risk AI systems (Art. 71). Providers and deployers must register high-risk systems before placing them on the market. The database is publicly accessible and serves as the central registry for market surveillance.

European Artificial Intelligence Board

Active

Composed of representatives from each member state. Advises the Commission on implementation, promotes consistent application across member states, issues opinions on cross-border matters, and contributes to guidelines and codes of practice.

Scientific Panel of Independent Experts

Active

Provides technical expertise for GPAI model evaluation, systemic risk assessment, and capability classification. Supports the AI Office in monitoring compliance of general-purpose AI models, including those with systemic risk.

Designated Authorities

Member states with designated competent authorities

As of April 2026, four member states have formally designated their national competent authorities under Article 70.

🇪🇸 Spain

National competent authority (coordinator)

**AESIA — Agencia Española de Supervisión de Inteligencia Artificial** — First EU member state to create a dedicated AI supervisory agency. AESIA coordinates 21 supporting sectoral authorities. Established by Royal Decree 729/2023.

🇮🇪 Ireland

Market surveillance across sectors

**Distributed model — 15 competent authorities** — Ireland uses a distributed regulatory model with 15 designated authorities spanning financial services (CBI), broadcasting (BAI), health products (HPRA), telecommunications (ComReg), utilities (CRU), and consumer protection (CCPC).

🇮🇹 Italy

Innovation & enforcement

**AgID + National Cybersecurity Agency (ACN)** — Dual-authority model. AgID (Agency for Digital Italy) promotes innovation and manages conformity procedures. ACN (Agenzia per la Cybersicurezza Nazionale) oversees enforcement and sanctions.

🇫🇷 France

Sector-specific market surveillance

**CNIL, DGCCRF, ARCOM (multi-authority)** — Decentralised model. CNIL oversees 15 AI use cases (data protection-adjacent). DGCCRF handles 14 use cases (consumer protection). ARCOM covers 7 use cases (audiovisual/digital). ANSM covers medical device AI.

Pending Designations

Member states awaiting formal designation

The remaining 23 member states are at various stages of the designation process. The August 2025 deadline under Article 70 has passed — implementation is ongoing.

🇩🇪 Germany

**Bundesnetzagentur (BNetzA) — proposed** — Draft implementation act designates the Federal Network Agency as main market surveillance authority. Legislation delayed past the August 2025 deadline.

🇳🇱 Netherlands

**Autoriteit Persoonsgegevens (AP) — expected** — The Dutch Data Protection Authority is expected to play a central role. Formal designation awaiting legislative process.

🇧🇪 Belgium

**To be designated** — Designation process ongoing. Belgium's federal structure adds complexity — competences may be split between federal and regional authorities.

🇦🇹 Austria

**To be designated** — 11 fundamental rights authorities identified. Market surveillance and notifying authority designation pending legislative action.

🇸🇪 Sweden

**To be designated** — Expected to follow a distributed model aligned with existing sectoral regulators. Formal designation pending.

🇩🇰 Denmark

**To be designated** — Danish authorities evaluating institutional arrangements. Designation expected to align with existing market surveillance infrastructure.

🇫🇮 Finland

**To be designated** — National implementation planning underway. Finland has been active in AI governance policy but formal authority designation is pending.

🇵🇱 Poland

**To be designated** — Implementation planning in early stages. One of the larger member states yet to formalise its AI Act governance structure.

🇵🇹 Portugal

**To be designated** — Expected to build on existing data protection and market surveillance infrastructure.

🇨🇿 Czech Republic