AI Act National Competent Authorities: Market Surveillance Authorities, Notifying Authorities and Single Points of Contact in All 27 Member States

AI Act national competent authorities are the notifying authorities and market surveillance authorities that each Member State designates under Article 70, one of which acts as single point of contact. Every Member State had to designate them by 2 August 2025, and their enforcement powers under the act have applied since 2 August 2026.

The EU AI Act is Regulation (EU) 2024/1689, in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026, which changed four rules on national authorities. This page maps the authorities of the 27 Member States and the EEA as of 24 October 2026, with the gazette reference behind each national status.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text and national gazettes; how we check every statement: methodology.

What Are National Competent Authorities under the AI Act?

A national competent authority is a notifying authority or a market surveillance authority (Article 3(48)); for Union institutions the European Data Protection Supervisor takes that place. In substance, that is any national authority that assesses and monitors conformity assessment bodies or that carries out market surveillance of AI systems under Regulation (EU) 2019/1020. The bodies at EU level, such as the AI Office and the AI Board, complete AI Act governance and enforcement across the Union.

Three Roles in Article 70: Notifying Authority, Market Surveillance Authority and Single Point of Contact

Article 70(1) requires every Member State to establish or designate at least one notifying authority and at least one market surveillance authority, and Article 70(2) makes one market surveillance authority the single point of contact.

Article 70 of Regulation (EU) 2024/1689, paragraph 8 as replaced by Regulation (EU) 2026/1744.

The designation is a minimum: one or more authorities can perform the tasks, in accordance with the organisational needs of the Member State. All national competent authorities exercise their powers independently and impartially (Article 70(1)).

Article 70(3) requires staff with competences including AI technologies, data protection, cybersecurity, fundamental rights, safety and standards. Since 27 July 2026, national competent authorities may provide guidance and advice under Article 70(8), in particular to SMEs, including start-ups, and small mid-caps. Authorities under the NIS2 Directive are not AI Act authorities unless a national AI law names them.

What National Authorities Do Not Supervise: EU-Level Competences

National authorities do not supervise general-purpose AI models, AI systems under the exclusive competence of the AI Office, or AI systems of Union institutions. The European AI Office is a Commission function (Article 3(47)), established by Commission Decision C(2024) 390 of 24 January 2024. The Commission supervises general-purpose AI models at EU level under Chapter V and can fine their providers under Article 101 from 2 August 2026. The European Data Protection Supervisor is the competent and market surveillance authority for Union institutions, bodies, offices and agencies (Articles 70(9) and 74(9)), while the European Artificial Intelligence Board brings one representative per Member State together, chaired by a Member State representative, with the AI Office attending without a vote (Article 65).

The 27 Member States and the EEA: National Frameworks as of 24 October 2026

Ten Member States have a status verified in a gazette, parliament or government record as of 24 October 2026, and eight of them have an adopted national framework: Cyprus, Denmark, Finland, Germany, Hungary, Italy, Malta and Poland. The Commission column shows only what the Commission page lists, which is not the legal status in a Member State.

National frameworks from national gazettes and parliament records, checked 24 October 2026; Commission column: digital-strategy.ec.europa.eu, last update 7 September 2026; () = national designation decision still pending final adoption.*

The AI Act applies directly in every Member State, whatever the national status, because it is a regulation under Article 288 TFEU.

How to Read the Commission's List of Single Points of Contact

The Commission page "Market surveillance authorities under the AI Act", last updated on 7 September 2026, lists each Member State's single point of contact and marks with an asterisk every designation still pending final adoption. It records what Member States reported, not what their gazettes say.

The Commission lists 9 Member States without an asterisk, 12 with an asterisk and 6 without any entry. The list is out of date for 2 states: Germany still carries an asterisk although KI-MIG is published, and Hungary has no entry although Decree 344/2025 designates its authorities. The Commission states that it may start an infringement procedure where a Member State fails to designate its authorities.

Four National Supervision Models in the Member States with an Adopted Framework

Member States with an adopted framework follow four models: one central authority, a coordinator with sector authorities, statutory sector allocation, or a cyber agency next to a digital agency.

The models describe allocation, not quality of supervision. The grouping is our own reading of the national texts, not a legal category of the AI Act.

Which Authority Supervises Which AI System: The Article 74 Allocation

The market surveillance authority for an AI system depends on the product, the sector and the deployer of the system: Article 74 assigns product, financial, data-protection and EU-institution cases to specific authorities. Under Article 74(1), Regulation (EU) 2019/1020 applies to AI systems, and the general authority takes every unassigned case. The sector rules reach high-risk AI systems in particular, because Articles 74(3), 74(6) and 74(8) attach to products, financial services and sensitive uses.

Chapter IX on market surveillance applies since 2 August 2026, so the allocation already decides which authority acts on an AI system.

Notifying Authorities: Designating and Monitoring Conformity Assessment Bodies (Article 28)

A notifying authority sets up and carries out the procedures for assessing, designating and notifying conformity assessment bodies and monitors them (Article 3(19), Article 28). Under Article 28(2), the national accreditation body under Regulation (EC) No 765/2008 may carry out the assessment and monitoring. Since 27 July 2026, Article 28(8) gives bodies also designated under Annex I Section A legislation a single application and a unified assessment procedure.

Chapter III Section 4 applies since 2 August 2025 (Article 113, third paragraph, point (b)). Notified bodies matter for AI Act conformity assessment because they carry out the third-party procedures, and notified bodies of the Annex I Section A sector laws apply for designation under the AI Act by 28 January 2028 (Article 43(3)). No notified body is listed on NANDO under the AI Act as of 24 October 2026.

Member State Duties and Deadlines under the AI Act

Member States carry six dated duties under the AI Act, from the fundamental-rights authority lists of 2 November 2024 to the national sandbox of 2 August 2027. One fell due in 2024, three on 2 August 2025, and two lie ahead:

The designation, contact and penalty deadlines have passed for every Member State, whether or not its national law is in force.

The next national deadline is 2 August 2027, when the second resource report falls due and at least one sandbox per Member State must operate. The EU AI Act timeline sets out every other application date, including the general date of 2 August 2026.

What Regulation (EU) 2026/1744 Changed for National Authorities

Regulation (EU) 2026/1744, in force since 27 July 2026, changed four rules on national and EU authorities:

• Sandbox deadline: 2 August 2027 instead of 2 August 2026 (Article 57(1)).
• Guidance for small mid-caps: advice to SMEs, start-ups and small mid-caps (Article 70(8)).
• Single application: unified assessment for bodies under Annex I Section A law (Article 28(8)).
• AI Office competence: exclusive supervision of the Article 75(1) systems (Article 75(1) as replaced).

The sandbox change gives Member States one more year to run AI regulatory sandboxes under Article 57. Article 57(3a) adds that the AI Office may establish a Union-level sandbox for Article 75(1) systems, with priority access for SMEs, start-ups and small mid-caps.

The amending act was published in the Official Journal on 24 July 2026. The Digital Omnibus on AI explains all 2026 amendments, including the new high-risk dates.

National Penalty Rules under Article 99(1) and (2)

Member States lay down the penalties for AI Act infringements and had to notify them to the Commission by 2 August 2025 (Article 99(1) and (2)). The rules cover penalties and other enforcement measures, which may also include warnings and non-monetary measures, and the penalties must be effective, proportionate and dissuasive. Article 99(8) leaves Member States to decide whether and to what extent fines apply to public authorities.

Five national texts add their own rules: Germany fines national offences up to EUR 50 000 (§ 15(3) KI-MIG), applies the administrative offences act to Article 99 (§ 16) and imposes no fines on public bodies (§ 17(2)); Italy adds EUR 1 000 000 or 0.5 % for breaches of Articles 27 and 86 (D.Lgs. 179/2026, Article 23); Malta sets up to EUR 350 000 or 1 % and EUR 12 000 per day (L.N. 226 of 2025, regulation 11); Hungary sets caps of HUF 13 300 000 000, 5 700 000 000 and 2 850 000 000 (Decree 344/2025, § 4); Finland imposes no fines on state and municipal authorities (§ 24 of Act 1377/2025).

Article 99 sets the maximum fines national rules must provide for: EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher, for Article 5 breaches, EUR 15 000 000 or 3 % for the Article 99(4) list and EUR 7 500 000 or 1 % for incorrect, incomplete or misleading information, each whichever is higher. The EU AI Act penalties set out the EU fine caps, including the lower amounts for SMEs and small mid-caps. The Commission itself fines providers of general-purpose AI models (Article 101) and, through the AI Office, AI systems under its exclusive competence (Article 75c(4)).

How Operators Deal with National Authorities: Contact, Cooperation, Incidents and Complaints

Operators meet national authorities at four points: the single point of contact, requests for documentation and access, serious-incident reports and complaints.

• Contact the single point of contact of the Member State for general questions (Article 70(2)).
• Cooperate by giving full access to the documentation and the training, validation and testing data sets of high-risk AI systems, also remotely; source code only on a reasoned request, where necessary to assess conformity with Chapter III, Section 2 and testing or auditing based on the provider's data and documentation has been exhausted or proved insufficient (Article 74(12) and (13)).
• Report serious incidents to the market surveillance authority within 15 days, 2 days or 10 days depending on the incident (Article 73).
• Complain to the relevant market surveillance authority: "any natural or legal person having grounds to consider that there has been an infringement" of the AI Act may do so (Article 85).

Where an AI system presents a risk, corrective action follows the period the market surveillance authority prescribes, in any event the shorter of 15 working days or the period in the relevant Union harmonisation legislation (Article 79(2)). The guide to rights of affected persons covers complaints, explanation and whistleblower protection. Providers of systems under AI Office competence report serious incidents to the AI Office (Article 75(1a)).

The AI Act Complaints Tool of the AI Office covers only systems under the exclusive competence of the AI Office. It is not anonymous.

How Providers and Deployers Prepare for Supervision in Several Member States

Four steps prepare a provider or deployer active in several Member States:

1. Map every Member State where a system is placed on the market, put into service or used.
2. Identify the competent authority per system, checking Articles 74(3), 74(6) and 74(8) before the default authority.
3. Assign one contact person for authority requests, serious incidents and corrective action.
4. Monitor the national frameworks and the Commission list of single points of contact, dated 7 September 2026.

A bank and a product manufacturer face different authorities. A step-by-step programme for both roles is set out in the guide to EU AI Act compliance.

The steps give an orientation, not a legal assessment.

National Competent Authorities: Related Questions

Articles 22, 74(8) and 5 answer the questions on non-EU providers, data protection authorities and the supervision of the Article 5 prohibitions.

Which Authority Supervises a Non-EU Provider?

A non-EU provider deals with the market surveillance authority of each Member State where its AI system is placed on the market or used, or with the AI Office for Article 75(1) systems.

The EU AI Act for non-EU companies explains the territorial reach of the act. Non-EU providers of high-risk systems appoint an authorised representative who cooperates with the authorities (Article 22).

Do Data Protection Authorities Supervise AI Systems?

Data protection authorities supervise AI systems under the AI Act where Member States designate them as market surveillance authorities; Article 74(8) requires Member States to designate the data protection authorities, or another authority under Articles 41 to 44 of Directive (EU) 2016/680, for Annex III point 1 in law enforcement, border management, justice and democracy and for points 6 to 8.

The guide to AI Act vs GDPR shows where the regulations overlap. Cyprus designated its Commissioner for Personal Data Protection for Annex III points 1, 6, 7 and 8, and Italy the Garante under Article 74(8).

Who Supervises the Article 5 Prohibitions in Each Member State?

National market surveillance authorities supervise the Article 5 prohibitions, and the AI Office supervises them for systems under its exclusive competence; enforcement powers apply since 2 August 2026.

The prohibited AI practices cover the ten lettered points: points (a), (b) and (c) to (h) apply since 2 February 2025, points (ba) and (bb) and paragraphs 1a and 1b from 2 December 2026. Denmark splits the points between Digitaliseringsstyrelsen and Datatilsynet.

Frequently Asked Questions about National Competent Authorities

What is a national competent authority under the AI Act?

A notifying authority or a market surveillance authority (Article 3(48)); for Union institutions, the European Data Protection Supervisor (Article 70(9)).

By when did Member States have to designate their authorities?

By 2 August 2025 (Article 70(2) with Article 113, third paragraph, point (b)).

Does the AI Act apply where a Member State has designated no authority?

Yes. The AI Act is a regulation and applies directly; national laws implement or supplement it.

Is the Commission list of single points of contact the legal status?

No. The Commission list shows what Member States reported; the legal status comes from national gazettes.

Which national authority receives serious-incident reports?

The market surveillance authority, within 15 days, 2 days or 10 days depending on the incident (Article 73); the AI Office for systems under its exclusive competence (Article 75(1a)).