Since the AI Act entered into force on the 1st of August, it has become crunch time for Member States to prepare the implementation of the Act. One of the first aspects of national implementation is to designate authorities. This post gives an overview of the national authorities to be designated under the AI Act and what we know about the national implementation plans as per the date of publication.
This resource is a work in progress, and will be updated when new information is available. Please help us ensure the completeness and accuracy of this content by contributing any information you have about the authorities in your area: tekla@futureoflife.org.
Three types of authorities in Member States under the AI Act
Member States are required to designate or establish three kinds of authorities as part of the implementation of the EU AI Act.
Market Surveillance Authority
First, a ‘market surveillance authority’ shall carry out activities and take measures known from Regulation (EU) 2019/1020 on market surveillance and compliance of products (Art 3(26)). Thus, this authority builds upon the pre-existing and well-established concept of market surveillance authorities within EU law and will be tasked with ensuring that only products compliant with EU law are made available on the Union market.
Notifying Authority
Second, a ‘notifying authority’ will be the national authority responsible for establishing and performing the procedure for assessment, designation and notification of conformity assessment bodies and for their monitoring (Art 3(19) and Art 28(1)). ‘Conformity assessment bodies’ are bodies that perform third-party conformity assessment activities, including testing, certification and inspection (Art 3(21)).
The notifying authority and the market surveillance authority are collectively referred to as the national competent authorities (Art 3(48)). They must function independently, impartially and without bias, have adequate technical, financial and human resources, as well as the infrastructure to effectively execute their tasks under the AI Act (Art 70(1)&(3)). The Commission will facilitate exchange of experience between national competent authorities (Art 70(7)).
National Public Authority
Third, Member States must identify national public authorities that enforce the respect for fundamental rights obligation in Member States in relation to High-risk AI systems referred to in Annex III. Such authorities should have powers to request and access any documentation created or maintained under the AI Act, when such documentation is necessary to effectively fulfill their mandate within the limits of their jurisdiction (Art 77 (2)).
Wide discretions for Member States
The AI Act gives Member States discretion with regards to the structure and design of these three types of authorities. Accordingly, Member States have proposed or designated authorities that take a range of forms. For example, Spain has established a Spanish Artificial Intelligence Supervisory Agency (AESIA) acting as a single market surveillance authority under the Spanish Department of Digital Transformation. In contrast, Finland has proposed a decentralized model appointing 10 already existing market surveillance authorities, including the Energy Authority, The Transport and Communications Agency, and the Medicines Agency.
Timelines and status of implementation
See our full Implementation Timeline for all key dates and deadlines for the AI Act.
Member States must establish or designate competent authorities by the 2nd of August 2025 (Art 113(b)). As per the date of publication, Malta is the only Member State which has designated both notifying and market surveillance authorities (‘clear’ in the table below). Eight Member States have pending legislative proposals or have appointed one competent authority (‘partial clarity’), whereas 18 Member States have not, to our knowledge, designated or established any competent authority.
With regards to authorities protecting fundamental rights, Member States should publish a list of such authorities by the 2nd of November 2024 (Art 77 (2)). To our knowledge, only four Member States have published a list of such authorities as per the date of publication.
Table 1: Overall status of National Authorities
| Status (as of date of publication) | National Competent Authorities (Art 28 and Art 70) | Authorities Protecting Fundamental Rights (Art 77) |
|---|---|---|
| Unclear | 18 | 23 |
| Partial clarity | 8 | – |
| Clear | 1 | 4 |
Table 2: Member States and their designated National Authorities
| Member State | National Competent Authorities (Art 28 and Art 70) | Authorities Protecting Fundamental Rights (Art 77) | Notes |
|---|---|---|---|
| Austria | Unclear. An AI Service Desk has been established under the Austrian Regulatory Authority for Broadcasting and Telecommunications (RTR) to support the implementation of the EU AI Act. The notifying authority and market surveillance authorities have not been appointed. | Unclear | Austria has established a national AI Advisory Board (‘KI Beirat’) composed of experts from research and business. |
| Belgium | Unclear. In the AI Board meeting on 10.09.2024, the Federal Public Service of Economy and the Agence du Numérique represented Belgium. | Unclear | Belgium has an Ethics Advisory Council on Data and AI appointed by the Minister of Civil Service and the State Secretary for Digitization. |
| Bulgaria | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Electronic Governance represented Bulgaria. | Unclear | |
| Croatia | Unclear. In the AI Board meeting on 10.09.2024, the Central State Office for the Development of Digital Society represented Croatia. | Unclear | |
| Cyprus | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Research, Innovation and Digital Policy represented Cyprus. | The Ministry of Research, Innovation and Digital Policy have identified a list of 3 public authorities, subject to changes. | |
| Czech Republic | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Industry and Trade represented the Czech Republic. | Unclear | The Ministry of Industry and Trade was also in charge of adopting a revised national AI strategy in July 2024. |
| Denmark | Partial clarity. The pre-existing Danish Agency for Digital Government has been designated as coordinating market surveillance authority and single point of contact. Unclear what body will be notifying authority. | Unclear | A working group representing range of actors (civil society, industry, public institutions, academia, etc) was established in September 2024. It will convene 3-4 times per year. |
| Estonia | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Economic Affairs and Communications represented Estonia. | Unclar | |
| Finland | Partial clarity. A draft implementing act from October, 2024, appoints 10 already existing market surveillance authorities (see English overview). The Finnish Transport and Communications Agency will act as the single point of contact. Unclear what body will be notifying authority. | Unclear | The draft implementing act is open for public consultations until the 4th of December 2024. |
| France | Unclear. In the AI Board meeting on 10.09.2024, the Directorate General of Enterprises represented France. | Unclear | |
| Germany | Unclear. The Federal Ministry for Economic Affairs and Climate Action and the Ministry for Justice are jointly responsible for the implementation of the AI Act, but the competent authorities are undecided as of September 2024. | Unclear | An implementing act is expected Q1 of 2025. |
| Greece | Unclear. In the AI Board meeting on 10.09.2024,the Ministry of Digital Governance represented Greece. | Unclear | |
| Hungary | Partial clarity. According to a government resolution, a new enforcement body will be established under the Minister for National Economy with the purpose of fulfilling the tasks of the notifying authority as well as market surveillance authority. | Unclear | According to the government resolution, an AI Council will be established with powers to issue guidelines and resolutions. Delegates will include representatives from National Media and Infocommunications Authority, the Hungarian National Bank, and the Hungarian Competition Authority. The deadline for the Ministry of National Economy to propose the corresponding law is 30th of November. |
| Ireland | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Enterprise, Trade and Employment represented Ireland. | The Department of Enterprise, Trade and Employment has listed 9 national public authorities. | |
| Italy | Partial clarity. A legislative proposal from May 2024 designates the National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) as market surveillance authority with monitoring, inspection and enforcement powers in relation to AI systems. The proposal designates the Agency for Digital Italy (Agenzia per l’Italia Digitale, AgID) as notifying authority. | Unclear | |
| Latvia | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Smart Administration and Regional Development represented Latvia. | Unclear | |
| Lithuania | Partial clarity. A pending implementing law designates the Innovation Agency as notifying authority. The proposal designates the Regulatory Communications Authority as an AI market surveillance authority and single point of contact. | Unclear | Lithuania has launched AI sandbox pilots. |
| Luxembourg | Unclear. In the AI Board meeting on 10.09.2024, the State Department represented Luxembourg. | Unclear | |
| Malta | Clear. The Malta Digital Innovation Authority (MDIA) and the Information Data Protection Commission will jointly serve as market surveillance authorities. Further, the MDIA is designated as a notifying authority together with the National Accreditation Board. | A list of 10 authorities protecting fundamental rights has been outlined. | |
| The Netherlands | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Economic Affairs and Climate Policy represented the Netherlands. | Unclear | The Dutch government has gathered interim advice on supervisory structure for the AI Act with input from 22 relevant Dutch supervisory authorities including the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure. |
| Poland | Partial clarity. A pending implementing act establishes a new body, the Committee on Development and Security of AI, as the market surveillance authority and single point of contact. The act designates the Minister of Digitization as notifying authority. | Unclear | The law is expected to be adopted by Q4 2024. |
| Portugal | Unclear. In the AI Board meeting on 10.09.2024, the Administrative Modernization Agency represented Portugal. | The Ministry of Youth and Modernization released a list of 14 agencies. | |
| Romania | Partial clarity. According to the Romanian national AI strategy from July 2024, a new AI Regulatory Authority will be established with the purpose of fulfilling the tasks of the notifying authority as well as market surveillance authority. The strategy falls under the scope of the Authority for the Digitalization of Romania which was also the authority representing Romania in the AI Board meeting on 10.09.2024. | Unclear | |
| Slovakia | Unclear. In the AI Board meeting on 10.09.2024, the Ministry of Investment, Regional Development and Informatics represented Slovakia. | Unclear | A Standing Commission on Ethics and Regulation of AI (CERAI) was established in 2020. AISlovakia is a neutral, independent non-profit platform facilitating cooperation on AI between academia, employers, government representatives, and representatives of international institutions. |
| Slovenia | Unclear. The Ministry of Digital Transformation is responsible for implementing the AI Act into Slovenian law. As per 12.09, an expert council consisting of Slovenian experts is expected to be established to advise on the implementation. | Unclear | |
| Spain | Partially clear. The Spanish Artificial Intelligence Supervisory Agency (AESIA) was established in September 2023 as an autonomous agency of the Spanish Department of Digital Transformation.The agency will constitute market surveillance authority and single point of contact. The notifying body has not been designated yet. | Unclear | |
| Sweden | Unclear. The Swedish Data Protection Authority as well as the Swedish Digitalization Authority have published statements about the implementation of the AI Act. In the AI Board meeting on 10.09.2024, the Ministry of Finance represented Sweden. | Unclear | Sweden has established an AI Council with the aim of strengthening Swedish AI competitiveness. |