Overview of all AI Act National Implementation Plans

08 Nov, 2024

Since the AI Act entered into force on the 1st of August, it has become crunch time for Member States to prepare the implementation of the Act. One of the first aspects of national implementation is to designate authorities. This post gives an overview of the national authorities to be designated under the AI Act and what we know about the national implementation plans as per the date of publication. 

This resource is a work in progress, and will be updated when new information is available. Please help us ensure the completeness and accuracy of this content by contributing any information you have about the authorities in your area: tekla@futureoflife.org.

Three types of authorities in Member States under the AI Act

Member States are required to designate or establish three kinds of authorities as part of the implementation of the EU AI Act.

Market Surveillance Authority

First, a ‘market surveillance authority’ shall carry out activities and take measures known from Regulation (EU) 2019/1020 on market surveillance and compliance of products (Art 3(26)). Thus, this authority builds upon the pre-existing and well-established concept of market surveillance authorities within EU law and will be tasked with ensuring that only products compliant with EU law are made available on the Union market.

Notifying Authority

Second, a ‘notifying authority’ will be the national authority responsible for establishing and performing the procedure for assessment, designation and notification of conformity assessment bodies and for their monitoring (Art 3(19) and Art 28(1)). ‘Conformity assessment bodies’ are bodies that perform third-party conformity assessment activities, including testing, certification and inspection (Art 3(21)).

The notifying authority and the market surveillance authority are collectively referred to as the national competent authorities (Art 3(48)). They must function independently, impartially and without bias, have adequate technical, financial and human resources, as well as the infrastructure to effectively execute their tasks under the AI Act (Art 70(1)&(3)). The Commission will facilitate exchange of experience between national competent authorities (Art 70(7)). 

National Public Authority

Third, Member States must identify national public authorities that enforce the respect for fundamental rights obligation in Member States in relation to High-risk AI systems referred to in Annex III. Such authorities should have powers to request and access any documentation created or maintained under the AI Act, when such documentation is necessary to effectively fulfill their mandate within the limits of their jurisdiction (Art 77 (2)).

Wide discretions for Member States

The AI Act gives Member States discretion with regards to the structure and design of these three types of authorities. Accordingly, Member States have proposed or designated authorities that take a range of forms. For example, Spain has established a Spanish Artificial Intelligence Supervisory Agency (AESIA) acting as a single market surveillance authority under the Spanish Department of Digital Transformation. In contrast, Finland has proposed a decentralized model appointing 10 already existing market surveillance authorities, including the Energy Authority, The Transport and Communications Agency, and the Medicines Agency.

Timelines and status of implementation

See our full Implementation Timeline for all key dates and deadlines for the AI Act.

Member States must establish or designate competent authorities by the 2nd of August 2025 (Art 113(b)). As per the date of publication, Malta is the only Member State which has designated both notifying and market surveillance authorities (‘clear’ in the table below). Eight Member States have pending legislative proposals or have appointed one competent authority (‘partial clarity’), whereas 18 Member States have not, to our knowledge, designated or established any competent authority.

With regards to authorities protecting fundamental rights, Member States should publish a list of such authorities by the 2nd of November 2024 (Art 77 (2)). To our knowledge, 7 Member States have published a list of such authorities as per the 20th of November 2024.

Table 1: Overall status of National Authorities

Status
(as of date of publication)
National Competent Authorities (Art 28 and Art 70)Authorities Protecting Fundamental Rights (Art 77)
Unclear1720
Partial clarity9– 
Clear17

Table 2: Member States and their designated National Authorities

Member StateNational Competent Authorities (Art 28 and Art 70)Authorities Protecting Fundamental Rights (Art 77)Notes
AustriaUnclear.
An AI Service Desk has been established under the Austrian Regulatory Authority for Broadcasting and Telecommunications (RTR) to support the implementation of the EU AI Act.
The notifying authority and market surveillance authorities have not been appointed.
UnclearAustria has established a national AI Advisory Board (‘KI Beirat’) composed of experts from research and business.
BelgiumUnclear. 
In the AI Board meeting on 10.09.2024, the Federal Public Service of Economy and the Agence du Numérique represented Belgium.
UnclearBelgium has an Ethics Advisory Council on Data and AI appointed by the Minister of Civil Service and the State Secretary for Digitization.
BulgariaUnclear.
In the AI Board meeting on 10.09.2024, the Ministry of Electronic Governance represented Bulgaria.
Unclear
CroatiaUnclear.
In the AI Board meeting on 10.09.2024, the Central State Office for the Development of Digital Society represented Croatia.
Unclear
CyprusUnclear.
In the AI Board meeting on 10.09.2024, the Ministry of Research, Innovation and Digital Policy represented Cyprus.
The Ministry of Research, Innovation and Digital Policy have identified a list of 3 public authorities, subject to changes.
Czech RepublicUnclear.
In the AI Board meeting on 10.09.2024, the Ministry of Industry and Trade represented the Czech Republic. 
Unclear
The Ministry of Industry and Trade was also in charge of adopting a revised national AI strategy in July 2024. 
DenmarkPartial clarity.
The pre-existing Danish Agency for Digital Government has been designated as coordinating market surveillance authority and single point of contact.
Unclear what body will be notifying authority.
UnclearA working group representing  a range of actors (civil society, industry, public institutions, academia, etc) was established in September 2024. It will convene 3-4 times per year.
EstoniaUnclear. 
In the AI Board meeting on 10.09.2024, the Ministry of Economic Affairs and Communications represented Estonia.
Unclar
FinlandPartial clarity. 
A draft implementing act from October, 2024, appoints 10 already existing market surveillance authorities (see English overview). The Finnish Transport and Communications Agency will act as the single point of contact.
Unclear what body will be notifying authority.
UnclearThe draft implementing act is open for public consultations until the 4th of December 2024.
FranceUnclear.
In the AI Board meeting on 10.09.2024, the Directorate General of Enterprises represented France.
Unclear
GermanyPartial clarity.

The Federal Ministry for Economic Affairs and Climate Action and the Ministry for Justice are jointly responsible for the implementation of the AI Act.

Some sources (here and here) suggest that the Federal Network Agency will be designated as market surveillance authority and that the Federal Accreditation body will be appointed as notifying authority. Competent authorities have not been appointed by law yet as of September 2024.
UnclearAn implementing act is expected Q1 of 2025. 
GreeceUnclear.
In the AI Board meeting on 10.09.2024,the Ministry of Digital Governance represented Greece.

A list of 4 authorities has been published by the ministry of Digital Governance.
HungaryPartial clarity.
According to a government resolution, a new enforcement body will be established under the Minister for National Economy with the purpose of fulfilling the tasks of the notifying authority as well as market surveillance authority.
UnclearAccording to the government resolution, an AI Council will be established with powers to issue guidelines and resolutions. Delegates will include representatives from National Media and Infocommunications Authority, the Hungarian National Bank, and the Hungarian Competition Authority.
The deadline for the Ministry of National Economy to propose the corresponding law is 30th of November.
IrelandUnclear.
In the AI Board meeting on 10.09.2024, the Ministry of Enterprise, Trade and Employment represented Ireland.
The Department of Enterprise, Trade and Employment has listed 9 national public authorities.
ItalyPartial clarity.
A legislative proposal from May 2024 designates the National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) as market surveillance authority with monitoring, inspection and enforcement powers in relation to AI systems.
The proposal designates the Agency for Digital Italy (Agenzia per l’Italia Digitale, AgID) as notifying authority.
Unclear
LatviaUnclear.
In the AI Board meeting on 10.09.2024, the Ministry of Smart Administration and Regional Development represented Latvia.
Unclear
LithuaniaPartial clarity.
A pending implementing law designates the Innovation Agency as notifying authority. 
The proposal designates the Regulatory Communications Authority as an AI market surveillance authority and single point of contact. 

A list of 4 authorities has been published by the Ministry of the Economy and Innovation.
Lithuania has launched AI sandbox pilots.
LuxembourgUnclear.
In the AI Board meeting on 10.09.2024, the State Department represented Luxembourg.
Unclear
MaltaClear.
The Malta Digital Innovation Authority (MDIA) and the Information Data Protection Commission will jointly serve as market surveillance authorities.
Further, the MDIA is designated as a notifying authority together with the National Accreditation Board.
A list of 10 authorities protecting fundamental rights has been outlined. 
The NetherlandsUnclear.
In the AI Board meeting on 10.09.2024, the Ministry of Economic Affairs and Climate Policy represented the Netherlands.
UnclearThe Dutch government has gathered interim advice on supervisory structure for the AI Act with input from 22 relevant Dutch supervisory authorities including the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure.
PolandPartial clarity.
A pending implementing act establishes a new body, the Committee on Development and Security of AI, as the market surveillance authority and single point of contact.
The act designates the Minister of Digitization as notifying authority.

The Ministry of Digitization has published a list of 3 authorities.
The law is expected to be adopted by Q4 2024.
PortugalUnclear.
In the AI Board meeting on 10.09.2024, the Administrative Modernization Agency represented Portugal.
The Ministry of Youth and Modernization released a list of 14 agencies.
RomaniaPartial clarity. 
According to the Romanian national AI strategy from July 2024, a new AI Regulatory Authority will be established with the purpose of fulfilling the tasks of the notifying authority as well as market surveillance authority.
The strategy falls under the scope of the Authority for the Digitalization of Romania which was also the authority representing Romania in the AI Board meeting on 10.09.2024.
Unclear
SlovakiaUnclear.
In the AI Board meeting on 10.09.2024, the Ministry of Investment, Regional Development and Informatics represented Slovakia.
UnclearA Standing Commission on Ethics and Regulation of AI (CERAI) was established in 2020.
AISlovakia is a neutral, independent non-profit platform facilitating cooperation on AI between academia, employers, government representatives, and representatives of international institutions.
SloveniaUnclear.
The Ministry of Digital Transformation is responsible for implementing the AI Act into Slovenian law. As per 12.09, an expert council consisting of Slovenian experts is expected to be established to advise on the implementation.
Unclear
SpainPartially clear.
The Spanish Artificial Intelligence Supervisory Agency (AESIA) was established in September 2023 as an autonomous agency of the Spanish Department of Digital Transformation.The agency will constitute market surveillance authority and single point of contact.
The notifying body has not been designated yet.
Unclear
SwedenUnclear.
The Swedish Data Protection Authority as well as the Swedish Digitalization Authority have published statements about the implementation of the AI Act. 
In the AI Board meeting on 10.09.2024, the Ministry of Finance represented Sweden.
UnclearSweden has established an AI Council with the aim of strengthening Swedish AI competitiveness. 
This post was published on 8 Nov, 2024

Related articles

The AI Office is hiring a Lead Scientific Advisor for AI

A very important job opening has opened up at the European AI Office: They are hiring for the Lead Scientific Advisor for AI. Application deadline is 13 December 2024. Based on the European Union Employment Advisor, the monthly basic salary for this role (level AD13)...

The AI Act: Responsibilities of the European Commission (AI Office)

If you are unsure who is implementing and enforcing the new digital law and what the specific time frames are, you might find this post—and our post on the responsibilities of the EU Member States—very helpful. The tables below provide a comprehensive list of all...

The AI Act: Responsibilities of the EU Member States

If you are unsure who is implementing and enforcing the EU AI Act and what the specific time frames are, you might find this post—and our post on the responsibilities of the European Commission (AI Office)—very helpful. The tables below provide you with a...

An introduction to Codes of Practice for the AI Act

Updated: 30 October 2024. This blog post will be updated as new information becomes available. This summary, detailing the Code of Practice for General Purpose AI model providers, was put together by Jimmy Farrell, EU AI policy lead at Pour Demain, and Pour Demain...

Why work at the EU AI Office?

It’s probably not for everyone, but there are a lot of great reasons to consider, including the potential to have an impact on AI governance worldwide, leveraging the first-mover advantage, and more.