EU AI Act Member State Implementation Tracker. Where each of the 27 stands.

Most deployers in Europe still do not know which national body will supervise their compliance. This tracker exists to answer that question for every Member State. The designation picture below was re-read at national sources on 17 August 2026, and it had moved substantially since this page was first written: four Member States that this tracker described as pending have since enacted or designated. Where a claim could not be confirmed at a national source, this document now says so instead of carrying the old entry forward.

Why Member State implementation matters

The EU AI Act is a Regulation, not a Directive. That means it does not require transposition into national law to produce legal effect. From the dates specified in Article 113, the obligations it contains apply directly to providers, deployers, importers, and distributors throughout the EU without any intervening national act. Unlike GDPR, where national data protection laws were necessary to fill in specific fields, the AI Act's core requirements are self-executing.

What Member States must do, under Article 70, is not transpose the Regulation but designate the national bodies responsible for enforcing it. At minimum, each Member State must designate one notifying authority (responsible for overseeing conformity assessment bodies) and one market surveillance authority (responsible for enforcing the Act against providers and deployers in the market). Where multiple market surveillance authorities are appointed, one must be nominated as the single point of contact for coordination with the European Commission and the AI Office.

The enforcement consequences of this structure are direct. When a deployer in Paris deploys a high-risk AI system in an employment screening context, the authority that will conduct any enforcement inquiry is the French market surveillance authority, not the AI Office in Brussels. When that deployer expands to deploy the same system in Amsterdam, the Dutch authority becomes relevant in parallel. The legal standard is uniform across all 27 jurisdictions because it is set by a single Regulation, but the enforcement entity, its powers, its institutional culture, and its enforcement priorities vary by Member State.

Article 70(2) adds a further layer. For AI systems used in specific high-risk categories involving personal data, including biometric identification, law enforcement, and a number of employment and financial screening applications, data protection authorities are designated as market surveillance authorities. This means the GDPR supervisory structure is directly embedded into AI Act enforcement for the most sensitive use cases.

The penalty exposure routed through national authorities under Article 99(2) reaches EUR 15 million or 3 per cent of worldwide annual turnover for deployer obligation violations. A deployer who has not identified the relevant national authority, not consulted its published guidance, and not structured its compliance documentation with that authority's expectations in mind is operating with a material and avoidable exposure gap.

The implementation timeline

Regulation (EU) 2024/1689 entered into force on 1 August 2024. Its obligations have applied in three phases.

The first phase covered the prohibited AI practices in Article 5: social scoring by public authorities, real-time remote biometric identification in publicly accessible spaces for law enforcement purposes (with narrow exceptions), subliminal manipulation techniques causing harm, and exploitation of vulnerabilities of specific groups. These prohibitions have applied since 2 February 2025. Supervision and enforcement of them commenced on 2 August 2026.

The second phase, activating on 2 August 2025, covered the obligations for providers of general-purpose AI models under Chapter V. These obligations apply to providers of foundation models and large language models placing systems on the EU market, and are supervised primarily by the AI Office within the European Commission. The codes of practice for high-capability models were developed during this period.

The third phase split in two. The Article 50 transparency obligations and the Article 99 penalty regime activated on 2 August 2026 as originally scheduled and are in application now. The provider obligations in Chapter III (Articles 9 through 17) and the deployer obligations in Article 26, as they apply to the systems listed in Annex III, were deferred by the Digital Omnibus to 2 December 2027. This is the phase for which most organisations across the EU are building compliance programmes, and it is the phase the designation gaps below now have to close against.

A further deferral applies to high-risk AI systems embedded in the regulated products listed in Annex I, including machinery, medical devices, aviation equipment, and toys. These systems face a final deadline of 2 August 2028, moved by the Digital Omnibus from 2 August 2027.

Comparative status: all 27 Member States

The table below maps the designation status across all 27 Member States. Fifteen entries were re-read at national sources on 17 August 2026 and are dated in the table. The remainder still rest on the position as at April 2026 and are marked as such; treat those as a lead, not as a finding. Where nothing could be confirmed at a national source, the entry says "Pending verification" rather than naming a likely authority.

Note on methodology: the European Commission's list of market surveillance authorities under the AI Act carries a last update of 26 September 2025 and is no longer a reliable current picture; this tracker previously described it as updated continuously, which was wrong. Entries dated 17 August 2026 below were read at the Member State's own ministry, regulator, parliament or official gazette. Entries not so dated rest on the April 2026 research and have not been re-verified. Omissions or corrections can be sent to the editorial desk via the contact page.

Status legend: Formally Designated = notified to Commission or equivalent formal act. Pending Final Adoption = acknowledged in Commission's pending list. Proposed = published in official government document but not legally enacted. Partial = one authority designated, remainder pending. Pending = no confirmed authority. Overdue = August 2025 deadline passed with no credible progress.

The five most-developed Member States

Italy

Italy holds a singular position in EU AI Act implementation. Law No. 132/2025, signed into law on 10 October 2025, made Italy the first EU Member State to enact dedicated and comprehensive national AI legislation complementing the Regulation. The law does not attempt to replicate the AI Act's requirements, which apply directly, but addresses areas the Regulation leaves to national discretion: sectoral rules for specific high-risk applications, governance of AI in the public sector, obligations for AI use in medical, legal, and media contexts, and the designation of national supervisory bodies.

The National Cybersecurity Agency (ACN) is designated as both market surveillance authority and single point of contact with EU institutions. This choice reflects Italy's view that AI risk is principally a cybersecurity and critical infrastructure concern rather than primarily a data protection matter. The Agency for Digital Italy (AgID) serves as notifying authority. A Coordination Committee at the Presidency of the Council of Ministers provides cross-government oversight. The Garante per la protezione dei dati personali retains its GDPR supervisory function and its Article 70(2) role as market surveillance authority for personal data-intensive AI use cases, operating in parallel with ACN.

Deployers in Italy should direct AI Act compliance enquiries to ACN for general high-risk AI matters and to the Garante for any system processing personal data in a high-risk context. ACN has begun publishing operational guidance for sectors identified in the national AI law, including healthcare and media.

Ireland

Ireland's implementation is notable for both its speed and its structural ambition. The government approved a roadmap on 4 March 2025 designating an initial eight bodies, and completed the designation of 15 national competent authorities on 16 September 2025, rather than creating a single new body. The rationale was explicit: existing sectoral expertise should not be duplicated when it already exists within established regulators.

Ireland was among the first Member States to meet the designation milestone. The Data Protection Commission, which already supervises a substantial share of EU GDPR enforcement given the concentration of technology companies in Dublin, takes responsibility for AI systems involving personal data. The Central Bank of Ireland covers financial services AI. The health bodies are the Health and Safety Authority, the Health Service Executive and the Health Products Regulatory Authority. An earlier version of this tracker named HIQA in that role; HIQA is not among the fifteen and that sentence has been removed.

The Regulation of Artificial Intelligence Act 2026 was signed into law on 21 July 2026 and establishes the AI Office of Ireland, which coordinates the 15 authorities and is the single point of contact. It has been operational since 2 August 2026. An earlier version of this tracker named the Minister for Enterprise, Tourism and Employment as the single point of contact; that is superseded. Given Ireland's role as European headquarters for most of the world's largest AI system providers, the DPC's AI Act posture will have outsized practical significance for the European enforcement landscape.

Germany

Germany has completed formal designation. The KI-MIG (KI-Marktüberwachungs- und Innovationsförderungsgesetz) was adopted by the Bundestag on 11 June 2026, Drucksache 21/4594, committee version 21/6407, promulgated as BGBl. I 2026 Nr. 223 and in force since 29 July 2026. It makes the Bundesnetzagentur (Federal Network Agency, BNetzA) the market surveillance authority, the contact point and the complaints body, and the operator of the national AI regulatory sandbox and the Koordinierungs- und Kompetenzzentrum KI-VO (KoKIVO). An earlier version of this tracker described the KI-MIG as a draft in consultation; it is law.

The BfDI retains its role as the data protection authority and will function as a market surveillance authority for personal data-intensive high-risk AI systems under Article 70(2). The BSI (Federal Office for Information Security) retains oversight where AI systems intersect with cybersecurity obligations. Germany's federal structure means that Länder-level sectoral regulators will also play roles in specific domains. The BNetzA's designation as coordinating authority is designed to impose coherence on this distributed system.

Deployers operating in Germany now have a named counterpart. Treat the BNetzA as the contact for general AI Act matters and the BfDI for any AI system processing personal data. On Article 28 notification, the notifying authority sits with the authorities already designated for the relevant Annex I legislation; BNetzA holds it for Directive 2014/53/EU. Germany's national accreditation body, DAkkS, accredits conformity assessment bodies under Regulation (EC) 765/2008 and the AkkStelleG. It holds no notification role under Article 28.

France

France's implementation has been characterised by ambition in design and delay in execution. The Directorate-General for Enterprises (DGE) published a detailed draft on 9 September 2025 proposing 17 market surveillance authorities. In that scheme the DGCCRF is the coordinator and the single point of contact under Article 70(2), the DGE is the French representative to the European AI Board, and CNIL is proposed for biometric and emotion prohibited practices together with high-risk employment, education, justice and democracy systems. The scheme applies only if Parliament accepts it.

The political complication is that the designation provisions were withdrawn from the bill submitted to Parliament and re-tabled, leaving the September 2025 draft without legislative authority. As of 17 August 2026, France remains without formally designated authorities, a year after the Article 70 deadline. The CNIL continues to operate as the de facto interim supervisory body for AI systems involving personal data, but its formal authority under the AI Act awaits a parliamentary act.

Deployers in France should treat CNIL as the most likely enforcement contact for personal data AI systems and maintain documentation sufficient to answer a CNIL inquiry under its existing GDPR powers. Do not describe CNIL as the French AI Act authority or as the single point of contact. The published draft gives the coordinating role and the single point of contact to the DGCCRF, and nothing is adopted.

Netherlands

The Netherlands has taken one of the most analytically thorough approaches to implementation while remaining formally undesignated. In November 2025, the Autoriteit Persoonsgegevens (AP) and the Rijksinspectie Digitale Infrastructuur (RDI) published a joint advisory to the Minister of Economic Affairs and the State Secretary for Legal Protection recommending a five-authority co-supervision model: AP, RDI, ACM, AFM and DNB. That advisory has since been superseded by the draft bill, which names ten market surveillance authorities: AP, RDI, ILT, IGJ, NVWA, NLA, AFM, DNB, PGHR and ABRvS, with AP and RDI coordinating. ACM is not among them.

The Uitvoeringswet AI-verordening, the national legislative vehicle for formal designation, went to internet consultation from 20 April to 1 June 2026 and remains a draft bill. The AP's Department for the Coordination of Algorithmic Oversight (DCA) functions as a practical coordination point in the interim. With Annex III now activating on 2 December 2027, the Dutch timetable has more room than it did, but nothing is designated.

Deployers in the Netherlands are in an unusual position: the most likely enforcement authority is known (AP for personal data AI systems) and has published relevant interim guidance, but the formal designation giving it full Article 70 powers has not been made. The AP operates under GDPR powers in the meantime, which substantially overlap with the AI Act's requirements for personal data-intensive systems.

The cross-border deployer's reading guide

A deployer that operates AI systems in more than one Member State faces a structural compliance question that the AI Act does not resolve with complete clarity: which authority is your primary supervisor, and when does a second authority's role become active?

The general rule, derived from Article 70(3) and the market surveillance coordination provisions in Articles 74 and 75, is that a deployer's primary supervisor is the market surveillance authority of the Member State where the deployer is established. If the deployer is not established in the EU, the primary supervisor is in the Member State where the affected persons are located, or where the system has its most significant impact.

A secondary authority becomes active when a deployer's AI system affects persons in its territory. Under Article 74, where a national authority has reasonable grounds to believe that an AI system presents a risk and the system is being used in its territory, it may require the deployer to provide information, conduct a technical assessment, and take corrective measures. This can occur even when the deployer's primary supervisor is in another Member State.

Article 75 provides for mutual assistance between national authorities. An authority in one Member State can request investigatory action from an authority in another, and the requested authority is required to act within specified timeframes. This mechanism creates genuine multi-authority exposure for deployers whose systems operate across borders. A complaint filed in any Member State where the system is deployed can initiate a process that reaches back to the deployer's home authority.

For deployers with operations concentrated in one Member State, the practical implication is simpler: focus compliance investment on understanding the designated authority in that Member State, engage with its published guidance early, and maintain documentation that could be produced to a secondary authority if required. For deployers with genuinely pan-European deployment, a compliance programme that is defensible to the most demanding designated authority in the operating footprint will be adequate for all others, since the substantive standard is uniform.

The European Artificial Intelligence Board, established under Article 65, provides the coordination layer above the national authorities. Its role is non-enforcement: it provides opinions, recommends guidelines, and supports the Commission in developing delegated acts. But its outputs on the application of the classification rules and the documentation standards will be the reference documents that national authorities use when assessing deployer compliance. Monitoring Board publications and Commission implementing guidelines is part of the compliance infrastructure for any multi-market deployer.

What to do if your designated authority has not been finalised

For deployers in a Member State that has not yet completed formal designation, the practical question is how to direct compliance investment and engagement in the absence of a formally designated counterpart.

The first step is to identify which existing sectoral authority most closely corresponds to the AI use case being deployed. In virtually every Member State, the data protection authority already has oversight capacity over AI systems involving personal data, derived from its GDPR mandate. For most high-risk AI deployers, this authority is the most likely interim enforcement contact.

The second step is to consult whatever interim guidance the likely authority has published. Several data protection authorities, including the German BfDI and the Dutch AP, have published AI-specific guidance documents that overlap substantially with AI Act requirements. CNIL has published detailed technical recommendations on AI systems developed with personal data. These documents represent the expectations of the bodies most likely to conduct early enforcement, even before formal designation is complete.

The third step is to maintain the minimum operator file described in Article 26 regardless of authority designation status. The AI Act obligations do not depend on formal authority designation. A deployer who holds a current risk record, an oversight register, a map of the instructions for use received from the provider, a logging schedule, and an incident protocol is in a defensible position regardless of which authority eventually conducts an inquiry. A deployer who has waited for formal designation to begin compliance work is not.

The fourth step is to subscribe to official channels from the likely supervisory authority. Most data protection authorities and digital regulators publish newsletters, consultation notices, and guidance documents. Designations, when they are completed, will be announced through these channels before they appear in secondary sources.

Finally, deployers in undesignated Member States should not interpret the absence of a formal authority as effective suspension of the AI Act. The European Commission retains oversight capacity, including through the AI Office, and has indicated that it will monitor Member State implementation progress. Cross-border coordination mechanisms remain available to fully designated authorities in other Member States. The risk of enforcement action does not wait for national designation to be complete.

Resources by Member State

The following are official publications from designated or proposed national authorities. Links are provided for verification and direct engagement.

• Belgium: BIPT application of the AI Act guidance
• Cyprus: Ministry of Research, Innovation and Digital Policy
• Finland: Finnish Government announcement on AI Act supervision (January 2026)
• France: CNIL questions and answers on EU AI Act entry into force
• Germany: Bundesnetzagentur (BNetzA)
• Hungary: Hungary implements institutional framework for EU AI Act (CMS analysis of Act LXXV/2025)
• Ireland: Ireland Department of Enterprise announcement on AI Act competent authorities
• Italy: Agenzia per la cybersicurezza nazionale (ACN)
• Lithuania: Communications Regulatory Authority (RRT)
• Luxembourg: CNPD: AI Act one year on (August 2025)
• Malta: Malta Digital Innovation Authority (MDIA)
• Netherlands: AP Department for Coordination of Algorithmic Oversight (DCA)
• Spain: Agencia Española de Supervisión de Inteligencia Artificial (AESIA)
• European Commission official list: Market Surveillance Authorities under the AI Act (last update 26 September 2025)
• Comprehensive tracker: EU Artificial Intelligence Act: National Implementation Plans overview