Member state implementation: what is actually confirmed
This page used to present a country-by-country status table. It no longer does, because during our last review we found public sources directly contradicting each other on two of the largest member states. A confident table would have been the wrong output.
What we found
Two credible sources, both dated 2026, describe France differently. One lists the CNIL as designated with an AI oversight division. A readiness assessment describes France as the largest economy without designated AI Act authorities, having not notified the Commission, with designation provisions stalled or withdrawn.
The same divergence appears for Germany: designated, versus BNetzA remaining a proposed authority in a draft statute until the KI-MIG is enacted.
We could not resolve either. So this page reports the disagreement rather than resolving it by choosing the more convenient source. Why we work this way →
What is not in dispute
- Article 70 required each member state to designate at least one notifying authority and at least one market surveillance authority, with one acting as single point of contact. The obligation applied from 2 August 2025.
- A majority of member states had designated a primary authority by 2026; a number had not completed formal designation.
- Member states have overwhelmingly reused existing authorities rather than creating new ones, and have designated fewer notifying authorities than market surveillance authorities — a centralised pre-market architecture and a fragmented post-market one.
- Data protection authorities were treated inconsistently: some hold AI Act competence, some do not, and Germany deliberately routed supervision away from its DPA.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Three models, and what each means for you
| Model | Example | What it means practically |
|---|---|---|
| Distributed | Ireland: a reported fifteen competent authorities plus nine Article 77 fundamental rights authorities, coordinated centrally | Your counterparty is a sector authority. The question is never “who regulates AI here” but “which authority covers my activity”. |
| Lead plus sectors | Germany — BNetzA as lead under the draft KI-MIG, with BaFin for financial services and BfArM reported for medical devices | A coordinating lead exists but will not be your counterparty if you are in a regulated sector. |
| Dedicated agency | Spain: AESIA, working alongside the AEPD and financial regulators | A single identifiable AI authority, which is the rarest outcome. |
France sits outside all three at the time of writing, with sector regulators, CNIL, HAS, ARCOM, DGCCRF, acting in practice while formal designation is contested.
How to get a definitive answer
- The Commission’s published list of authorities notified under Article 70. This is the authoritative record and nothing on this page displaces it.
- The authority’s own website, which will usually state whether it holds AI Act competence.
- Your sector regulator, which in several member states retains competence for high-risk AI in its field regardless of who leads.
Why this matters less than it looks
The AI Act is a regulation. It applies directly, in full, without national transposition. Member states designate authorities and set national penalty procedures. They do not create the obligations, and an incomplete designation does not suspend them.
So none of the following is waiting on anyone: Article 50 disclosure, Article 4 literacy, Article 49 registration, classification and the Article 6(4) documented assessment, or your AI inventory.
Where designation status does change your behaviour
Expert analysis. Two places. First, if you need to notify someone, an Article 73 serious incident, or Article 27 FRIA results, you need to know who. Establish that before you need it, not during a two-day reporting window. Second, if you are choosing where to establish an EU entity, supervisory capacity and model are legitimate inputs, and an advanced member state is also where early supervisory activity is most likely to begin.
Status labels on this page
Verified fact: That Art. 70 required designation from 2 August 2025; that a majority but not all member states had designated by 2026; that member states reused existing authorities and designated fewer notifying than market surveillance authorities; and that the Regulation applies without transposition.
Expert analysis: The three-model framing and the assessment of where designation status changes behaviour.
Unsettled: The current designation status of several member states, including France and Germany, where credible sources directly conflict. Verify against the Commission's published list.
Find out who you would notify
The one piece of national detail worth establishing now is your notification counterparty for a serious incident. Article 73's shortest clock is two days, which is not enough time to work out who to call.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
Have all EU member states designated their AI Act authorities?
No, and public sources disagree on several. Article 70 required member states to designate at least one notifying authority and at least one market surveillance authority as a single point of contact. The obligation applied from 2 August 2025. Reporting through 2026 indicates that a majority had designated a primary authority but that a number had not completed formal designation, and assessments differ on whether some of the largest economies have completed it. The Commission's published list of notified authorities is the authoritative record.
Which member states are most advanced on EU AI Act implementation?
Reporting consistently places Ireland and Spain among the more advanced. Ireland uses a distributed model with a reported fifteen designated competent authorities, nine fundamental rights authorities under Article 77 and a National AI Office as coordinating body. Spain created a dedicated agency, AESIA, working alongside its data protection authority and financial regulators. Germany's framework runs through the draft KI-MIG designating the Bundesnetzagentur, with sector authorities retaining competence.
Do obligations apply if a member state has not designated authorities?
Yes. The EU AI Act is a regulation and applies directly in all member states without national transposition. Member states designate authorities and set national penalty procedures; they do not create the obligations. Article 50 transparency, Article 49 registration and Article 4 AI literacy bind providers and deployers regardless of national designation status.