# Who Oversees AI in the EU? The Designation of National Competent Authorities under the EU AI Act

Shadée Pinto

<figure><img src="image_1.png" /></figure>

## To cite this version:

Shadée Pinto. Who Oversees AI in the EU? The Designation of National Competent Authorities under the EU AI Act. 2025. hal-05336456

HAL Id: hal-05336456

https://hal.science/hal-05336456v1

Submitted on 29 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Who Oversees AI in the EU?
## The Designation of National Competent Authorities under the EU AI Act.

By Shadée Pinto

<figure><img src="image_3.png" /></figure>
# Who Oversees AI in the EU?

## The Designation of National Competent Authorities under the EU AI Act.

This study seeks to provide an overview of current progress in the designation of national competent authorities, and to analyse how national governance architectures are being developed. The study shows that one week prior to the deadline, the majority of member states were behind schedule. Progress seems to have been fragmented, with many states not having made an announcement about their designation choices, or not legally enshrining their designation decisions. A few draft governance frameworks, some of them unofficial, were announced. These present a centralised architecture for notifying authorities, but a fragmented one for market surveillance, with most authorities already identified.

On 2 August 2025, European Union (EU) Member States (MSs) were expected to have designated or established their National Competent Authorities (NCAs) responsible for implementing and enforcing the Regulation (EU) 2024/1689 on Artificial Intelligence (AI Act) at national level, to comply with Article 70 of the AI Act.<fnref n="1" /> However, one week prior the deadline the formal and definitive designation of these authorities had not yet been ratified by all MSs.

Since the AI Act came into force, a number of projects have been carried out to identify the designated NCAs.<fnref n="2" /> <fnref n="3" /> These projects have gradually brought to light disparities between MSs in terms of the maturity of the designation process, revealing delays or, at the very least, limited public communication regarding ongoing negotiations. This article contributes to previously-published studies, by expanding the discussion on how MSs form their national governance architectures.<fnref n="4" />

One week prior to the deadline, most MSs were behind schedule: **21 had not yet submitted a national implementation law and 13 had not announced the designation of their NCAs.** The 14 governance architectures available at the time revealed a **centralised approach to the designation of notifying authorities**, but a more **fragmented structure for market surveillance**, and a **reliance on pre-existing institutions** rather than newly established authorities. **Data protection authorities** were also **assigned responsibilities, primarily as market surveillance authorities, although some MSs chose to exclude them from their governance architectures.**

This study begins by presenting the methodology used for compiling and analysing the various national implementation laws as well as the designations of NCAs, while also acknowledging the limitations inherent in this

documentary research (1). It then introduces the dual-level governance architecture established by the AI Act and explains the division of competences and responsibilities between the different bodies at national and EU levels (2). The study then examines how MSs' national governance architectures are structured, in order to identify trends, convergences and divergences. This final section addresses the delays observed in the designation of NCAs and the emerging governance architectures, which tend to be structured around multiple but pre-identified authorities (3).

### 1. METHODOLOGY.

This section outlines the methodology employed for the collection and compilation of national implementation laws and NCA designations (1.1) and their subsequent analysis (1.2) while highlighting the limitations of this documentary research (1.3).

#### 1.1 Data collection.

The analysis is based on a preliminary survey of announced, proposed and designated NCAs, as well as national implementing laws, either currently being drafted or already adopted. Given that the analysis is limited to an overview of the authorities referred to in Article 70 of the AI Act, the scope of this study is restricted to notifying authorities, market surveillance authorities, and single points of contact.

The data collection process involved documentary research of publicly available information online and a literature review based on the aforementioned pre-existing works. The data were retrieved from official websites (parliaments, governments or administrative entities) and specialised websites (press articles and legal blogs). The data collection

<footnote n="1">¹ The term “National Competent Authorities” (NCAs) refers to both Notifying Authorities (NAs) and Market Surveillance Authorities (MSAs), as indicated in Article 3(48) of the AI Act. Since MSs are required, when they designate multiple MSAs, to appoint one of them to act as the Single Point of Contact (SPoC), the term NCA, in the context of this article, also includes SPoCs. For more information about each authority, see Appendix 1.</footnote>

<footnote n="2">² Emborg, T. (2024, updated in May 2025). Overview of all AI Act National Implementation Plans. EU AI Act. Available at: https://artificialintelligenceact.eu/national-implementation-plans/.</footnote>

<footnote n="3">³ Pók, L. (2024). Responsible authorities for the enforcement of the AI Act on national level. GDPR Blog. Available at: https://gdpr.blog.hu/2024/10/02/responsibleAuthorities_for_the_enforce of_the_ai_act_on_national_level.</footnote>

<footnote n="4">⁴ Parisini, E. and Dervishaj, E. (2025) *Emerging models of national competent authorities under the EU AI Act*. Conference on Digital Government Research. Vol. 26. Available at: https://proceedings.open.tudelft.nl/DGO2025/article/view/1007.</footnote>
period runs from February to July 2025. The data
collected are presented in a table, current as of 23
July 2025 and available at [AI-Regulation.com](https://AI-Regulation.com), with
selected parts reproduced in the appendices.

## 1.2 Data analysis.

Based on these data, this study examines the
formation of national AI governance architectures,
focusing on the following parameters: the number of
designated NCAs<fnref n="5" />, data protection authorities
designated as NCAs, and newly created authorities.

The section 3.2 of this study analyses the governance architectures of 14 MS: Bulgaria, Cyprus, the Czech Republic, Denmark, Finland, Germany, Ireland, Italy, Latvia, Lithuania, Luxembourg, Poland, Slovenia and Spain. These states were selected because their AI governance architectures were publicly accessible online as of 23 July and issued by official sources (government announcements, draft laws or reports). However, it is worth noting that although Bulgarian and German architectures have been included in the data set, they were not officially endorsed by their respective governments. In fact, the Bulgarian architecture was put forward by a minor party in the Bulgarian Parliament for public consultation, but it had not yet been submitted to Parliament as of that date. With respect to Germany, the document retrieved is not available on an official website and was drafted before the 2025 German federal election. Even though the projects outlined may not reflect the government's final intentions, they shed light on a potential national approach.

Member states for which no public information was
available as of 23 July have been deliberately left out
from the analysis to simplify understanding. The
states concerned are Austria, Belgium, Croatia,
Estonia, France, Greece, Hungary<fnref n="6" />, Malta<fnref n="7" />, the
Netherlands, Portugal, Romania<fnref n="8" />, Slovakia and
Sweden.

## 1.3 Limitations.

In order to contextualise the results presented, it is
worth highlighting the methodological limitations
that may have affected the accuracy of the analysis.
The first limitation concerns the accessibility of the
documentation. The data obtained came from public
sources, most of which were freely available. This

limits the completeness of the information,
particularly when no official designation had been
published, or when discussions were held in
confidential interministerial meetings.

The second limitation is the linguistic diversity of the media analysed. As many of the sites and documents were only available in the relevant national dialect, it was necessary to use automatic translation tools (Deepl Pro, Google Translation), which could affect the quality and accuracy of the translation.

Finally, the third limitation is our incomplete
understanding of the specific national legislative
processes of the 27 MSs, which can affect contextual
understanding of certain national measures.

## 2. A DUAL-LEVEL AI GOVERNANCE ARCHITECTURE.

In order to ensure the effective implementation of the
[AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:5201C000000&from=EN), Chapter VII establishes a two-level governance architecture: one at European level organised around the European Commission (2.1) and the other at national level, formed by MSs (2.2).

### 2.1 The European architecture formed by and around the European Commission.

Section 1 of the Chapter VII (Art. 64 to 69) of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:5201C000000&from=EN) organises the AI governance architecture at EU level and settles four bodies: the AI Office, the AI Board, the Advisory Forum and the Scientific Panel of Independent Experts.<fnref n="9" />

These are new bodies that complement the existing
entities concerned with digital regulation, some of
which are expected to be consulted in accordance
with the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:5201C000000&from=EN).

<figure><img src="image_4.png" /><figcaption>Chart 1 - AI governance architecture at EU level.</figcaption></figure>

<footnote n="5">⁵ The analysis excludes extensions of powers for authorities already designated under EU harmonisation legislation (Annex I of the AI Act) if those authorities are not explicitly named in the national implementation law or draft.</footnote>

<footnote n="6">⁶ The Hungarian government adopted Resolution no. 1301/2024, stating that an “Organisation” (Szervezet in Hungarian) should be appointed as the NA, MSA and SPoC, but it did not formally designate or establish any authority.</footnote>

<footnote n="7">⁷ The Malta Digital Innovation Authority (MDIA) and the Information and Data Protection Commissioner (IDPC) published information about their</footnote>

<footnote>designations as NCAs on their respective websites. However, no formal
designation has been made public yet.</footnote>

<footnote n="8">⁸ In Romania, a draft bill has been presented to Parliament. However, without substantial amendments, it may not be adopted, as the majority of the opinions gathered as part of the legislative procedure has been negative. One of the reasons given has been the failure to take account of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:5201C000000&from=EN), and the lack of provision to adapt national law to the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:5201C000000&from=EN).</footnote>

<footnote n="9">⁹ A comprehensive table of each authority is provided in Appendix 1.</footnote>
## The AI Office<fnref n="10" />

The AI Office is the European Commission's (Commission) function responsible for overseeing the implementation of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001) across the EU and for supervising general-purpose AI (GPAI) models and systems.<fnref n="11" />

With regard to GPAI models and systems, the Office is tasked with developing tools and methodologies to assess such models and systems, monitoring the application of relevant rules and the emergence of unforeseen risks, and investigating potential infringements. As for the overall implementation of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001), the Office assists the Commission in preparing implementing and delegated acts, as well as guidance documents and supporting tools.

It also supports the establishment and operation of AI regulatory sandboxes and coordinates the setup of the governance architecture at both EU and national levels.

The Office is part of the Directorate-General for Communications Networks, Content and Technology (DG CONNECT) of the Commission, and it draws on DG CONNECT's human resources.

Beyond its internal coordination role, the Office also has a supra-regional and international dimension, as it ensures cooperation not only with stakeholders, other Commission services, EU bodies, offices and agencies, and MSs authorities and bodies, but also with third countries and international organisations on AI-related matters.

## The AI Board<fnref n="12" />

The AI Board assists and advises the Commission and the MSs in ensuring the coherent implementation of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001) throughout the EU. It provides a forum for discussion among MSs to foster inter-state coordination and the exchange of best practices.

The Board is composed primarily of representatives from MSs, each of which is required to appoint one representative to serve a renewable three-year term. States representatives must have relevant competences and powers in their MS to actively contribute to the Board's tasks, be designated as a single contact point for the Board, and be

empowered to facilitate coordination between NCAs in their MS. State representatives are not merely representatives of their MSs, they shall be sufficiently empowered to carry out their responsibilities and enhance coordination effectively at the national level. In addition to states representatives, the AI Office and the European Data Protection Supervisor participate as observers, while other national or European authorities and experts may be invited to take part depending on the topics discussed.

The Board's main tasks include supporting coordination among NCAs, promoting the exchange of expertise and best practices, contributing to the harmonisation of administrative practices, providing advice on the implementation of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001) – particularly regarding the enforcement of rules on GPAI models – issuing opinions on qualified alerts related to GPAI models, and assists MSs in the establishment and development of AI regulatory sandboxes.<fnref n="13" />

Two permanent sub-groups are established within the Board: one to serve as a platform for cooperation and exchange among market surveillance, and notifying authorities, and another for notified bodies. Additional sub-groups may be created, either temporarily or permanently, to address specific issues or tasks.

## The Advisory Forum<fnref n="14" />

The Advisory Forum is a consultative body that provides the Commission and the AI Board with technical expertise from a wide range of stakeholders on AI governance.

It issues opinions, recommendations, and written contributions upon request from the Commission or the AI Board.

The Forum is composed of representatives from industry, small and medium-sized enterprises (SMEs) and start-ups, as well as from civil and academia, all appointed by the Commission for a renewable two-year term. Its composition ensures a balanced representation of commercial and non-commercial interests and includes European bodies such as the Fundamental Rights Agency and the European Committee for Standardisation (CEN) among others.

<footnote n="10">¹⁰ Articles 3(47) and 64 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001) and Commission Decision C/2024/1459 of 24 January 2024 establishing the European Artificial Intelligence Office.</footnote>

<footnote n="11">¹¹ General-purpose AI models are defined in Article 3 the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001) as “an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications.”</footnote>

<footnote>The term should be distinguished from general-purpose AI systems which are “AI system which is based on a general-purpose AI model and which</footnote>

<footnote>has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems”.</footnote>

<footnote n="12">¹² Articles 65 and 66 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001).</footnote>

<footnote n="13">¹³ Qualified alerts are issued by the Scientific Panel of Independent Experts to the AI Office when the Panel's experts suspect that a GPAI model poses a concrete identifiable risk at EU level or that it can be classified as a GPAI model with systemic risk pursuant to Article 51 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001), in order to launch follow-up measures.</footnote>

<footnote n="14">¹⁴ Article 67 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021C0001).</footnote>
The Forum allows the Commission to engage all stakeholders in AI governance and gather technical expertise as well as operational feedback and advice on the implementation and enforcement of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN).

### The Scientific Panel of Independent Experts<fnref n="15" />

Finally, the Scientific Panel of Independent Experts is a technical body established to support enforcement activities under the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN).
It assists the AI Office by handling qualified alerts signalling potential systemic risks arising from GPAI models and systems, and by providing tools, methodologies, and advice to assess and classify such models and systems, including those presenting systemic risks. It also supports the Commission, the AI Office, and national MSAs in their enforcement activities, upon request. As such, it guarantees equal access to expertise for all MSs.

The Panel is composed of up to 60 experts selected by the Commission for a renewable two-year term on the basis of their scientific or technical expertise in the field of AI, their independence from providers of AI systems or GPAI models, and their impartiality and objectivity. At least one, and no more than three, nationals from each MS and from each member of the European Free Trade Association participating in the European Economic Area – namely Iceland, Norway, and Liechtenstein – may be appointed to the Panel. Nationals of third countries may also be appointed as experts but should not represent more than one-fifths of the experts on the Scientific Panel.

The main distinction between the Scientific Panel and the Advisory Forum lies in the Panel's independence, impartiality, and objectivity, as well as in its active contribution to the enforcement of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN) through its direct support to the AI Office and the national MSAs in fulfilling their enforcement tasks.

By creating these bodies, the EU has built a pool of experts that both supports the Commission in its supervisory and regulatory functions and ensures continuous feedback from stakeholders. This structure helps the EU maintain up-to-date expertise, identify implementation challenges, and strengthen the overall effectiveness of the European regulation of AI. However, this governance system brings together a wide range of actors operating across

different forums, which may complicate coordination efforts.

Beyond the EU-level governance layer, the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN) requires the creation of a governance architecture at a national level, to be established by each MS. They have a “significant degree of autonomy”<fnref n="16" /> when it comes to forming their national governance architectures, particularly when it comes to designating the NCAs.<fnref n="17" />

## 2.2 National architecture drawn up by member states.

The [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN) gives MSs a key role in the governance of AI, making them responsible for defining the national institutional architecture necessary for its implementation.<fnref n="18" />

The legislation provides for the designation of several authorities that constitute the national governance architecture: notifying authorities, notified bodies, market surveillance authorities, single points of contact, authorities protecting fundamental rights, and state representatives.
According to recital 153 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN), the way states designate their NCAs is left at their discretion based on their "organisational characteristics and needs", although they must comply with certain requirements.

<figure><img src="image_5.png" /><figcaption>Chart 2 - AI governance architecture at national level.</figcaption></figure>

### Notifying authorities (NAs)<fnref n="19" />

Notifying authorities are independent and impartial public entities responsible for organising and overseeing the conformity assessment ecosystem.

To that end, they set up and carry out the procedures for the assessment, designation, notification, and monitoring of conformity assessment bodies. They

<footnote n="15">¹⁵ Articles 68 and 69 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN), and Commission Implementing Regulation (EU) 2025/454 of 7 March 2025 as regards the establishment of a scientific panel of independent experts in the field of artificial intelligence.</footnote>

<footnote n="16">¹⁶ Mazur, J. Novelli, C. and Choińska, Z. (2025). *Should Data Protection Authorities Enforce the AI Act? Lessons from EU-wide Enforcement Data*. SSRN. Available at: https://ssrn.com/abstract=5290513.</footnote>

<footnote n="17">¹⁷ Articles 70(1) and recital 153 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN).</footnote>

<footnote n="18">¹⁸ Article 70 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN).</footnote>

<footnote n="19">¹⁹ Articles 28 and 70 of the [AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52020C0001&from=EN).</footnote>
may be supported by national accreditation bodies, which can be entrusted with assessment and monitoring tasks. NAs are also authorised to provide guidance and advice – to start-ups and SMEs – on the implementation of the [AI Act](#).

MSs were required to designate or establish at least one NA – without limitation on their number – by 2 August 2025. These NAs must be organised in a way that guarantees objectivity and must be provided with sufficient technical, financial and human resources and infrastructure. They are required to comply with the confidentiality obligations set out in the [AI Act](#) and to ensure an appropriate level of cybersecurity. Their identity, contact details, and responsibilities must be communicated by MSs to the Commission.

### Notified bodies<sup>20</sup>

Notified bodies are independent conformity assessment bodies — formally notified by a NA — responsible for carrying out conformity assessment activities on high-risk AI systems to certify that they comply with the requirements of the [AI Act](#) before being placed on the market or put into service.

To be notified, a conformity assessment body must submit an application for notification to the NA of the MS in which it is established and comply with a set of requirements, including independence, impartiality, objectivity, confidentiality, adequate insurance coverage, sufficient resources, integrity in performing evaluations, and the necessary technical competence to ensure the reliability and performance of their results and activities. They may subcontract specific tasks, provided that the same requirements apply to the subcontractors and that the NA is duly informed.

Conformity assessment bodies established in third countries with which the EU has concluded an agreement may also be authorised to carry out the activities of notified bodies under the [AI Act](#), provided that they meet the same requirements or equivalent level of compliance as those imposed on notified bodies established within the EU.

### Market surveillance authorities (MSAs)<sup>21</sup>

Market surveillance authorities are impartial public entities responsible for overseeing AI systems that are placed on the market, put into service, or made available within their territory. They ensure that high-risk AI systems remain in compliance with the requirements of the [AI Act](#) and applicable EU law

throughout their lifecycle after being placed on the market. They enforce the [AI Act](#) by investigating cases of non-compliance and handling complaints and incident reports.

MSs were required to designate or establish at least one MSA – without limitation on their number – by 2 August 2025. These MSAs must also be organised in a way that guarantees objectivity and must be provided by MSs with sufficient technical, financial and human resources and infrastructure. They are required to comply with the confidentiality obligations set out in the [AI Act](#) and to ensure an appropriate level of cybersecurity. Their identity, contact details, and responsibilities must be communicated by MSs to the Commission.

### Single points of contact (SPoCs)<sup>22</sup>

A single point of contact is a MSA designated to act as the main contact point in relation to the public and its counterparts at both national and EU levels. MSs are required to designate one MSA to act as SPoC, particularly when several MSAs are designated.

The SPoCs are briefly mentioned in the [AI Act](#), but their missions are not explicitly defined.<sup>23</sup> Their designation aims to improve efficiency and coordination among national authorities and with their counterparts in other MSs.

### Authorities protecting fundamental rights<sup>24</sup>

Authorities protecting fundamental rights are national public authorities or bodies – such as data protection authorities or equality bodies – responsible for supervising and enforcing EU laws protecting fundamental rights in relation to the use of high-risk AI systems listed in Annex III of the [AI Act](#).

To ensure that such systems do not infringe fundamental rights, these authorities may request access to documentation produced under the [AI Act](#) and request the MSAs to conduct tests to detect potential infringements.

The [AI Act](#) does not require the establishment of new authorities protecting fundamental rights. Rather, it provides that the authorities identified by MSs to supervise and enforce EU laws protecting fundamental rights in the context of high-risk AI systems will receive additional competences to fulfil these tasks. MSs were required to identify these authorities, make the corresponding list publicly

<footnote n="20"><sup>20</sup> Articles 29 to 39 of the [AI Act](#).</footnote>

<footnote n="21"><sup>21</sup> Articles 70, 72 to 76 and 85 of the [AI Act](#), and Regulation (EU) 2019/1020 on market surveillance and compliance of products.</footnote>

<footnote n="22"><sup>22</sup> Article 70 and recital 153 of the [AI Act](#), and European Commission. (2025). Market surveillance Authorities under the [AI Act](#) Available at:</footnote>

<footnote><https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act#1720699867912-1></footnote>

<footnote n="23"><sup>23</sup> The [AI Act](#) only mentions single points of contact four times, twice in recital 153 and twice in Article 70 of the [AI Act](#).</footnote>

<footnote n="24"><sup>24</sup> Article 77 of the [AI Act](#).</footnote>
available, and notify both the Commission and the
other MSs by 2 November 2024.

State Representatives<fnref n="25" />

State representatives are officials from public
entities appointed by their MS for a renewable three-
year term to sit on the AI Board. Each MS must
designate a single representative, who acts as the
main point of contact with the Board and with other
MSs.

These representatives are responsible for facilitating
coordination between the NCAs within their territory
and for contributing to the tasks of the AI Board.

Since this article focuses on the obligation of MSs to
designate their NAs, MSAs, and SPoCs pursuant to
Article 70 of the AI Act, the other entities have been
deliberately excluded from the analysis. For the sake
of clarity and consistency, this article uses the term
National Competent Authority (NCA) to refer to
MSAs, SPoCs, and NAs.<fnref n="26" />

To ensure the successful implementation and
enforcement of the AI Act, it is essential that MSs
establish clear, identifiable and “well-coordinated”<fnref n="27" />
national governance architectures. In order to
understand how emerging national governance
architectures are being formed, an overview of the
state of designations has been formulated and then
analysed to understand the trends.<fnref n="28" />

3. NATIONAL ARCHITECTURES UNDER
CONSTRUCTION AROUND PRE-
IDENTIFIED AND MULTIPLE
AUTHORITIES.

The study of the AI governance architectures at
national level reveals two dynamics: on the one
hand, MSs had delayed designating their NCAs (3.1)
and, on the other, the emergence of a still embryonic
governance architectures, based on pre-identified,
multiple authorities (3.2).

3.1 Delay in the announcement and legal
enshrinement of the designation of NCAs.

This section addresses MSs' compliance with the
deadline set by the AI Act for designating their

NCAs. To this end, it considers MSs where the
designation of NCAs had not been made public and
remained unknown (3.1.1). It then reviews the
adoption of national implementation laws that
formally established such designations by assessing
the current status of their legal enshrinement (3.1.2).

3.1.1 Delay in the announcement of NCAs.

Although MSs were called upon to designate their
NCAs by 2 August 2025, as per Article 70 of the AI
Act, many had not yet officially designated or
created them, and some had not even announced
them. In fact, one week prior to the deadline, 13
states had not publicly announced their NCAs:
Austria, Belgium, Croatia, Estonia, France, Greece,
Hungary<fnref n="29" />, Malta<fnref n="30" />, the Netherlands, Portugal,
Romania<fnref n="31" />, Slovakia, and Sweden.

These delays can generally be explained by **three factors**. Firstly, they resulted from **difficulties in arbitrating the distribution of powers between administrative bodies**. For instance, in France the designation process dragged on for months, reportedly due to difficulties in arbitrating the allocation of competences between various authorities.<fnref n="32" />

Secondly, they resulted from **delays in the legislative process** that have prevented states from officially creating their authorities or assigning new powers to designate authorities within the allotted timeframe. For example, Luxembourg had already submitted its implementation law to its parliament, months prior to the deadline. <fnref n="33" /> However, official and final endorsement was delayed, as the legislature was still reviewing the text as of 2 August 2025. Thirdly, they resulted from **the political situation and dynamics in each MS**. In Germany, for instance, early parliamentary elections were held in March 2025, leading to a period of political instability and a slowdown in the handling of certain matters, as governments often restrict themselves to day-to-day affairs during such times.

In practice, such NCA designations, along with the
creation of new administrative entities and the
allocation of new competences, are generally
established by means of laws that adapt national law
to EU law, or by other types of legal act depending
on the legal characteristics of each state.<fnref n="34" /> For the

<footnote n="25">²⁵ Articles 65 and 66 of the AI Act.</footnote>

<footnote n="26">²⁶ See footnote no.1</footnote>

<footnote n="27">²⁷ Mazur, J. Novelli, C. and Choińska, Z. (2025). *Should Data Protection Authorities Enforce the AI Act? Lessons from EU-wide Enforcement Data*. SSRN. Available at: https://ssrn.com/abstract=5290513.</footnote>

<footnote n="28">²⁸ For further details, see Appendices 4 to 7 and the interactive Excel table available at AI-Regulation.com.</footnote>

<footnote n="29">²⁹ See footnote no.6.</footnote>

<footnote n="30">³⁰ See footnote no.7.</footnote>

<footnote n="31">³¹ As mentioned in footnote no.8, Romania has drafted and submitted to its Parliament a law related to AI, however it does not address the designation of NCAs or any provisions to implement the AI Act.</footnote>

<footnote n="32">³² Contexte. (2025). *Le mercato des autorités du règlement sur l'IA bute sur les processus démocratiques et les infrastructures critiques*. Contexte. Available at: https://www contexte com/fr/actualite/tech/le-mercato-des autorites-du-reglement-sur-lia-bute-sur-les-processus-democratiques-et-les-infrastructures-critiques_235039?go-back-to-briefitem=235039.</footnote>

<footnote n="33">³³ Draft law 8476 implementing certain provisions of Regulation (EU) 2024/1689. Chambre des députés du Grand-duché du Luxembourg. Available at: https://www.chd.lu/fr/dossier/8476.</footnote>

<footnote n="34">³⁴ As a reminder, in European law a regulation is a legal instrument of EU secondary legislation provided for under Article 288 of the *Treaty on the Functioning of the European Union* (TFEU). Its purpose is to ensure that European legislation is applied uniformly and simultaneously in all MSs.</footnote>
sake of clarity and consistency, these acts will be referred to as national implementation laws.

### 3.1.2 Delay in the legal enshrinement of the designation of NCAs.

Regarding the legal enshrinement of NCA designations, MSs were not all at the same stage. A week prior to the deadline, **21 states had still not submitted a national implementation law to their respective parliaments**, in order to legally enshrine the designation of their NCAs.

More precisely, 13 states were reported to be drafting a law or to have drafted one that had not yet been submitted to parliament.<fnref n="35" /> As for the remaining 8 states, no bills or information on draft legislation were found.<fnref n="36" /> However, with respect to the latter, it is possible that interministerial negotiations were underway but had not been announced, or that arbitration decisions had already been adopted but not made public. For example, although no implementation law had been made public, Cyprus had already **announced** its national competent authorities and was one of the first MSs to notify the Commission.

<figure><img src="image_6.png" /><figcaption>Table 1 - Status of the adoption of national implementation laws.<fnref n="37" /></figcaption></figure>

This delay in establishing national AI governance architectures is not an unusual occurrence. For instance, the identification of authorities protecting

fundamental rights under Article 77 of the AI Act was also delayed in some MSs.<fnref n="38" /> On 2 August 2025, Italy had still not identified its authorities responsible for protecting fundamental rights, ten months after the date set by the AI Act.<fnref n="39" />

Nevertheless, this delay is likely to give rise to complications in the implementation of the AI Act. It delays identification of the authorities by European bodies, their counterparts in other MSs, and operators. It may suspend the internal organisation of the authorities, for which a reorganisation of priorities, objectives and teams, and possibly recruitment, may be necessary, as Article 70(3) of the AI Act requires that “national competent authorities are provided with adequate technical, financial and human resources, and with infrastructure to fulfil their tasks effectively under this Regulation”. In legal terms, this means that states were not in compliance with the AI Act, thereby exposing them to the risk of an infringement procedure in the most serious cases.<fnref n="40" />

This delay has been criticised by digital rights groups, which have called on the Commission to “press Member States to pass implementing laws and designate and sufficiently resource national competent authorities” and on MSs to “ensure that national AI governance structures are well-resourced and officially designated”.<fnref n="41" />

Finally, the majority of MSs (21) had not yet adopted – and in some cases even initiated – a procedure that officially assigns the powers devolved to the authorities under the AI Act.<fnref n="42" /> Nevertheless, plans for 14 governance frameworks had been announced, giving a glimpse of the way AI governance could take shape within the EU.

## 3.2 National architectures based on multiple but pre-identified authorities.

A week prior to the deadline, it was possible to identify the governance architectures of the following 14 MSs based on publicly available information: Bulgaria<fnref n="43" />, Cyprus, the Czech

<footnote>The regulation is binding in full, general in scope and direct in application, which means that it does not need to be transposed into national law or published in national official journals. However, the adoption of national legal acts may be necessary in order to organise the internal jurisdiction resources and to comply with new European regulations.</footnote>

<footnote n="35">³⁵ States that are currently drafting a law or have a drafted law but have not yet submitted it to parliament are Bulgaria, Croatia, the Czech Republic, Estonia, France, Germany, Hungary, Ireland, Latvia, Poland, Slovakia, Slovenia and Spain.</footnote>

<footnote n="36">³⁶ States for which no information is available concerning whether they are drafting a law are Austria, Belgium, Cyprus, Greece, Malta, the Netherlands, Portugal and Sweden.</footnote>

<footnote n="37">³⁷ For further information, see Appendix 4.</footnote>

<footnote n="38">³⁸ Kroet, C. (2025). *Italy and Hungary fail to appoint fundamental rights bodies under AI Act*. EuroNews. Available at: https://www.euronews.com/next/2025/05/06/italy-and-hungary-fail-to-appoint-fundamental-rights-bodies-under-ai-act.</footnote>

<footnote n="39">³⁹ European Commission, Fundamental rights protection authorities with special powers under the AI Act. Available at: https://digital-</footnote>

<footnote>strategy.ec.europa.eu/en/policies/fundamental-rights-protection-authorities-ai-act.</footnote>

<footnote n="40">⁴⁰ The infringement procedure is a prerogative granted to the Commission enabling it to compel MSs to comply with EU law when they fail to do so or do not correctly apply EU legislation on the basis of Article 258 of the TFEU. This is a gradual procedure, ranging from a letter of formal notice to the defaulting state to referral to the Court of Justice of the EU.</footnote>

<footnote n="41">⁴¹ EDRi et al. (2025). *Open letter "Keep AI Act National Implementation on Track"*. EDRi. Available at: https://edri.org/our-work/open-letter-european-commission-member-states-keep-ai-act-national-implementation-on-track/.</footnote>

<footnote n="42">⁴² Denmark and Lithuania are the only states to have officially and legally designated their NCAs within the deadline set by the AI Act. Finland, Italy, Luxembourg and Romania had submitted their drafts to their respective parliaments, but these had not yet been officially adopted by the legislatures by 2 August 2025.</footnote>

<footnote n="43">⁴³ As mentioned in section 1.2, Bulgarian architecture was put forward by a minor party in Bulgarian Parliament for public consultation but it has not been submitted to Parliament yet. It may therefore not represent the real</footnote>
Republic, Denmark, Finland, Germany<fnref n="44" />, Ireland, Italy, Latvia, Lithuania, Luxembourg, Poland, Slovenia and Spain.

A closer look at these national governance architectures reveals a significant disparity between the number of MSAs and NAs designated, with states tending to designate fewer NAs than MSAs (3.2.1). While some data protection authorities are granted competences under the *AI Act* – primarily as MSAs – others are entirely excluded (3.2.2). Finally, MSs tend to rely on pre-existing authorities rather than creating new ones (3.2.3).

### 3.2.1 Number of NCAs designated.

The majority of **MSs limited themselves to designating a single NA**, whereas a few chose to designate more: Germany (2), Luxembourg (3), Finland, Ireland, and Slovenia (4 each).<fnref n="45" />

<figure><img src="image_7.png" /><figcaption>Table 2 - Number of notifying authorities designated by Member States.<fnref n="46" /></figcaption></figure>

Conversely, **MSAs tended to be more heterogeneous and greater in number**, with their designation varying from 1 to 13 authorities per state. At the same time, a disparity emerged between MSs choosing to establish a limited number of MSAs – three or fewer authorities – and those that designated more than three.

<figure><img src="image_8.png" /><figcaption>Table 3 - Number of market surveillance authorities designated by Member States.<fnref n="47" /></figcaption></figure>

This disparity reflects the diversity of national approaches to market surveillance.

On the one hand, employing a limited number of MSAs reflects a preference for centralised or even unified oversight of AI systems. On the other hand, relying on a higher number of MSAs reflects a more fragmented approach, which may be justified by the pursuit of sectoral specialisation. Both approaches are driven by different local institutional, economic, and administrative considerations.

Nevertheless, they both require sufficient financial, human, and technical resources<fnref n="48" /> and structures in order to comply with Article 70 of the *AI Act* and ensure effective and efficient monitoring and oversight of AI systems. As Claudio Novelli et al. stated, “*a lack of sufficient resources at MSAs can significantly slow the regulatory oversight of emerging AI technologies*”.<fnref n="49" /> As a matter of fact, lagging MSs that have not yet designated and properly resourced their MSAs could temporarily hinder their competitiveness, given the fact that speed to market is a crucial issue for businesses.

### 3.2.2 Designation of DPAs as NCAs.

The interconnection between personal data legislation and the *AI Act* raises the question of the role of data protection authorities (DPAs) in the regulation of AI, and the powers they may be afforded under the *AI Act* give pause for thought.<fnref n="50" />

In July 2024, the European Data Protection Board (EDPB) published a statement on the role of DPAs under the *AI Act*.<fnref n="51" /> In its statement, the EDPB

<footnote>intentions of the executive and legislative powers and may not be submitted to Parliament.</footnote>

<footnote n="44">⁴⁴ As mentioned in section 1.2, as regards Germany, the *document* retrieved is not available on an official website and is more akin to a working or preparatory document, drafted before the 2025 German federal election.</footnote>

<footnote n="45">⁴⁵ States that have designated a single NA are Bulgaria, Cyprus, the Czech Republic, Denmark, Italy, Latvia, Lithuania, Poland and Spain.</footnote>

<footnote n="46">⁴⁶ For further information, see Appendix 5.</footnote>

<footnote n="47">⁴⁷ For further information, see Appendix 6.</footnote>

<footnote n="48">⁴⁸ Novelli, C. et al. (2025). *A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities*. European Journal of</footnote>

<footnote>Risk Regulation. Cambridge University Press. 16(2). p.566-590. Available at: https://www.cambridge.org/core/journals/european-journal-of-risk-regulation/article/robust-governance-for-the-ai-act-ai-office-ai-board-scientific-panel-and-national-authorities/98FEE97C8F9423DFCC28CBE063F9753B.</footnote>

<footnote n="49">⁴⁹ *Ibid*.</footnote>

<footnote n="50">⁵⁰ Mazur, J. Novelli, C. and Choińska, Z. (2025). *Should Data Protection Authorities Enforce the AI Act? Lessons from EU-wide Enforcement Data*. SSRN. Available at: https://ssrn.com/abstract=5290513.</footnote>

<footnote n="51">⁵¹ EDPB. (2024). EDPB adopts statement on DPAs role in AI Act framework, EU-U.S. Data Privacy Framework FAQ and new European</footnote>
recommends that MSs designate their national DPAs as their MSAs for high-risk AI systems, and as their SPoCs. The EDPB grounds its justification in the independence of the DPAs, their expertise and experience with related matters, and the legal and technical skills they possess.<fnref n="52" /> Their position as a key player in the digital governance ecosystem would facilitate interactions among data protection and AI governance stakeholders, and enable a "unified, consistent and effective" approach across the relevant sectors.

Its position has been echoed by some national DPAs, such as the French (CNIL) and Polish (UODO).

Upon examining the governance architectures, it appeared that the **EDPB's recommendation had been partially followed** by MSs since **9 DPAs had been designated as MSAs and 1 as SPoC.**<fnref n="53" />

However, **5 MSs** – namely the Czech Republic, Germany, Italy, Lithuania, and Poland – **completely excluded their DPAs** from their governance architectures.

Such exclusion contrasts with the **AI Act** itself acknowledging DPAs legitimacy to oversee AI systems. In fact, Article 74(8) provides that MSs shall designate as MSA "either the competent data protection supervisory authorities under Regulation (EU) 2016/679 or Directive (EU) 2016/680, or any other authority designated pursuant to the same conditions laid down in Articles 41 to 44 of Directive (EU) 2016/680" to oversee high-risk AI systems listed in points 1 – when used for law enforcement purposes, border management and justice and democracy – as well as points 6, 7, and 8 of Annex III of the **AI Act**.<fnref n="54" />

<figure><img src="image_9.png" /><figcaption>Table 4 - Designation of data protection authorities as national competent authorities.</figcaption></figure>

Germany's decision to sideline its DPA – in favour of its Federal Network Agency (Bundesnetzagentur, BNetzA) and a newly created body within it – has been confirmed in a recently published *draft law*. However, this choice has been *strongly criticised* in a statement issued by the national and federal German DPAs, which described it as a “massive weakening of fundamental rights”. This approach stands in contrast to France's recent decision – set out in a complex governance *scheme* – to designate its DPA as an MSA with 15 areas of AI use cases.<fnref n="55" />

As MSs proceed with their designations, **divergences have become increasingly evident regarding the allocation of responsibilities to DPAs** for the implementation and enforcement of the **AI Act**. The exclusion of DPAs raises broader questions about how MSs perceive the role of DPAs and **points to a potential lack of trust in their involvement in AI governance**. This concern was explicitly highlighted by the German DPAs in the previously cited statement, which observed that “*one of the reasons given for the proposal is to remove supposed barriers to innovation, as ‘data protection authorities focus primarily on the protection of fundamental rights,’ as the draft states.*”

### 3.2.3 Designation of pre-existing authorities.

Finally, the lifespan of the designated authorities is a parameter that requires consideration, as it is likely to influence their ability to achieve their objectives quickly and effectively and to become fully operational as the provisions of the **AI Act** come into force. Authorities that have already been identified and invested with responsibilities under European legislation are likely to benefit from their prior experience, whereas newly created entities may experience delays due to internal organisation and integration into the digital regulation ecosystem. Nevertheless, new entities may enjoy a significant organisational advantage, as they can structure themselves specifically around the framework established by the **AI Act** and integrate the rapidly evolving nature of AI from the outset.

The **majority of MSs had opted to designate pre-existing authorities**, which already have responsibilities under other legislation, as NCAs.

<footnote>Data Protection Seal. EDPB. Available at: https://www.edpb.europa.eu/news/news/2024/edpb-adopts-statement-dpas-role-ai-act-framework-eu-us-data-privacy-framework-faq_en.</footnote>

<footnote n="52">⁵² The independence of the authorities is a requirement of Article 70 of the AI Act.</footnote>

<footnote n="53">⁵³ Those MSs are Bulgaria, Cyprus, Denmark, Finland, Ireland, Latvia, Luxembourg, Slovenia and Spain. Luxembourg went further, by being the only country to designate its DPA as a MSA and SPoC, thereby making it a cornerstone in the national governance of AI</footnote>

<footnote n="54">⁵⁴ Regulation (EU) 2016/679, also known as the General Data Protection Regulation (GDPR), provides protection to individuals when their personal data are processed by private and public entities.</footnote>

<footnote>The Directive (EU) 2016/680 also known as Law Enforcement Directive (LED), provides protection to individuals when their personal data are processed by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties (judicial authorities, law enforcement authorities, etc.).</footnote>

<footnote n="55">⁵⁵ The scheme is reproduced on page 11.</footnote>
However, 5 MSs – namely Germany, Luxembourg, Ireland<fnref n="56" />, Poland and Spain – had entrusted the supervision of AI to newly created authorities or authorities that are acquiring their first responsibilities under the AI Act.<fnref n="57" /> The latter two had chosen to create authorities that are specifically dedicated to AI, combining the functions of MSA and SPoC. In so doing, they made these new entities pivotal figures in the governance of AI at national level.

<figure><img src="image_10.png" /><figcaption>Table 5 - Number of Member States designating a newly created body as national competent authority.</figcaption></figure>

## Conclusion

The aim of this study was to identify and analyse the development of national AI governance architectures, focusing on the designation of NAs, MSAs and SPoCs. It also provided an opportunity to determine where MSs stand in relation to the AI Act timetable, which set the designation of these authorities for 2 August 2025.

The study revealed that one week prior to the deadline, 21 MSs had not yet submitted a national implementation law to their parliaments to legally enshrine their designations, while 13 had not announced the designation of their NCAs. Since the end of data compilation in July, some MSs have officially announced their NCAs (France, Ireland), published drafts of their national implementation laws (Germany, Hungary), or adopted their national implementation laws (Italy). Despite these developments, the majority of MSs still have not

## legally empowered their NCAs to fulfil their tasks.

The embryonic governance architectures highlight divergences in the number of designated NCAs. While MSs tend to rely on a limited number of NAs, approaches differ in market surveillance, where the number of designated authorities is considerably higher. Many of these authorities have already been identified by operators in the relevant sectors, as most of them already have powers under other legislation or are specifically identified for AI supervision.

Among these authorities are DPAs, whose potential contribution to AI governance seems to be questioned by several MSs. In fact, although some MSs have chosen to grant their DPA powers under the AI Act – mainly as MSAs – 5 MSs decided to exclude their DPAs from their national governance architectures. The German DPA, which appears to adopt a cautious and demanding stance regarding the risks AI models and systems may pose to fundamental rights, is one of the DPAs excluded from its MS's national governance architecture. Conversely, the French DPA, which maintains an open dialogue and cooperative relationship with businesses, has recently been designated as an MSA and entrusted with the supervision of 15 areas of AI use cases.

As MSs announce their designations and organise their national governance, a complex and expansive bureaucracy is emerging, which runs counter to the EU's efforts to simplify digital legislation – including the AI Act – carried out by the Commission under the forthcoming Digital Omnibus.<fnref n="58" /> Despite this simplification process – initially called for by MSs and stakeholders – some MSs continue to increase institutional complexity by designating numerous NCAs. France serves as a notable example, opting for a complex fragmented governance structure with 17 different MSAs, often sharing mandates across 1 to 3 bodies (see page 11).<fnref n="59" />

This state-of-the-art overview, which focused on the situation prior to the entry into force of Article 70 of the AI Act, is intended to be updated to further assess progress in these designations and the shaping of the EU's AI governance framework.

<footnote n="56">⁵⁶ The Irish Minister of State for Trade Promotion, Artificial Intelligence and Digital Transformation announced that a new central and coordination authority should be appointed and designated as the SPoC during a Ministerial question session. The interim responsibility will be assumed by the Minister of State for Trade Promotion, Artificial Intelligence, and Digital Transformation under the Ministry for Enterprise, Tourism and Employment.</footnote>

<footnote n="57">⁵⁷ Luxembourg has designated the Luxembourg Agency for Medicines and Health Products (Agence luxembourgeoise des médicaments et produits de santé) as its NA and MSA. Its creation has been called for since 2019, but</footnote>

<footnote>the draft bill submitted to Parliament in January 2025 had not yet been adopted.</footnote>

<footnote n="58">⁵⁸ European Commission. (2025). Commission collects feedback to simplify rules on data, cybersecurity and artificial intelligence in the upcoming Digital Omnibus. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-collects-feedback-simplify-rules-data-cybersecurity-and-artificial-intelligence-upcoming.</footnote>

<footnote n="59">⁵⁹ The Department for Enterprise (DGE) of the French Ministry of the Economy published a scheme outlining the MSAs responsible for monitoring high-risk AI systems. The scheme has been translated and reproduced on page 11.</footnote>
<figure><img src="image_11.png" /><figcaption>Table 6 - Market surveillance structure for AI Act implementation in France.</figcaption></figure>
<figure><img src="image_12.png" /></figure>

Bibliography

Drechsler, L. and Vogiatzoglou, P. (2024). *Article 74 - Market Surveillance and Control of AI Systems in the Union Market*. In Necati Pehlivan, C. and Forgó, N. and Valcke, P. (EDS). The EU Artificial Intelligence (AI) Act: A commentary. Kluwer Law International. 1468pp.

EDPB. (2024). *EDPB adopts statement on DPAs role in AI Act framework, EU-U.S. Data Privacy Framework FAQ and new European Data Protection Seal*. EDPB. Available at: https://www.edpb.europa.eu/news/news/2024/edpb-adopts-statement-dpas-role-ai-act-framework-eu-us-data-privacy-framework-faq_en.

EDRi et al. (2025). *Open letter "Keep AI Act National Implementation on Track"*. EDRi. Available at: https://edri.org/our-work/open-letter-european-commission-member-states-keep-ai-act-national-implementation-on-track/.

Emborg, T. (2024, updated in May 2025). Overview of all AI Act National Implementation Plans. EU AI Act. Available at: https://artificialintelligenceact.eu/national-implementation-plans/.

European Commission. (2025). Commission collects feedback to simplify rules on data, cybersecurity and artificial intelligence in the upcoming Digital Omnibus. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-collects-feedback-simplify-rules-data-cybersecurity-and-artificial-intelligence-upcoming/.

European Commission. (2025) Fundamental rights protection authorities with special powers under the AI Act. Available at: https://digital-strategy.ec.europa.eu/en/policies/fundamental-rights-protection-authorities-ai-act.

European Commission. (2025). Market surveillance Authorities under the AI Act. Available at: https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act#1720699867912-1.

Gerritsen, J. (2025). List of authorities protecting fundamental rights (Article 77 AI Act). LinkedIn. Available at: https://www.linkedin.com/posts/jbagerritsen_digibeetleeu-complete-list-ai-act-fundamental-activity-7311388946133835776-Mpta/.

Kroet, C. (2025). *Italy and Hungary fail to appoint fundamental rights bodies under AI Act*. EuroNews. Available at: https://www.euronews.com/next/2025/05/06/italy-and-hungary-fail-to-appoint-fundamental-rights-bodies-under-ai-act.

Lakssimi, T. (2025). *Du code civil au règlement sur l'intelligence artificielle (RIA)*. [From the Civil Code to the Regulation on Artificial Intelligence (EU AI Act)]. Les Cahiers de la justice. Dalloz. No.2, p. 249-261.

Mazur, J. Novelli, C. and Choińska, Z. (2025). *Should Data Protection Authorities Enforce the AI Act? Lessons from EU-wide Enforcement Data*. SSRN. Available at: https://ssrn.com/abstract=5290513.

Novelli, C. et al. (2025). *A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities*. European Journal of Risk Regulation. Cambridge University Press. 16(2). p.566-590. Available at: https://www.cambridge.org/core/journals/european-journal-of-risk-regulation/article/robust-governance-for-the-ai-act-ai-office-ai-board-scientific-panel-and-national-authorities/98FEE97C8F9423DFCC28CBE063F9753B.

Parisini, E. and Dervishaj, E. (2025) *Emerging models of national competent authorities under the EU AI Act*. Conference on Digital Government Research. Vol. 26. Available at: https://proceedings.open.tudelft.nl/DGO2025/article/view/1007.

Pók, L. (2024). Authorities protecting fundamental rights (Art. 77 AI Act). LinkedIn. Available at: https://www.linkedin.com/posts/laszlopokAuthorities-protecting-fundamental-rights-activity-7326192248381968384-eHH-/.

Pók, L. (2024). Responsible authorities for the enforcement of the AI Act on national level. GDPR Blog. Available at: https://gdpr.blog.hu/2024/10/02/responsibleAuthorities_for_enforce ment_of_the_ai_act_on_national_level.

Schmidl, M. and Rohner, A. (2024). *Article 70 - Designation of National Competent Authorities and Single Point of Contact*. In Necati Pehlivan, C.

and Forgó, N. and Valcke, P. (EDS). The EU Artificial Intelligence (AI) Act: A commentary. Kluwer Law International. 1468pp.

Škorjanc, Ž. and Korte, K. (2024). *Article 28 - Notifying Authorities*. In Necati Pehlivan, C. and Forgó, N. and Valcke, P. (EDS). The EU Artificial Intelligence (AI) Act: A commentary. Kluwer Law International. 1468pp.

Zenner, K. (2024). *The EU AI Act: responsibilities of the Member States*. Digitizing Europe. Available at: https://www.kaizenner.eu/post/ai-act-responsibilities-ms/.

Austria

Parlament Österreich. (2023). *Geplante EU-Regulierung von künstlicher Intelligenz heute auch Thema im EU-Unterausschuss mit Staatssekretär Tursky* [Planned EU regulation of artificial intelligence also discussed today in EU subcommittee with State Secretary Tursky]. Parlament Österreich. Available at: https://www.parlament.gv.at/aktuelles/pk/jahr_2023/pk1376.

Belgium

SPF Economie. (2025). Foire aux questions concernant l'intelligence artificielle, l'Artificial Intelligence Act de la Commission européenne, et les applications de ce dernier [Frequently asked questions about artificial intelligence, the European Commission's Artificial Intelligence Act, and its applications]. SPF Economie. Available at: https://economie.fgov.be/fr/themes/line/intelligence-artificielle/foire-aux-questions-concernant.

SPF Economie. (2025). Règlement sur l'intelligence artificielle. [Artificial Intelligence Act]. SPF Economie. Available at: https://economie.fgov.be/fr/themes/line/intelligence-artificielle/reglement-sur-l-intelligence/.

Bulgaria

Božanov, B. (2025). *Обществено обсъждане на изцяло нов Закон за използването и развитието на Изкуствения интелект*. [Public consultation on a completely new law on the use and development of artificial intelligence]. Da Bulgaria!. Available at: https://www.dabulgaria.bg/obshttestveno-obsazhdane-na-iztsyalo-nov-zakon-za-izpolzvaneto-i-razvitieto-na-izkustveniya-intelekt/.

Da Bulgaria!. (2025). *Проект закон за използването и развитието на Изкуствения интелект*. [Draft law on the use and development of artificial intelligence]. Google Doc. Available at: https://docs.google.com/document/d/1-ikV4J3q2xDNP6z03p5WidCyjeh3-EwwSOp1dadanMM/edit?tab=t.0.

Croatia

Vlada Republike Hrvatske. (2025). *Cilj Nacionalnog plana za razvoj umjetne inteligencije je stvaranje konkretnih mjera za njezin razvoj u Hrvatskoj*. [The goal of the National Plan for the Development of Artificial Intelligence is to create concrete measures for its development in Croatia.]. Vlada Republike Hrvatske. Available at: https://vlada.gov.hr/vijesti/cilj-nacionalnog-plana-za-razvoj-umjetne-inteligencije-je-stvaranje-konkretnih-mjera-za-njezin-razvoj-u-hrvatskoj/44503.

Ministarstvo pravosuda, uprave i digitalne transformacije (2025). *Sjednica Vlade: Pri izradi planova kojima će se regulirati umjetna inteligencija, u fokusu sigurnost gradana i njihovih podataka*. [Government Session: Plans to regulate artificial intelligence will focus on the security of citizens and their data]. Ministarstvo pravosuda, uprave i digitalne transformacije. Available at: https://mpudt.gov.hr/vijesti-8/sjednica-vlade-pri-izradi-planova-kojima-ce-se-regulirati-umjetna-inteligencija-u-fokusu-sigurnost-gradjana-i-njihovih-podataka/30074.

Cyprus

Damianou, N. (2025). Speech by Deputy Minister of Research, Innovation and Digital Policy, Dr Nicodemos Damianou. Government Portal. Available at: https://www.gov.cy/en/speeches/speech-by-deputy-minister-of-research-innovation-and-digital-policy-dr-nicodemos-damianou-2/.

Damianou, N. (2025). Δήλωση του Υφυπουργού Έρευνας, Καινοτομίας και Ψηφιακής Πολιτικής αναφορικά με την έγκριση σύστασης Εθνικής Εξετιδικευμένης Επιτροπής για την Τεχνητή Νοημοσύνη (AITaskforce) από το Υφυπουργικό Συμβούλιο. [Statement by the Deputy Minister of Research, Innovation, and Digital Policy regarding the approval of the establishment
of a National Specialized Committee on Artificial Intelligence (AITaskforce) by the Council of Ministers]. Government Portal. Available at: https://www.gov.cy/erevna-kainotomia-kai-psifiaki-politiki/dilosia-tou-yfypourgou-erevnas-kainotomias-kai-psifiakis-politikis-anaforika-me-tin-egkrisi-systasis-ethnikis-exeidikeymenis-epitropis-gia-tin-techni-noimosyni-aitaskforce-apo-to-ypourgiko-symvoul/.

## Czech Republic

71/25 Návrh implementace Aktu o umělé inteligenci v České republice; T:10.4.2025. [71/25 Proposal for the implementation of the Act on Artificial Intelligence in the Czech Republic; T: 10.4.2025]. Hospodářská komora České Republiky. Available at: https://www.komora.cz/pravni-predpis/71-25-návrh-implementace-aktu-o-umele-inteligenci-v-ceske-republicit10-4-2025/.

161/24 Implementace Aktu o umělé inteligenci; T:26.7.2024. [161/24 Implementation of the Act on Artificial Intelligence; T: 26.7.2024]. Hospodářská komora České Republiky. Available at: https://www.komora.cz/pravni-predpis/161-24-implementace-aktu-o-umele-inteligencit26-7-2024/.

Výsledky jednání vlády 28. května 2025. [Results of the government meeting on May 28, 2025; see points 22, 23 and 24]. Vláda České republice. Available at: https://vlada.gov.cz/cz/media-centrum/aktualne/vysledky-jednani-vlády-28--kvetna-2025-219919/.

## Denmark

Lov nr 467 af 14/05/2025 - Lov om supplerende bestemmelser til forordningen om kunstig intelligens. [Law no. 467 of 14/05/2025 - Act on supplementary provisions to the Regulation on artificial intelligence.]. Retsinformation. Available at: https://www.retsinformation.dk/eli/lta/2025/467.

L154 - Forslag til Lov om supplerende bestemmelser til forordningen om kunstig intelligens, vedtaget af Folketinget ved 3. behandling den 8. maj 2025. [L154 - Proposal for a law on supplementary provisions to the regulation on artificial intelligence, adopted by the Danish Parliament at its third reading on May 8, 2025.]. Folketinget. Available at: https://www.ft.dk/ripdf/samling/20241/lovforslag/l154/20241_l154_som vedtaget.pdf.

Lovgivningsproces - L154 Forslag til lov om supplerende bestemmelser til forordningen om kunstig intelligens. [Legislative process - L154 Proposal for a law on supplementary provisions to the regulation on artificial intelligence.]. Folketinget. Available at: https://www.ft.dk/samling/20241/lovforslag/l154/index.htm.

## Estonia

Andmekaitse Inspektsioon. Tähelepanekuid andmekaitse ja tehisintellekti (AI) seostest ja arengutest. [Observations on the links and developments between data protection and artificial intelligence (AI)]. Andmekaitse Inspektsioon. Available at: https://aastaraamat.aki.ee/aastaraamat-2024/tahelepanekuid-andmekaitse-ja-tehisintellekti-ai-seostest-ja-arengutest.

## Finland

Eduskunta Riksdagen. Asian käsitellytiedot HE 46/2025 vp. [Information on the processing of the matter HE 46/2025 vp.]. Eduskunta Riksdagen. Available at: https://www.eduskunta.fi/FI/vaski/KasittelytiedotValtiopaivaasiia/Sivut/HE_46+2025.aspx?TSPD_101.

Eduskunta Riksdagen. Hallituksen esitys HE 46/2025 vp Hallituksen esitys eduskunnalle EU: n tekölyäsetusta täydentäväksi lainsäädännöksi. [Government proposal HE 46/2025 vp Government proposal to Parliament for legislation supplementing the EU Artificial Intelligence Act.]. Eduskunta Riksdagen. Available at: https://www.eduskunta.fi/FI/vaski/HallituksenEsitys/Sivut/HE_46+2025.aspx?TSPD_101.

## France

Contexte. (2025). Le mercato des autorités du règlement sur l'IA bute sur les processus démocratiques et les infrastructures critiques. [The AI Regulation's Authority Reshuffle Runs Up Against Democratic Processes and Critical Infrastructures.]. Contexte. Available at: https://www contexte.com/fr/actualite/tech/le-mercato-des-autorites-du-reglement-sur-lia-bute-sur-les-processus-democratiques-et-les-infrastructures-critiques_235039?go-back-to-briefitem=235039.

Contexte. (2025). Règlement sur l'IA : l'Arcom et la Cnil en compétition pour récupérer la surveillance des processus démocratiques. [AI

Regulation: Arcom and CNIL Compete to Take Over Oversight of Democratic Processes.]. Contexte. Available at: https://www contexte.com/fr/actualite/medias/reglement-sur-lia-larcomet-la-cnil-en-competition-pour-recuperer-la-surveillance-des-processus-democratiques_235168?go-back-to-briefitem=235168.

Contexte. (2025). Les autorités aux manettes, sous le regard vigilant de Bercy : comment la France pourrait réguler l'IA. [The authorities at the helm, under the watchful eye of Bercy: how France could regulate AI.]. Contexte. Available at: https://www contexte.com/fr/article/tech/les-autorites-aux-manettes-sous-le-regard-vigilant-de-bercy-comment-la-france-pourrait-reguler-lia_216004?utm source=briefing&utm medium=email&utm content=24626&go-back-to-briefitem=234410.

## Germany

Der Landesbeauftragte für Datenschutz und Informationsfreiheit Baden-Württemberg. (2025). Landesdatenschutzbehörden: Digitalministerium will bei KI-Kontrolle Grundrechtsschutz schwächen. [Autorités régionales chargées de la protection des données : le ministère du Numérique souhaite affaiblir la protection des droits fondamentaux dans le cadre du contrôle de l'IA]. Available at: https://www.baden-wuerttemberg.datenschutz.de/landesdatenschutzbehoerden-digitalministerium-will-bei-ki-kontrolle-grundrechtsschutz-schwaechen/.

Referententewurf des Bundesministeriums für Wirtschaft und Klimaschutz und des Bundesministeriums der Justiz (Gesetz zur Durchführung der KI-Verordnung). [Draft bill of the Federal Ministry of Economics and Climate Protection and the Federal Ministry of Justice (Act on the Implementation of the AI Regulation)]. Available at: https://assets.ctfassets.net/jq1xw71av3v5/6AKrXoeiDtYvFgYjrEwLYI/774c67d2d73ccc94aee94f894a936a87/241204_BMWK-BMJ RefE_AI-Act-Umsetzung.pdf.

Wulff Wold, J. (2025). German coalition disagrees on AI regulation, digital sovereignty. Euractiv. Available at: https://www.euractiv.com/section/tech/news/german-coalition-disagrees-on-ai-regulation-digital-sovereignty/.

Helleberg, M. (2025). Zur künstlichen Intelligenz im Rahmen der Koalitionsverhandlungen: ein Zwischenstand. [Artificial intelligence in coalition negotiations: an interim assessment]. NOERR. Available at: https://www.noerr.com/de/insights/zur-kuenstlichen-intelligenz-im-rahmen-der-koalitionsverhandlungen-ein-zwischenstand.

Rappenglück, D. and Vonthien, M. (2025). Umsetzung der KI-VO: Der Referententewurf zum KI Marktüberwachungsgesetz. [Implementation of the AI Regulation: The draft bill for the AI Market Surveillance Act]. Available at: https://www.cmshs-bloogt.de/rechtsthemen/kuenstliche-intelligenz/umsetzung-der-ki-vo-der-referententewurf-zum-ki-marktueberwachungsgesetz/.

CDU/CSU. (2024). Kleine Anfrage - Nationale Umsetzung des AI Act in Deutschland. [Minor interpellation - National implementation of the AI Act in Germany.]. Deutscher Bundestag. Available at: https://www.bundestag.de/presse/hib/kurzmeldungen-1016762.

Datenschutzkonferenz. (2024). Beschluss der Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder vom 3. Mai 2024. [Decision of the Conference of Independent Data Protection Authorities of the Federal Government and the States of May 3, 2024.]. Datenschutzkonferenz. Available at: https://www.datenschutzkonferenz-online.de/media/dskb/20240503_DSK_Positionspapier_Zustaendigkeiten_KI VO.pdf.

Bundesregierung. (2024). Antwort der Bundesregierung auf die Kleine Anfrage der Fraktion der CDU/CSU - Nationale Umsetzung des AI Act in Deutschland. [Response of the Federal Government to the minor interpellation by the CDU/CSU parliamentary group - National implementation of the AI Act in Germany.]. Deutscher Bundestag. Available at: https://dsserver.bundestag.de/btd/20/129/2012948.pdf.

## Greece

ΑΠΟΦΑΣΕΙΣ Αριθμ. 1961 - Σύσταση Ετιδικής Γραμματείας Τεχνητής Νοη-μοσύνης και Διαχυβέρνησης Δεδομένων στο Υπουργείο Ψηφιακής Διαχυβέρνησης. [DECISIONS No. 1961 - Establishment of a Special Secretariat for Artificial Intelligence and Data Governance at the Ministry of Digital Governance.]. Government Gazette of the Hellenic Republic. Available at: https://karagilanis.gr/files/kya_1961_2025.pdf.

## Hungary

1149/2025. (V. 14.) Korm. határozat a mesterséges intelligenciáról szóló európai parlamenti és tanácsi rendelete végrehajtásához szükséges
intézkedésekről szóló 1301/2024. (IX. 30.) Korm. határozatban foglalt feladatok végrehajtásáról. [1149/2025. (V. 14.) Government Resolution on the implementation of the tasks set out in Government Resolution 1301/2024. (IX. 30.) on the measures necessary for the implementation of the Regulation of the European Parliament and of the Council on artificial intelligence.]. Nemzeti Jogszabálytár. Available at: https://njt.hu/jogszabaly/2025-1149-30-22.

1301/2024. (IX. 30.) Korm. határozat a mesterséges intelligenciáról szóló európai parlamenti és tanácsi rendelet végrehajtásához szükséges intézkedésekről. [1301/2024. (IX. 30.) Government Decree on measures necessary for the implementation of the Regulation of the European Parliament and of the Council on artificial intelligence.]. Nemzeti Jogszabálytár. Available at: https://njt.hu/jogszabaly/2024-1301-30-22.

Országgyűlés. (2025). *A Kormány 2025. évi őszí törvé nyalkotási programja*. [The Government's legislative program for the fall of 2025.]. Országgyűlés. Available at: https://www.parlament.hu/documents/d/guest/tvalk_program_2025-osz.

## Ireland

Gibney, S. (2025). *Parliamentary questions - Artificial Intelligence, Dáil Éireann Debate, Tuesday - 8 July 2025*. Houses of the Oireachtas. Available at: https://www.oireachtas.ie/en/debates/question/2025-07-08/370/#pq_370.

Connolly, C. (2025). *Parliamentary questions - Maximising Artificial Intelligence: Statements, Dáil Éireann Debate, Wednesday - 19 Feb 2025*. Houses of the Oireachtas. Available at: https://www.oireachtas.ie/en/debates/debate/dail/2025-02-19/13/.

Department of Enterprise, Trade and Employment. (2024). *Public consultation on National Implementation of EU Harmonised Rules on Artificial Intelligence (AI Act)*. Department of Enterprise, Tourism and Employment. Available at: https://enterprise.gov.ie/en/consultations/public-consultation-on-eu-ai-act.html.

Irish Council of Civil Liberties. (2025). *Who is Responsible to Enforce AI Act Prohibitions in Ireland? The State Does Not Know*. Irish Council of Civil Liberties. Available at: https://www.icli.ie/news/who-is-responsible-to-enforce-ai-act-prohibitions-in-ireland-the-state-does-not-know/#_ftn4.

Department of Enterprise, Trade and Employment. (2025). *Ministers Burke and Smyth welcome government approval of roadmap for implementing the EU Artificial Intelligence Act*. Department of Enterprise, Trade and Employment. Available at: https://www.gov.ie/en/press-release/441b7-ministers-burke-and-smyth-welcome-government-approval-of-roadmap-for-implementing-the-eu-artificial-intelligence-act/.

## Italy

Disegno di legge presentato dal Presidente del Consiglio dei ministri e dal Ministro della giustizia approvato dal Senato della Repubblica il 20 marzo 2025 modificato dalla Camera dei deputati il 25 giugno 2025. [Draft law presented by the Prime Minister and the Minister of Justice, approved by the Senate on March 20, 2025, amended by the Chamber of Deputies on June 25, 2025.]. Senato della Repubblica. Available at: https://www.senato.it/show-doc?leg=19&tipodoc=DDLPRES&id=1462298&idoggetto=0&part=ddlpr-es_ddlpre1.

Processo legislativo: Legge del Senato n. 1146. [Legislative process: Senate Law No. 1146.]. Senato della Repubblica. Available at: https://www.senato.it/leg/19/BGT/Schede/Ddliter/58262.htm.

## Latvia

Finanšu ministrija. Tiesību aktu projekti - Finanšu tirgus digitālās darbības noturības un mākslīgā intelekta izmantošanas likums. [Draft legislation - Law on the resilience of digital operations in financial markets and the use of artificial intelligence.]. TAP portāla lietotāju atbalsta dienests. Available at: https://tapportals.mk.gov.lv/legal_acts/ca9a89c8-1647-4628-9976-24fe64ca619c.

Ministru kabineta. (2025). Ministru kabineta 25.02.2025. sēdes protokols Nr. 8 (§49). [Minutes of the Cabinet of Ministers meeting No. 8 of 25 February 2025 (§49).]. TAP portāla lietotāju atbalsta dienests. Available at: https://tapportals.mk.gov.lv/meetings/protocols/ae207d5e-3ee8-4e84-ae62-6f41ed54318e#meeting-protocol-preview-8.

Publiskā apspriešana - Kārtība, kādā Mākslīgā intelekta centrs sadarbībā ar kompetentajām institūcijām organizē speciālo regulatīvo vidi, un kārtība, kādā speciālās regulatīvās vides ietvaros tiek apstrādāti personas dati. [Public consultation - The procedure by which the Artificial Intelligence

Centre, in cooperation with the competent authorities, organises the special regulatory environment and the procedure by which personal data is processed within the special regulatory environment.]. TAP portāla lietotāju atbalsta dienests. Available at: https://tapportals.mk.gov.lv/legal_acts/a6390b65-53c9-4af5-a507-85f4adf282a8.

Viedās administrācijas un reģionālās attīstības ministrija. (2024). Informatīvais zinojums "Par Mākslīgā intelekta akta prasību ieviešanu" [Informative report "On the implementation of the Artificial Intelligence Act"].] TAP portāla lietotāju atbalsta dienests. Available at: https://tapportals.mk.gov.lv/legal_acts/2d28c354-9baa-4aa2-ab31-fb4757687050#.

Viedās administrācijas un reģionālās attīstības ministrija. Tiesību aktu projekti - Mākslīgā intelekta attīstības likums. [Draft legislation - Artificial Intelligence Development Act.]. TAP portāla lietotāju atbalsta dienests. Available at: https://tapportals.mk.gov.lv/legal_acts/0a81b414-03dc-4773-99b3-d9cad5f0579d.

## Lithuania

X-614 Lietuvos Respublikos informacinės visuomenės paslaugų įstatymas - Galiojanti suvestinė redakcija. [X-614 Law on Information Society Services of the Republic of Lithuania - Valid consolidated version.]. Teisės Aktų Registras. Available at: https://www.e-tar.lt/portal/lt/legalAct/TAR.8A719A97956F/asr.

XIII-1414 Lietuvos Respublikos technologijų ir inovacijų įstatymas - Galiojanti suvestinė redakcija. [XIII-1414 Law on Technology and Innovation of the Republic of Lithuania - Valid consolidated version.]. Teisės Aktų Registras. Available at: https://www.e-tar.lt/portal/lt/legalAct/303806a0869411e8af589337b1eb893/asr.

XV-105 Lietuvos Respublikos technologijų ir inovacijų įstatymo Nr. XIII-1414 1, 2, 11, 13, 14, 17, 21 straipsnių pakeitimo ir Įstatymo papildymo priedu įstatymas. [XV-105 Law of the Republic of Lithuania on Technology and Innovation No. XIII-1414 Law on the Amendment of Articles 1, 2, 11, 13, 14, 17, 21 and the Supplement to the Law.]. Lietuvos Respublikos Seimas. Available at: https://e-seimasx.lrs.lt/portal/legalAct/lt/TAD/51938be0d2771efbd239e318cbd5b26.

XV-106 Lietuvos Respublikos informacinės visuomenės paslaugų įstatymo Nr. X-614 1, 2, 23 straipsnių ir priedo pakeitimo įstatymas. [XV-106 Law of the Republic of Lithuania on the Amendment of Articles 1, 2, 23 and the Annex to the Law on Information Society Services No. X-614.]. Teisės Aktų Registras. Available at: https://www.e-tar.lt/portal/legalAct.html?documentId=e351b770d88811efa5ddd96c482819f5.

860 Dėl Lietuvos Respublikos technologijų ir inovacijų įstatymo Nr. XIII-1414 1, 2, 11, 13, 14, 17, 21 straipsnių pakeitimo ir įstatymo papildymo priedu įstatymo projekto ir Lietuvos Respublikos informacinės visuomenės paslaugų įstatymo Nr. X-614 1, 2, 23 straipsnių ir priedo pakeitimo įstatymo projekto pateikimo Lietuvos Respublikos Seimui. [860 On the draft law amending Articles 1, 2, 11, 13, 14, 17, 21 of the Law on Technology and Innovation of the Republic of Lithuania No. XIII-1414 and supplementing the law with an appendix, and on the draft law amending Articles 1, 2, 23 of the Law on Information Society Services 17, 21 of the Law on Technology and Innovation of the Republic of Lithuania and the draft law amending the Law on Information Society Services of the Republic of Lithuania No. X-614, Articles 1, 2, 23 and the annex to the Law on the submission of the draft law to the Seimas of the Republic of Lithuania]. Teisės Aktų Registras. Available at: https://www.e-tar.lt/portal/lt/legalAct/ca88ddf38c7e11ef92b19bb92dd76d17.

Dėl Lietuvos Respublikos Vyriausybės 2018 m. spalio 3 d. nutarimo Nr. 982 „Dėl įgaliojimų suteikimo įgyvendinant Lietuvos Respublikos technologijų ir inovacijų įstatymą“ pakeitimo. [On the amendment of Resolution No. 982 of the Government of the Republic of Lithuania of October 3, 2018, "On the granting of powers for the implementation of the Law on Technology and Innovation of the Republic of Lithuania."]. Teisės Aktų Registras. Available at: https://www.e-tar.lt/portal/lt/legalAct/a6e431c20b9911f08e9f87c0d053bf09.

## Luxembourg

Commission Nationale pour la Protection des Données. (2024). Mise en œuvre nationale de l'« AI Act » : la CNPD désignée comme autorité compétente. [National implementation of the "AI Act": the CNPD designated as the competent authority.]. Commission Nationale pour la Protection des Données. Available at: https://cnpd public.lu/fr/actualites/national/2024/11/cnpd-ai-act.html.
Dossier législatif - Projet de loi 8476 portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689 – Dossier consolidé. [Legislative file - Draft law 8476 implementing certain provisions of Regulation (EU) 2024/1689.]. Chambre des députés du Grand-duché du Luxembourg. Available at: https://www.chd.lu/fr/dossier/8476.

Margue, E. (2024). Projet de loi 8476 portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689 – Dossier consolidé. [Draft law implementing certain provisions of Regulation (EU) 2024/1689 – Consolidated file.]. Chambre des députés du Grand-duché du Luxembourg. Available at: https://wdocs pub.chd.lu/docs/compilation/docpa/pdf/8476_Dossier_Complet.pdf.

## Malta

Act No. XIX of 2024 Malta Digital Innovation Authority (Amendment) Act. Parliament Ta'Malta. Available at: https://parlament.mt/media/128836/1-act-no-xix-online-version.pdf.

Brincat, K. (2025). Malta's Digital Innovation Authority 2.0 born. Times of Malta. Available at: https://timesofmalta.com/article/malta-digital-innovation-authority-20-born.1094607.

Information and Data Protection Commissioner. (2025). IDPC as FRA and MSA under the AI Act. Information and Data Protection Commissioner. Available at: https://idpc.org.mt/idpc-publications/idpc-as-fra-and-msa-under-the-ai-act/.

Legislativ Process - Act No. XIX of 2024 Malta Digital Innovation Authority (Amendment) Act. Parliament Ta'Malta. Available at: https://parlament.mt/en/14th-leg/acts act-xix-of-2024/.

Malta Digital Innovation Authority. Artificial Intelligence. Malta Digital Innovation Authority. Available at: https://mdia.gov.mt/services/artificial-intelligence/.

## Netherlands

Autoriteit Persoonsgegevens and Rijksinspectie Digitale Infrastructuur. (2024). Final recommendation on supervision of AI: sector and centrally coordinated. Autoriteit Persoonsgegevens. Available at: https://autoriteitpersoonsgegevens.nl/en/current/final-recommendation-on-supervision-of-ai-sector-and-centrally-coordinated.

Autoriteit Persoonsgegevens and Rijksinspectie Digitale Infrastructuur. (2024). Second (interim) advice on supervisory structure AI Act. Autoriteit Persoonsgegevens. Available at: https://autoriteitpersoonsgegevens.nl/en/documents/second-interim-advice-on-supervisory-structure-ai-act.

Autoriteit Persoonsgegevens. (2024). AP and RDI: Supervision of AI systems requires cooperation and must be arranged quickly. Autoriteit Persoonsgegevens. Available at: https://autoriteitpersoonsgegevens.nl/en/current/ap-and-rdi-supervision-of-ai-systems-requires-cooperation-and-must-be-arranged-quickly.

## Poland

Ministerstwo Cyfryzacji. (2025). Projekt Ustawy o systemach sztucznej inteligencji ze zmianami po konsultacjach społecznych. [Draft Act on Artificial Intelligence Systems with amendments following public consultation.] Ministerstwo Cyfryzacji. Available at: https://www.gov.pl/web/cyfryzacja/projekt-ustawy-o-systemach-sztucznej-inteligencji-ze-zmianami-po-konsultacjach-społecznych.

Rządowy Proces Legislacyjny - Projekt ustawy o systemach sztucznej inteligencji. [Government Legislative Process - Draft Act on Artificial Intelligence Systems.] Rządowe Centrum Legislacji. Available at: https://legislacja.gov.pl/projekt/12390551.

UC71 Projekt ustawy o systemach sztucznej inteligencji. [Draft bill on artificial intelligence systems.] Kancelaria Prezesa Rady Ministrów. Available at: https://www.gov.pl/web/premier/projekt-ustawy-o-systemach-sztucznej-inteligencji.

## Portugal

Processo legislativo - Projeto de Resolução 725/XVI/1 Pela criação da Agência Portuguesa para a Inteligência Artificial (APIA, I.P.). [Legislative Process - Draft Resolution 725/XVI/1 For the creation of the Portuguese Agency for Artificial Intelligence (APIA, I.P.).] Assembleia da República. Available at: https://www.parlamento.pt/ActividadeParlamentar/Paginas/DetalheIniciati va.aspx?BID=314842.

Processo legislativo - Projeto de Resolução 771/XVI/1 Para uma Estratégia Nacional de Inteligência Artificial. [Legislative Process - Draft Resolution 771/XVI/1 For a National Artificial Intelligence Strategy.] Assembleia da República. Available at: https://www.parlamento.pt/ActividadeParlamentar/Paginas/DetalheIniciati va.aspx?BID=314923.

Projeto de Resolução 725/XVI/1 Pela criação da Agência Portuguesa para a Inteligência Artificial (APIA, I.P.). [Draft Resolution 725/XVI/1 For the creation of the Portuguese Agency for Artificial Intelligence (APIA, I.P.).] Assembleia da República. Available at: https://app.parlamento.pt/webutils/docs/doc.pdf?path=MkIaJXFg%252fx HFRUQwfoCElkOWgbfCr%252fOFLdNqFGBVXpfWrotGKdw5oHR 8Je0MAe%252fRztw%252bH3tlTmSJ%252foQrXCe9tkIP%252bre1ze0 65PxYcL6G Gy8hKhtXD9TbZJFh151EaRtc5Pfr0yUT%252fCfFb2etY4 MJxcgRDBosdfv89QdxgTCLNx4OK0uEkXhVZ89DWZxieckKm69yA3t LRL32prFAtiS9ObrAeIwBHFMM%252b4uPbG5DxRTw9q2ujdTBuG %252fLBRBnxhejNb%252b5NISHQ6CrvonuGjVE67%252bI5fpMPiQq 7sBnyk%252b0EDMAneV031p892jY%252fpaAj%252fk0q5Bed3M4Ce b0m4ELalYw%252fKOKUDxtDcZa7O9%252f2Ma4o%253d&fich=75f0 d63d-896a-400c-a0e-8-cc08863f7da.docx&Inline=true.

Projeto de Resolução 771/XVI/1 Para uma Estratégia Nacional de Inteligência Artificial. [Draft Resolution 771/XVI/1 For a National Artificial Intelligence Strategy.] Assembleia da República. Available at: https://app.parlamento.pt/webutils/docs/doc.pdf?path=pu0dXVxPh065tFJ oqU2xno%252fGpJ3dAZ18MUMOOiZG3dLnWaO%252bUXsF0U%2 52fTwE6fdPdwIan%252b2R41b8jxDdQnDxJPmK54HsF0K463dUAd 2w6n95x6r6qPU9YtPVYKbH2SuMk8P66mwQF00EqFiAQ%252fyFsSj 78f8Q0H4Pm8GC%252bbVx95PGEWXt44ctbYJYMjwRY0IdAe90YFC %252bqhisZRrHFtbIkt7S8M8rUxdw29xIGW2p9tDhDlLnGdPwMnP0% 252bjBL%252fciUzQNsumfP9yA%252fEFDKeAhRy20yRVaBqg7Lhm TXRW4j3KN6HP8wvoDSuH3AoiKiD4OQvNmgLV6HIFqMU88ck5GG 8LFmz2Cek5mvITsKJlI0o%253d&fich=f1f4d06c-64f8-4602-80d3- 8fab3e3c1e1b1.docx&Inline=true.

## Romania

Cadru strategic pentru adoptarea și utilizarea de tehnologii innovative în administrația publică 2021 – 2027. [Strategic framework for the adoption and use of innovative technologies in public administration 2021-2027.]. Autoritatea pentru Digitalizarea României. Available at: https://www.adr.gov.ro/cadru-strategic-pentru-adoptarea-si-utilizarea-de- tehnologii-innovative-in-administratia-publica-2021-2027-solutii-pentru- eficientizarea-activitatii-cod-sipoca-704-cod-mysmis-2014/.

Peia, N. Inteligența artificială între progres și responsabilitate! O necesitate legislativă pentru România! [Artificial intelligence between progress and responsibility! A legislative necessity for Romania!]. România Senat. Available at: https://www.senat.ro/StiriSenatDetaliu.aspx?ID=2C20DCB2-31F7-4804-B633-568E9A0A962B.

Proces legislativ - L140/2025 Propunere legislativă privind utilizarea responsabilă a inteligentei artificiale. [Legislative Process - Legislative proposal on the responsible use of artificial intelligence.] România Senat. Available at: https://www.senat.ro/Legis/Lista.aspx?cod=26759&pos=0&NR=b114&A N=2025.

Propunere legislativă privind utilizarea responsabilă a inteligentei artificiale. [Legislative proposal on the responsible use of artificial intelligence.] România Senat. Available at: https://www.senat.ro/POZE/2025/4/4/2c20dcb2-31F7-4804-b633- 568e9a0a962b/Proiect%20de%20lege%20A.I.pdf.

## Slovakia

Legislatívny proces - PI/2025/2 Návrh zákona, ktorým sa upravujú inštitucionálne podmienky, pôsobnosť orgánov, práva a povinnosti subjektov v súvislosti s využívaním systémov umelej inteligencie. [Legislative process - PI/2025/2 Draft law regulating institutional conditions, powers of authorities, rights and obligations of entities in relation to the use of artificial intelligence systems.] Slov-Lex. Available at: https://www.slov-lex.sk/elegislativa/legislativne- procesy/SK/PI/2025/2.

## Slovenia

Ministrstvo za digitalno preobrazbo. (2025). Predlog predpisa zakon o izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci. [Draft regulation implementing regulation (EU) on harmonised rules on artificial intelligence.] Republika Slovenija eUprava. Available at: https://e-uprava.gov.si/si/drzava-in-druzba/e-demokracija/predlogi- predpisov/predlog-predpisa.html?id=17671&lang=si.
Spain

PDF - Anteproyecto de ley para el buen uso y la gobernanza de la inteligencia artificial. [PDF - Draft bill on the proper use and governance of artificial intelligence]. Ministerio para la Transformación Digital y de la Función Pública. Available at: https://avance.digital.gob.es/_layouts/15/HttpHandlerParticipacionPublicaAnexos.ashx?k=19128.

Ley 22/2021, de 28 de diciembre, de Presupuestos Generales del Estado para el año 2022 (Bloque 289). [Law 22/2021, of December 28, on the General State Budget for 2022 (Block 289)]. Agencia Estatal Boletín Oficial del Estado. Available at: https://www.boe.es/buscar/act.php?id=BOE-A-2021-21653.

Sweden

Bird and Bird. (2025) AI Regulatory Horizon Tracker – Sweden. Bird and Bird. Available at: https://www.twobirds.com/en/capabilities/artificial-intelligence/ai-legal-services/ai-regulatory-horizon-tracker/sweden.
# Appendix

## Appendix 1 - Table of key governance institutions under the AI Act.

<table><thead><tr><th colspan="4">EU level</th></tr><tr><th>Name</th><th>References in AI Act</th><th>Composition</th><th>Function</th></tr></thead><tbody><tr><td>AI Office</td><td>Art. 64</td><td>Directorate-General for Communications Networks, Content and Technology (DG CONNECT) staff</td><td><strong>Oversees the implementation of the AI Act and supervises GPAI models and systems</strong><br>The AI Office is a function of the Commission, responsible for the coherent implementation and enforcement of the AI Act and supervising GPAI models and systems. It cooperates closely with EU bodies and agencies, member states and their national competent authorities, and stakeholders. In addition, it operates at a supra-regional level, engaging with third countries and international organisations on AI-related matters.</td></tr><tr><td>AI Board</td><td>Art. 65 & 66</td><td>1 representative per member state, appointed by each state for a 3-year term (renewable once)<br>Observers:<ul><li>European Data Protection Supervisor</li><li>AI Office</li></ul>Invited:<ul><li>National and EU authorities, bodies, or experts</li></ul>Two permanent subgroups are established within the Board</td><td><strong>Ensures coherent implementation and enforcement of the AI Act and coordination among national competent authorities</strong><br>The AI Board ensures consistent implementation and enforcement of the AI Act by fostering cooperation among national competent authorities and facilitating the harmonisation of practices and the exchange of expertise across the EU.</td></tr><tr><td>Advisory Forum</td><td>Art. 67</td><td><ul><li>Stakeholders from industry, start-ups, SMEs, civil society and academia appointed by the Commission for a 2-year term (renewable, max. 4 additional years)</li></ul>Permanent members:<ul><li>Fundamental Rights Agency</li><li>ENISA</li><li>European Committee for Standardization</li><li>European Committee for Electrotechnical Standardization</li><li>European Telecommunications Standards Institute</li></ul></td><td><strong>Provides advice and support to the Commission and AI Board to ensure appropriate implementation of the AI Act</strong><br>The Advisory Forum provides technical expertise and support to the AI Board and the Commission, preparing opinions, contributions and recommendations at their request. It enables various stakeholders to participate in the implementation of the AI Act and the governance of AI.</td></tr><tr><td>Scientific Panel of Independence Experts</td><td>Art. 68 & 69</td><td>Up to 60 experts with scientific or technical expertise in the field of AI, selected by the Commission for a 2-year term (renewable)</td><td><strong>Provides scientific and technical expertise to the AI Office and national competent authorities</strong><br>The Scientific Panel provides scientific and technical expertise to the AI Office – particularly regarding the oversight of GPAI models – and to national competent authorities. The latter may call upon its experts to provide support in the exercise of their enforcement activities.</td></tr></tbody></table>

<table><thead><tr><th colspan="4">National level</th></tr><tr><th>Name</th><th>References in AI Act</th><th>Designation</th><th>Function</th></tr></thead><tbody><tr><td>State Representative</td><td>Art. 65</td><td>Appointed by member states for a 3-year term (renewable once)<br>One per member state</td><td><strong>Represents member states on the AI Board and ensures coordination among national competent authorities</strong><br>A representative designated by a member state to sit on the AI Board and facilitate coordination of national competent authorities within their respective state.</td></tr><tr><td>Authorities Protecting Fundamental Rights</td><td>Art. 77</td><td>Identified by member states</td><td><strong>Oversees compliance of high-risk AI systems with EU law protecting fundamental rights</strong><br>National public authorities or bodies responsible for supervising and enforcing the respect of obligations under EU law protecting fundamental rights in relation to the use of high-risk AI systems referred to in Annex III of the AI Act.</td></tr><tr><td>Notifying Authority</td><td>Art. 28 & 70</td><td>Designated or created by member states<br>At least 1 per member states</td><td><strong>Organises and supervises the conformity assessment ecosystem</strong><br>An independent and impartial public entity responsible for setting up and carrying out the procedures for the assessment, designation, notification and monitoring of conformity assessment bodies.</td></tr><tr><td>Notified Body</td><td>Art. 29 to 39</td><td>Conformity assessment body notified by a notifying authority</td><td><strong>Performs conformity assessment activities</strong><br>An independent conformity assessment body – notified by a notifying authority – entitled to perform conformity assessment activities on high-risk AI systems to certify whether they meet the AI Act’s requirements before entering the market.</td></tr><tr><td>Market Surveillance Authority</td><td>Art. 70, 72 to 76 & 85</td><td>Designated or created by member states<br>At least 1 per member states</td><td><strong>Market surveillance</strong><br>An independent and impartial public entity responsible for enforcing the AI Act at national level, overseeing AI systems on the market, investigating non-compliance, and handling complaints and incident reports.</td></tr><tr><td>Single Point of Contact</td><td>Art.70(2)</td><td>Designated by member states<br>One per member states, if multiple market surveillance authorities are designated</td><td><strong>Coordination</strong><br>A market surveillance authority designated to act as the main contact point for the public and other counterparts at national and Union levels. It ensures effective coordination among national competent authorities and with their counterparts in other member states.</td></tr></tbody></table>
<figure><img src="image_13.png" /><figcaption>**Appendix 2** - Chart indicating AI governance architecture at EU level.</figcaption></figure>
<figure><img src="image_14.png" /><figcaption>**Appendix 3** - Chart indicating AI governance architecture at national level.</figcaption></figure>
<table><caption>Appendix 4 - Table on the adoption of national implementation laws as of 23 July 2025.<fnref n="60" /></caption><thead><tr><th rowspan="2">Member State</th><th colspan="3">NATIONAL IMPLEMENTATION LAWS</th></tr><tr><th>Status of National Implementation Laws</th><th>Regulatory Process Stage</th><th>National Implementation Laws (Title & Link)</th></tr></thead><tbody><tr><td>Austria</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr><tr><td>Belgium</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr><tr><td>Bulgaria</td><td>Draft Bill Available</td><td>Submitted for Public Consultation</td><td>Проект закон за използването и развитието на изкуствения интелект</td></tr><tr><td>Croatia</td><td>No Draft Bill Publicly Available</td><td>Inter-ministerial Consultation</td><td>/</td></tr><tr><td>Cyprus</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr><tr><td>Czech Republic</td><td>No Draft Bill Publicly Available</td><td>Draft in Preparation</td><td>/</td></tr><tr><td>Denmark</td><td>Bill Adopted</td><td>Adopted by Parliament</td><td>Lov nr 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens</td></tr><tr><td>Estonia</td><td>No Draft Bill Publicly Available</td><td>Inter-ministerial Consultation</td><td>/</td></tr><tr><td>Finland</td><td>Draft Bill Available</td><td>Submitted to Parliament</td><td>Hallituksen esitys eduskunnalle EU:n tekoälyasetusta täydentäväksi lainsäädännöksi (HE 46/2025 vp)</td></tr><tr><td>France</td><td>No Draft Bill Publicly Available</td><td>Inter-ministerial Consultation</td><td>/</td></tr><tr><td>Germany</td><td>Draft Bill Available</td><td>Draft in Preparation</td><td>Referententenwurf des Bundesministeriums für Wirtschaft und Klimaschutz und des Bundesministeriums der Justiz (Gesetz zur Durchführung der KI-Verordnung)</td></tr><tr><td>Greece</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr><tr><td>Hungary</td><td>No Draft Bill Publicly Available</td><td>Draft in Preparation</td><td>/</td></tr><tr><td>Ireland</td><td>No Draft Bill Publicly Available</td><td>Draft in Preparation</td><td>/</td></tr><tr><td>Italy</td><td>Draft Bill Available</td><td>Inter-Chamber Review</td><td>Disposizioni e deleghe al Governo in materia di intelligenza artificiale</td></tr><tr><td>Latvia</td><td>No Draft Bill Publicly Available</td><td>Draft in Preparation</td><td>/</td></tr><tr><td>Lithuania</td><td>Bill Adopted</td><td>Adopted by Parliament</td><td>Lietuvos X-614 Respublikos informacinės visuomenės paslaugu įstatymas<br>Lietuvos XIII-1414 Respublikos technologijų ir inovacijų įstatymo</td></tr><tr><td>Luxembourg</td><td>Draft Bill Available</td><td>First Reading</td><td>Projet de loi portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689</td></tr><tr><td>Malta</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr><tr><td>Netherlands</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr><tr><td>Poland</td><td>Draft Bill Available</td><td>Submitted for Public Consultation</td><td>Projekt ustawy o systemach sztucznej inteligencji</td></tr><tr><td>Portugal</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr><tr><td>Romania</td><td>Draft Bill Available</td><td>Second Reading</td><td>Propunere legislativă privind utilizarea responsabilă a inteligentei artificiale</td></tr><tr><td>Slovakia</td><td>No Draft Bill Publicly Available</td><td>Draft in Preparation</td><td>/</td></tr><tr><td>Slovenia</td><td>Draft Bill Available</td><td>Submitted for Public Consultation</td><td>Zakono izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci</td></tr><tr><td>Spain</td><td>Draft Bill Available</td><td>Submitted for Public Consultation</td><td>Anteproyecto de Ley para el buen uso y la gobernanza de la inteligencia artificial [PDF]</td></tr><tr><td>Sweden</td><td>No Draft Bill Publicly Available</td><td>No Information Publicly Available</td><td>/</td></tr></tbody></table>

<footnote n="60">⁶⁰ This appendix will be revised as further time pass.</footnote>
<table><caption>Appendix 5 - Table on the designation of notifying authorities as of 23 July 2025.<fnref n="61" /></caption><thead><tr><td>Member State</td><td>Status of NA Designation</td><td>Number of NAs</td><td>Notifying Authorities (Name & Link)</td><td>Notifying Authorities (Name & Link in English)</td><td>Source (Title & Link)</td></tr></thead><tbody><tr><td>Austria</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Belgium</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Bulgaria</td><td>Proposed</td><td>1</td><td>Министър на електронното управление</td><td>Minister for eGovernment</td><td>Проект закон за използването и развитието на изкуствения интелект</td></tr><tr><td>Croatia</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Cyprus</td><td>Announced</td><td>1</td><td>Επίτροπος Επικοινωνιών</td><td>Commissioner of Communications</td><td>Statement by the Deputy Minister for Research, Innovation and Digital Policy on the approval by the Council of Ministers of the designation of NCAs and the creation of a specialised national committee on artificial intelligence (AI Taskforce)</td></tr><tr><td>Czech Republic</td><td>Proposed</td><td>1</td><td>Úrad pro technickou normalizaci, metrologií a státní zkušebnictví (UNMZ)</td><td>Czech Office for Standards, Metrology and Testing</td><td>71/25 Návrh implementace Aktu o umělé inteligenci v České republice; T:10.4.2025</td></tr><tr><td>Denmark</td><td>Designated</td><td>1</td><td>Digitaliseringsstyrelsen</td><td>Agency for Digital Government</td><td>Lov nr 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens</td></tr><tr><td>Estonia</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Finland</td><td>Proposed</td><td>4</td><td>Työ- ja elinkeinoministeriö Liikenne- ja viestintävirasto (Traficom) Lääkealan turvallisuus- ja kehittämiskeskus (Fimea) Sosiaali- ja terveysministeriö</td><td>Ministry of Economic Affairs and Employment of Finland Finnish Transport and Communications Agency (Traficom) Finnish Medicines Agency (Fimea) Ministry of Social Affairs and Health</td><td>Hallituksen esitys HE 46/2025 vp Hallituksen esitys eduskunnalle EU:n tekoälyasetusta täydentäväksi lainsäädännöksi</td></tr><tr><td>France</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Germany</td><td>Proposed</td><td>2</td><td>Bundesnetzagentur für Elektrizität, Gas, Telekommunikation, Post und Eisenbahnen (BNetzA) Deutschen Akkreditierungsstelle (DAkkS) + Extension of the competences of the NAs already designated under Union harmonisation legislation (Annex I)</td><td>Federal Network Agency for Electricity, Gas, Telecommunications, Post, and Railways (BNetzA) German Accreditation Body (DAkkS) + Extension of the competences of the NAs already designated under Union harmonisation legislation (Annex I)</td><td>Referententenwurf des Bundesministeriums für Wirtschaft und Klimaschutz und des Bundesministeriums der Justiz (Gesetz zur Durchführung der KI-Verordnung)</td></tr><tr><td>Greece</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Hungary</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Ireland</td><td>Proposed</td><td>4</td><td>Minister for Enterprise, Tourism and Employment Minister for Transport Commission for Communications Regulation Health Products Regulatory Authority</td><td>Minister for Enterprise, Tourism and Employment Minister for Transport Commission for Communications Regulation Health Products Regulatory Authority</td><td>Government approval of roadmap for implementing the EU AI Act Ministerial question - Questions (370), July 8th, 2025</td></tr><tr><td>Italy</td><td>Proposed</td><td>1</td><td>Agenzia per l'Italia digitale (AgID)</td><td>Agency for Digital Italy</td><td>Disposizioni e deleghe al Governo in materia di intelligenza artificiala</td></tr><tr><td>Latvia</td><td>Proposed</td><td>1</td><td>Ekonomikas ministrija (EM)</td><td>Ministry of Economics</td><td>Advisory Report by the Ministry for Smart Administration and Regional Development (VARAM) on the Implementation of the Requirements of the EU AI Act</td></tr><tr><td>Lithuania</td><td>Designated</td><td>1</td><td>Inovaciju agentūros</td><td>Innovation Agency of Lithuania</td><td>Lietuvos XIII-1414 Respublikos technologijų ir inovaciju įstatymo</td></tr><tr><td>Luxembourg</td><td>Proposed</td><td>3</td><td>Office luxembourggeois d'accréditation et de surveillance - OLAS Agence luxembourgoise des médicaments et des produits de santé - ALMPS Commissariat du Gouvernement à la Protection des Données auprès de l'État - CGPD</td><td>Luxembourg Accreditation and Surveillance Office Luxembourg Agency for Medicines and Health Products Government Commissioner's Office</td><td>Projet de loi portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689</td></tr><tr><td>Malta</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr></tbody></table>

<footnote n="61">⁶¹ This appendix will be revised as further time pass.</footnote>
<table><tr><td>Netherlands</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Poland</td><td>Proposed</td><td>1</td><td>Ministerstwo Cyfryzacji</td><td>Ministry of Digital Affairs</td><td>Projekt ustawy o systemach sztucznej inteligencji</td></tr><tr><td>Portugal</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Romania</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Slovakia</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Slovenia</td><td>Proposed</td><td>4</td><td>Ministrstvo, pristojno za trg<br>Ministrstvo, pristojno za infrastrukturo<br>Ministrstvo, pristojno za zdravje<br>Ministrstva, pristojnega za informacijsko družbo</td><td>Ministry responsible for the market<br>Ministry of infrastructure<br>Ministry of Health<br>Ministry of Digital Transformation</td><td>Zakono izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci</td></tr><tr><td>Spain</td><td>Proposed</td><td>1</td><td>Secretaría de Estado de Digitalización e Inteligencia Artificial: Dirección General de Inteligencia Artificial</td><td>Secretariat of State for Digitalisation and Artificial Intelligence: Directorate-General for Artificial Intelligence</td><td>Anteproyecto de ley para el buen uso y la gobernanza de la inteligencia artificial [PDF]</td></tr><tr><td>Sweden</td><td>No NA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr></table>
<table><caption>Appendix 6 - Table on the designation of market surveillance authorities as of 23 July 2025.<fnref n="62" /></caption><thead><tr><th>Member State</th><th>Status of MSA Designation</th><th>Number of MSAs</th><th>Market Surveillance Authorities (Name & Link)</th><th>Market Surveillance Authorities (Name & Link in English)</th><th>Source (Title & Link)</th></tr></thead><tbody><tr><td>Austria</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Belgium</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Bulgaria</td><td>Proposed</td><td>7</td><td>Комисия за финансов надзор<br>Българска народна банка<br>Изпълнителна агенция<br>„Медицински надзор“<br>Съвет за електронни медиции - СЕМ<br>Изпълнителна агенция<br>„Автомobilна администрация“<br>Комисия за защита на личните данни<br>Комисия за регулиране на съобщенията</td><td>Financial Supervisory Commission<br>Bulgarian National Bank<br>Executive Agency "Medical Supervision"<br>Council for Electronic Media<br>Executive Agency "Road Transport Administration"<br>Commission for Personal Data Protection<br>Communications Regulation Commission</td><td>Проект закон за използването и развитието на изкуствения интелект</td></tr><tr><td>Croatia</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Cyprus</td><td>Announced</td><td>2</td><td>Επίτροκος Ελικονωνιών<br>Графείο Επιτρόκου Λεδομένων<br>Προσωπικού Χαρακτήρα</td><td>Commissioner of Communications<br>Commissioner for Personal Data Protection</td><td>Statement by the Deputy Minister for Research, Innovation and Digital Policy on the approval by the Council of Ministers of the designation of NCAs and the creation of a specialised national committee on artificial intelligence (AI Taskforce)</td></tr><tr><td>Czech Republic</td><td>Proposed</td><td>1</td><td>Český telekomunikační úřad</td><td>Czech Telecommunications Office</td><td>Proposal for the implementation of the Act on Artificial Intelligence in the Czech Republic</td></tr><tr><td>Denmark</td><td>Designated</td><td>3</td><td>Digitaliseringsstyrelsen<br>Datatilsynet<br>Domsstolsstyrelsen</td><td>Agency for Digital Government<br>Danish Data Protection Authority<br>Danish Court Administration</td><td>Lov nr 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens</td></tr><tr><td>Estonia</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Finland</td><td>Proposed</td><td>10</td><td>Turvallisuus- ja kemikaalivirasto (TUKES)<br>Tulli<br>Liikenne- ja viestintävirasto (Traficom)<br>Työsuojeluviranomainen<br>Lääkealan turvallisuus- ja kehittämiskeskus (Fimea)<br>Energiavirasto<br>Tietosuojavaltuutettu<br>Sosiaali- ja terveysalan lupa- ja valvontavirasto (Valvira)<br>Finanssivalvonta (FIN-FSA)<br>Lounais-Suomen aluehallintovirasto</td><td>Finnish Safety and Chemicals Agency (Tukes)<br>Finnish Customs<br>Finnish Transport and Communications Agency (Traficom)<br>Occupational Safety and Health Administration in Finland<br>Finnish Medicines Agency (Fimea)<br>Energy Authority<br>Office of the Data Protection Ombudsman<br>National Supervisory Authority for Welfare and Health (Valvira)<br>Financial Supervisory Authority (FIN-FSA)<br>Regional State Administrative Agency for Southwestern Finland</td><td>Hallituksen esitys HE 46/2025<br>vp Hallituksen esitys<br>eduskunnalle EU:n tekoälyasetusta täydentäväksi<br>lainsäädännöksi</td></tr><tr><td>France</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Germany</td><td>Proposed</td><td>2</td><td>Bundesnetzagentur für Elektrizität, Gas, Telekommunikation, Post und Eisenbahnen (BNetzA)<br>Unabhangige Marktübeiwachungskammer (UKIM)<br>+ Extension of the competences of the MSAs already designated under Union harmonisation legislation (Annex I) and those regulating financial institutions.</td><td>Federal Network Agency for Electricity, Gas, Telecommunications, Post, and Railways (BNetzA)<br>Independent Market Surveillance Chamber (UKIM)<br>+ Extension of the competences of the MSAs already designated under Union harmonisation legislation (Annex I) and those regulating financial institutions.</td><td>Referententwurf des Bundesministeriums für Wirtschaft und Klimaschutz und des Bundesministeriums der Justiz (Gesetz zur Durchführung der KI-Verordnung)</td></tr><tr><td>Greece</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Hungary</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr></tbody></table>

<footnote n="62">⁶² This appendix will be revised as further time pass.</footnote>
<table><tr><td>Ireland</td><td>Proposed</td><td>8</td><td>Central Bank of Ireland (Not confirmed in the Minister's answer to the Parliamentary question)<br>Commission for Communications Regulation<br>Commission for Railway Regulation<br>Competition and Consumer Protection Commission<br>Data Protection Commission<br>Health and Safety Authority<br>Health Products Regulatory Authority<br>Marine Survey Office of the Department of Transport</td><td>Central Bank of Ireland (Not confirmed in the Minister's answer to the Parliamentary question)<br>Commission for Communications Regulation<br>Commission for Railway Regulation<br>Competition and Consumer Protection Commission<br>Data Protection Commission<br>Health and Safety Authority<br>Health Products Regulatory Authority<br>Marine Survey Office of the Department of Transport</td><td>Government approval of roadmap for implementing the EU AI Act<br>Ministerial question - Questions (370), July 8th, 2025</td></tr><tr><td>Italy</td><td>Proposed</td><td>1</td><td>Agenzia per la cybersicurezza nazionale (ACN)<br>+ Maintains the roles of the Bank of Italy, the Italian Securities and Exchange Commission (CONSOB), and the Insurance Supervisory Authority (IVASS) as MSAs</td><td>National Cybersecurity Agency (ACN)<br>+ Maintains the roles of the Bank of Italy, the Italian Securities and Exchange Commission (CONSOB), and the Insurance Supervisory Authority (IVASS) as MSAs</td><td>Disposizioni e deleghe al Governo in materia di intelligenza artificiale</td></tr><tr><td>Latvia</td><td>Proposed</td><td>13</td><td>Patērētāju tiesību aizsardzības centrās (PTAC)<br>Veselības inspekcija - VI Valsts aģentūra "Civilās aviācijas aģentūra" (VA CAA)<br>Valsts sabiedrība ar ierobežotu atbildību "Latvijas Jūras administrācija" (VSIA LJA)<br>Valsts dzelzceļa tehniskā inspekcija<br>Valsts tehniskās uzraudzības aģentūra (VTUA)<br>Valsts akciju sabiedrība "Celu satiksmes drošības direkcija" (VSA CSDD)<br>Izglītības kvalitātes valsts dienests<br>Datu valsts inspekcija (DVI)<br>Valsts drošības dienests (VDD)<br>Militārās izlūkošanas un drošības dienests (MIDD)<br>Satversmes aizsardzības birojs (SAB)<br>Latvijas Banka</td><td>Consumer Rights Protection Centre<br>Health Inspectorate<br>State Agency "Civil Aviation Agency"<br>State Limited Liability Company "Latvian Maritime Administration"<br>State Railway Technical Inspectorate<br>State Technical Supervision Agency<br>State Joint Stock Company "Road Traffic Safety Directorate"<br>State Education Quality Service<br>Data State Inspectorate<br>Latvian State Security Service<br>Defence Intelligence and Security Service<br>Constitutional Protection Bureau<br>Bank of Latvia</td><td>Annexe 3 - Advisory Report by the Ministry for Smart Administration and Regional Development (VARAM) on the Implementation of the Requirements of the EU AI Act</td></tr><tr><td>Lithuania</td><td>Designated</td><td>1</td><td>Lietuvos Respublikos ryšių reguliavimo tarnyba (RRT)</td><td>Communications Regulatory Authority of the Republic of Lithuania (RRT)</td><td>Lietuvos X-614 Respublikos informacinišs visuomenės paslaugų įstatymas</td></tr><tr><td>Luxembourg</td><td>Proposed</td><td>8</td><td>Commission nationale pour la protection des données Autorité de Contrôle Judiciaire<br>Commission de surveillance du secteur financier - CSSF<br>Commissariat aux assurances - CAA<br>Institut luxembourgeois de la normalisation, de l'accréditation, de la sécurité et qualité des produits et services - ILNAS<br>Institut luxembourgeois de régulation - ILR<br>Agence luxembourgeoise des médicaments et produits de santé Autorité luxembourgeoise indépendante de l'audiovisuel - ALIA</td><td>National Commission for Data Protection<br>Judicial Supervisory Authority<br>Financial Sector Supervisory Commission (CSSF)<br>Luxembourg Insurance Supervisory Authority (CAA)<br>Luxembourg Institute of Standardization, Accreditation, Safety and Quality of Products and Services (ILNAS)<br>Luxembourg Regulatory Institute (ILR)<br>Luxembourg Agency for Medicines and Health Products Luxembourg Independent Audiovisual Authority (ALIA)</td><td>Projet de loi portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689</td></tr><tr><td>Malta</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Netherlands</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Poland</td><td>Proposed</td><td>1</td><td>Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji</td><td>Commission for the Development and Security of Artificial Intelligence</td><td>Projekt ustawy o systemach sztucznej inteligencji</td></tr><tr><td>Portugal</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Romania</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Slovakia</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Slovenia</td><td>Proposed</td><td>5</td><td>Agencija za komunikacijska omrežja in storitve Republike Slovenije (AKOS)<br>Informacijski pooblaščeneč (IP RS)<br>Banka Slovenije<br>Agencija za zavarovalni nadzor in (AZN)<br>Tržni inšpektorat Republike Slovenije</td><td>Agency for Communication Networks and Services of the Republic of Slovenia (AKOS)<br>Information Commissioner of the Republic of Slovenia (IP RS)<br>Bank of Slovenia Insurance Supervision Agency (AZN)<br>Market Inspectorate of the Republic of Slovenia</td><td>Zakono izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci</td></tr></table>
<table><tr><td>Spain</td><td>Proposed</td><td>8</td><td>Agencia Española de Supervisión de Inteligencia Artificial (AESIA)<br>Agencia Española de Protección de Datos (AEDP)<br>Autoridades autonómicas de protección de datos<br>Banco de España<br>Comisión Nacional de Mercados y Valores (CNMV)<br>Dirección General de Seguros y Fondos de Pensiones<br>Dirección de Supervisión y Control de Protección de Datos - Consejo General del Poder Judicial<br>Junta Electoral Central</td><td>Spanish Agency for the Supervision of Artificial Intelligence (AESIA)<br>Spanish Data Protection Agency (AEPD)<br>Regional data protection authorities<br>Bank of Spain<br>National Securities Market Commission (CNMV)<br>Directorate General for Insurance and Pension Funds<br>Directorate for Data Protection<br>Supervision and Control (General Council of the Judiciary)<br>Central Electoral Commission</td><td>Anteproyecto de ley para el buen uso y la gobernanza de la inteligencia artificial [PDF]</td></tr><tr><td>Sweden</td><td>No MSA Proposed</td><td>0</td><td>/</td><td>/</td><td>/</td></tr></table>
<table><caption>Appendix 7 - Table on the designation of single point of contact as of 23 July 2025.<fnref n="63" /></caption><thead><tr><td>Member State</td><td>Status of Single Point of Contact Designation</td><td>Single Point of Contact (Name & Link)</td><td>Single Point of Contact (Name & Link in English)</td><td>Source (Title & Link)</td></tr></thead><tbody><tr><td>Austria</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Belgium</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Bulgaria</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Croatia</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Cyprus</td><td>Announced</td><td>Επίτροπος Επικοινωνιών</td><td>Commissioner of Communications</td><td>Statement by the Deputy Minister for Research, Innovation and Digital Policy on the approval by the Council of Ministers of the designation of NCAs and the creation of a specialised national committee on artificial intelligence (AI Taskforce)</td></tr><tr><td>Czech Republic</td><td>Proposed</td><td>Český telekomunikační úřad</td><td>Czech Telecommunications Office</td><td>Proposal for the implementation of the Act on Artificial Intelligence in the Czech Republic</td></tr><tr><td>Denmark</td><td>Designated</td><td>Digitaliseringsstyrelsen</td><td>Agency for Digital Government</td><td>Lov nr 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens</td></tr><tr><td>Estonia</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Finland</td><td>Proposed</td><td>Liikenne- ja viestintävirasto (Traficom)</td><td>Finnish Transport and Communications Agency (Traficom)</td><td>Hallituksen esitys HE 46/2025 vp Hallituksen esitys eduskunnalle EU:n tekoälyasetusta täydentäväksi lainsäädännöksi</td></tr><tr><td>France</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Germany</td><td>Proposed</td><td>Bundesnetzagentur für Elektrizität, Gas, Telekommunikation, Post und Eisenbahnen (BNetzA)</td><td>Federal Network Agency for Electricity, Gas, Telecommunications, Post, and Railways (BNetzA)</td><td>Referententwurf des Bundesministeriums für Wirtschaft und Klimaschutz und des Bundesministeriums der Justiz (Gesetz zur Durchführung der KI-Verordnung)</td></tr><tr><td>Greece</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Hungary</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Ireland</td><td>Proposed</td><td>Unnamed New Authority (interim assumed by Minister for Enterprise, Tourism and Employment)</td><td>Unnamed New Authority (interim assumed by Minister for Enterprise, Tourism and Employment)</td><td>Ministerial question - Questions (370), July 8th, 2025</td></tr><tr><td>Italy</td><td>Proposed</td><td>Agenzia per la cybersicurezza nazionale (ACN)</td><td>National Cybersecurity Agency</td><td>Disposizioni e deleghe al Governo in materia di intelligenza artificiale</td></tr><tr><td>Latvia</td><td>Proposed</td><td>Patārētāju tiesību aizsardzības centrs (PTAC)</td><td>Consumer Rights Protection Centre</td><td>Advisory Report by the Ministry for Smart Administration and Regional Development (PARAM) on the Implementation of the Requirements of the EU AI Act</td></tr><tr><td>Lithuania</td><td>Designated</td><td>Lietuvos Respublikos ryšiu reguliavimo tarnyba (RRT)</td><td>Communications Regulatory Authority of the Republic of Lithuania (RRT)</td><td>Lietuvos X-614 Respublikos informacinės visuomenės paslaugų įstatymas</td></tr><tr><td>Luxembourg</td><td>Proposed</td><td>Commission nationale pour la protection des données</td><td>National Commission for Data Protection</td><td>Projet de loi portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689</td></tr><tr><td>Malta</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Netherlands</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Poland</td><td>Proposed</td><td>Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji</td><td>Commission for the Development and Security of Artificial Intelligence</td><td>Projekt ustawy o systemach sztucznej inteligencji</td></tr><tr><td>Portugal</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Romania</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Slovakia</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr><tr><td>Slovenia</td><td>Proposed</td><td>Agencija za komunikacijska omrežja in storitve Republike Slovenije (AKOS)</td><td>Agency for Communication, Networks and Services of the Republic of Slovenia</td><td>Zakono izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci</td></tr><tr><td>Spain</td><td>Proposed</td><td>Agencia Española de Supervisión de Inteligencia Artificial (AESIA)</td><td>Spanish Agency for Supervision of Artificial Intelligence</td><td>Anteproyecto de ley para el buen uso y la gobernanza de la inteligencia artificial [PDF]</td></tr><tr><td>Sweden</td><td>No SPoC Proposed</td><td>/</td><td>/</td><td>/</td></tr></tbody></table>

<footnote n="63">⁶³ This appendix will be revised as further time pass.</footnote>
<figure><img src="image_15.png" /></figure>

Shadée Pinto is a Research Fellow with the AI-Regulation Team, specialising in international law and digital regulation.

Her research primarily addresses the international regulation and governance of artificial intelligence, with a particular emphasis on security, ethical dimensions and geopolitical dynamics.

The cover image was generated using ChatGPT and further edited with Adobe Photoshop.

To cite this article: Pinto, S. (2025). *Who Oversees AI in the EU? The Designation of National Competent Authorities under the EU AI Act*. AI-Regulation Papers 25-10-4. [AI-Regulation.com](https://AI-Regulation.com).

These statements are attributable only to the author, and their publication here does not necessarily reflect the view of the other members of the AI-Regulation Chair or any partner organisations.

This work has been partially supported by MIAI @ Grenoble Alpes, (ANR-19-P3IA-0003) and by the Interdisciplinary Project on Privacy (IPoP) of the Cybersecurity PEPR (ANR 22-PECY-0002 IPOP).