EU AI Act Member State Implementation Tracker. Where each of the 27 stands as of April 2026.

One hundred days from now, the main operator provisions of Regulation (EU) 2024/1689 enter application. Most deployers in Europe do not yet know which national body will supervise their compliance. This tracker exists to answer that question for every Member State using the best available verified data as of 25 April 2026. Where the data is uncertain, this document says so.

Why Member State implementation matters

The EU AI Act is a Regulation, not a Directive. That means it does not require transposition into national law to produce legal effect. From the dates specified in Article 113, the obligations it contains apply directly to providers, deployers, importers, and distributors throughout the EU without any intervening national act. Unlike GDPR, where national data protection laws were necessary to fill in specific fields, the AI Act's core requirements are self-executing.

What Member States must do, under Article 70, is not transpose the Regulation but designate the national bodies responsible for enforcing it. At minimum, each Member State must designate one notifying authority (responsible for overseeing conformity assessment bodies) and one market surveillance authority (responsible for enforcing the Act against providers and deployers in the market). Where multiple market surveillance authorities are appointed, one must be nominated as the single point of contact for coordination with the European Commission and the AI Office.

The enforcement consequences of this structure are direct. When a deployer in Paris deploys a high-risk AI system in an employment screening context, the authority that will conduct any enforcement inquiry is the French market surveillance authority, not the AI Office in Brussels. When that deployer expands to deploy the same system in Amsterdam, the Dutch authority becomes relevant in parallel. The legal standard is uniform across all 27 jurisdictions because it is set by a single Regulation, but the enforcement entity, its powers, its institutional culture, and its enforcement priorities vary by Member State.

Article 70(2) adds a further layer. For AI systems used in specific high-risk categories involving personal data, including biometric identification, law enforcement, and a number of employment and financial screening applications, data protection authorities are designated as market surveillance authorities. This means the GDPR supervisory structure is directly embedded into AI Act enforcement for the most sensitive use cases.

The penalty exposure routed through national authorities under Article 99(2) reaches EUR 15 million or 3 per cent of worldwide annual turnover for deployer obligation violations. A deployer who has not identified the relevant national authority, not consulted its published guidance, and not structured its compliance documentation with that authority's expectations in mind is operating with a material and avoidable exposure gap.

The implementation timeline

Regulation (EU) 2024/1689 entered into force on 1 August 2024. Its obligations have applied in three phases.

The first phase covered the prohibited AI practices in Article 5: social scoring by public authorities, real-time remote biometric identification in publicly accessible spaces for law enforcement purposes (with narrow exceptions), subliminal manipulation techniques causing harm, and exploitation of vulnerabilities of specific groups. These prohibitions applied from 2 February 2026. Enforcement inquiries into prohibited practices can begin from that date.

The second phase, activating on 2 August 2025, covered the obligations for providers of general-purpose AI models under Chapter V. These obligations apply to providers of foundation models and large language models placing systems on the EU market, and are supervised primarily by the AI Office within the European Commission. The codes of practice for high-capability models were developed during this period.

The third phase, activating on 2 August 2026, is the one most relevant to deployers of high-risk AI systems. From that date, the full set of provider obligations in Chapter III (Articles 9 through 17), the deployer obligations in Article 26, and the transparency obligations in Article 50 apply to the systems listed in Annex III. The penalty provisions of Article 99 become operative on the same date. This is the phase for which most organisations across the EU are preparing compliance programmes.

A further deferral applies to high-risk AI systems embedded in the regulated products listed in Annex I, including machinery, medical devices, aviation equipment, and toys. These systems face a final deadline of 2 August 2027.

Comparative status: all 27 Member States

The table below maps the designation status across all 27 Member States as of 25 April 2026. Status categories follow the European Commission's official market surveillance authority list and supplementary research from published national legislative proposals. Where no formal designation has been published and no reliable secondary source confirms a specific authority, the status is recorded as "Pending verification."

Note on methodology: The primary source for formal designations is the European Commission's official list of market surveillance authorities under the AI Act, last updated September 2025. Secondary sources include published national implementing bills, government programme declarations, and regulatory authority communications. This table is a snapshot as of April 2026 and will be updated as designations are confirmed. Omissions or corrections can be sent to the editorial desk via the contact page.

Status legend: Formally Designated = notified to Commission or equivalent formal act. Pending Final Adoption = acknowledged in Commission's pending list. Proposed = published in official government document but not legally enacted. Partial = one authority designated, remainder pending. Pending = no confirmed authority. Overdue = August 2025 deadline passed with no credible progress.

The five most-developed Member States

Italy

Italy holds a singular position in EU AI Act implementation. Law No. 132/2025, signed into law on 10 October 2025, made Italy the first EU Member State to enact dedicated and comprehensive national AI legislation complementing the Regulation. The law does not attempt to replicate the AI Act's requirements, which apply directly, but addresses areas the Regulation leaves to national discretion: sectoral rules for specific high-risk applications, governance of AI in the public sector, obligations for AI use in medical, legal, and media contexts, and the designation of national supervisory bodies.

The National Cybersecurity Agency (ACN) is designated as both market surveillance authority and single point of contact with EU institutions. This choice reflects Italy's view that AI risk is principally a cybersecurity and critical infrastructure concern rather than primarily a data protection matter. The Agency for Digital Italy (AgID) serves as notifying authority. A Coordination Committee at the Presidency of the Council of Ministers provides cross-government oversight. The Garante per la protezione dei dati personali retains its GDPR supervisory function and its Article 70(2) role as market surveillance authority for personal data-intensive AI use cases, operating in parallel with ACN.

Deployers in Italy should direct AI Act compliance enquiries to ACN for general high-risk AI matters and to the Garante for any system processing personal data in a high-risk context. ACN has begun publishing operational guidance for sectors identified in the national AI law, including healthcare and media.

Ireland

Ireland's implementation is notable for both its speed and its structural ambition. The government announced a distributed supervision model on 5 March 2025, designating 15 national competent authorities simultaneously rather than creating a single new body. The rationale was explicit: existing sectoral expertise should not be duplicated when it already exists within established regulators.

Ireland became one of the first six Member States to meet the designation milestone. The Data Protection Commission, which already supervises a substantial share of EU GDPR enforcement given the concentration of technology companies in Dublin, takes responsibility for AI systems involving personal data. The Central Bank of Ireland covers financial services AI. The Health Information and Quality Authority (HIQA) covers health sector AI. The Minister for Enterprise, Tourism and Employment is formally designated as the single point of contact for Commission notifications.

A National AI Office will be established by 2 August 2026 to coordinate the 15 authorities, host a regulatory sandbox, and provide technical expertise. The Regulation of Artificial Intelligence Bill was in the Spring 2025 Legislative Programme. Given Ireland's role as European headquarters for most of the world's largest AI system providers, the DPC's AI Act posture will have outsized practical significance for the European enforcement landscape.

Germany

Germany has made detailed proposals but has not completed formal designation. The draft KI-MIG (KI-Marktüberwachungsgesetz- und Innovationsförderungsgesetz) circulated for public consultation with a deadline of 10 October 2025. The draft designates the Bundesnetzagentur (Federal Network Agency, BNetzA) as the primary market surveillance authority, single point of contact, and operator of the national AI regulatory sandbox and the Koordinierungs- und Kompetenzzentrum KI-VO (KoKIVO).

The BfDI retains its role as the data protection authority and will function as a market surveillance authority for personal data-intensive high-risk AI systems under Article 70(2). The BSI (Federal Office for Information Security) retains oversight where AI systems intersect with cybersecurity obligations. Germany's federal structure means that Länder-level sectoral regulators will also play roles in specific domains. The BNetzA's designation as coordinating authority is designed to impose coherence on this distributed system.

Deployers operating in Germany face a genuinely complex authority landscape until the KI-MIG passes. The most practical approach is to treat the BNetzA as the likely primary contact for general AI Act matters and the BfDI for any AI system processing personal data, while monitoring the legislative progress of the implementing act.

France

France's implementation has been characterised by ambition in design and delay in execution. The Directorate-General for Enterprises (DGE) published a detailed draft in September 2025 proposing 17 market surveillance authorities, with CNIL designated for the 15 most significant AI use cases involving personal data. The CNIL published its own question-and-answer document on the AI Act's entry into force, confirming that it views AI oversight as central to its mandate and has established an internal AI division.

The political complication is that the designation provisions were withdrawn from the bill submitted to Parliament, leaving the September 2025 draft without legislative authority. As of April 2026, France remains without formally designated authorities more than eight months after the Article 70 deadline. The CNIL continues to operate as the de facto interim supervisory body for AI systems involving personal data, but its formal authority under the AI Act awaits a parliamentary act that has not yet been scheduled.

Deployers in France should treat CNIL as the most likely enforcement contact for personal data AI systems, monitor the legislative calendar for the designation bill, and maintain compliance documentation sufficient to respond to a CNIL inquiry under its existing GDPR powers while the AI Act designation remains pending.

Netherlands

The Netherlands has taken one of the most analytically thorough approaches to implementation while remaining formally undesignated the longest. In November 2025, the Autoriteit Persoonsgegevens (AP) and the Rijksinspectie Digitale Infrastructuur (RDI) published a joint advisory to the Minister of Economic Affairs recommending a five-authority co-supervision model: AP, RDI, ACM (consumer and market authority), AFM (financial markets authority), and DNB (central bank).

The Dutch government accepted the advisory framework in principle but the EU AI Act Implementation Act, the national legislative vehicle for formal designation, is not expected to be laid before Parliament until Q4 2026, well after the operator obligations have activated. The AP's Department for the Coordination of Algorithmic Oversight (DCA) functions as a practical coordination point in the interim. The AP has also published a consultation document on a national regulatory sandbox, expected to become operational by August 2026.

Deployers in the Netherlands are in an unusual position: the most likely enforcement authority is known (AP for personal data AI systems) and has published relevant interim guidance, but the formal designation giving it full Article 70 powers has not been made. The AP operates under GDPR powers in the meantime, which substantially overlap with the AI Act's requirements for personal data-intensive systems.

The cross-border deployer's reading guide

A deployer that operates AI systems in more than one Member State faces a structural compliance question that the AI Act does not resolve with complete clarity: which authority is your primary supervisor, and when does a second authority's role become active?

The general rule, derived from Article 70(3) and the market surveillance coordination provisions in Articles 74 and 75, is that a deployer's primary supervisor is the market surveillance authority of the Member State where the deployer is established. If the deployer is not established in the EU, the primary supervisor is in the Member State where the affected persons are located, or where the system has its most significant impact.

A secondary authority becomes active when a deployer's AI system affects persons in its territory. Under Article 74, where a national authority has reasonable grounds to believe that an AI system presents a risk and the system is being used in its territory, it may require the deployer to provide information, conduct a technical assessment, and take corrective measures. This can occur even when the deployer's primary supervisor is in another Member State.

Article 75 provides for mutual assistance between national authorities. An authority in one Member State can request investigatory action from an authority in another, and the requested authority is required to act within specified timeframes. This mechanism creates genuine multi-authority exposure for deployers whose systems operate across borders. A complaint filed in any Member State where the system is deployed can initiate a process that reaches back to the deployer's home authority.

For deployers with operations concentrated in one Member State, the practical implication is simpler: focus compliance investment on understanding the designated authority in that Member State, engage with its published guidance early, and maintain documentation that could be produced to a secondary authority if required. For deployers with genuinely pan-European deployment, a compliance programme that is defensible to the most demanding designated authority in the operating footprint will be adequate for all others, since the substantive standard is uniform.

The European Artificial Intelligence Board, established under Article 65, provides the coordination layer above the national authorities. Its role is non-enforcement: it provides opinions, recommends guidelines, and supports the Commission in developing delegated acts. But its outputs on the application of the classification rules and the documentation standards will be the reference documents that national authorities use when assessing deployer compliance. Monitoring Board publications and Commission implementing guidelines is part of the compliance infrastructure for any multi-market deployer.

What to do if your designated authority has not been finalised

For deployers in one of the 18 Member States that have not yet completed formal designation, the practical question is how to direct compliance investment and engagement in the absence of a formally designated counterpart.

The first step is to identify which existing sectoral authority most closely corresponds to the AI use case being deployed. In virtually every Member State, the data protection authority already has oversight capacity over AI systems involving personal data, derived from its GDPR mandate. For most high-risk AI deployers, this authority is the most likely interim enforcement contact.

The second step is to consult whatever interim guidance the likely authority has published. Several data protection authorities, including the German BfDI and the Dutch AP, have published AI-specific guidance documents that overlap substantially with AI Act requirements. CNIL has published detailed technical recommendations on AI systems developed with personal data. These documents represent the expectations of the bodies most likely to conduct early enforcement, even before formal designation is complete.

The third step is to maintain the minimum operator file described in Article 26 regardless of authority designation status. The AI Act obligations do not depend on formal authority designation. A deployer who holds a current risk record, an oversight register, a map of the instructions for use received from the provider, a logging schedule, and an incident protocol is in a defensible position regardless of which authority eventually conducts an inquiry. A deployer who has waited for formal designation to begin compliance work is not.

The fourth step is to subscribe to official channels from the likely supervisory authority. Most data protection authorities and digital regulators publish newsletters, consultation notices, and guidance documents. Designations, when they are completed, will be announced through these channels before they appear in secondary sources.

Finally, deployers in undesignated Member States should not interpret the absence of a formal authority as effective suspension of the AI Act. The European Commission retains oversight capacity, including through the AI Office, and has indicated that it will monitor Member State implementation progress. Cross-border coordination mechanisms remain available to fully designated authorities in other Member States. The risk of enforcement action does not wait for national designation to be complete.

Resources by Member State

The following are official publications from designated or proposed national authorities. Links are provided for verification and direct engagement.

• Belgium: BIPT application of the AI Act guidance
• Cyprus: Ministry of Research, Innovation and Digital Policy
• Finland: Finnish Government announcement on AI Act supervision (January 2026)
• France: CNIL questions and answers on EU AI Act entry into force
• Germany: Bundesnetzagentur (BNetzA)
• Hungary: Hungary implements institutional framework for EU AI Act (CMS analysis of Act LXXV/2025)
• Ireland: Ireland Department of Enterprise announcement on AI Act competent authorities
• Italy: Agenzia per la cybersicurezza nazionale (ACN)
• Lithuania: Communications Regulatory Authority (RRT)
• Luxembourg: CNPD: AI Act one year on (August 2025)
• Malta: Malta Digital Innovation Authority (MDIA)
• Netherlands: AP Department for Coordination of Algorithmic Oversight (DCA)
• Spain: Agencia Española de Supervisión de Inteligencia Artificial (AESIA)
• European Commission official list: Market Surveillance Authorities under the AI Act (updated continuously)
• Comprehensive tracker: EU Artificial Intelligence Act: National Implementation Plans overview