Preparing for enforcement: A Guide to the EU AI Act's market surveillance authorities

Member State (or EEA Member)[1]

(Designated/Expected) Market surveillance authorities

Austria

Not yet announced.

In preparation for the implementation of the AI Regulation, an AI service centre has been set up within RTR GmbH to serve as a point of contact and information hub on AI.[2]

The data protection authority is responsible for data protection issues relating to AI systems.[3]

Belgium

Not yet announced.

The federal government has appointed an “Advisory Committee on Ethics in Data and Artificial Intelligence”.[4]

Bulgaria

Not yet announced.

Croatia

Not yet announced.

Cyprus

Not yet announced.

Czech Republic

Not yet announced.

Denmark

The Danish Agency for Digitisation (Digitaliseringsstyrelsen) has been appointed as the national supervisory authority and single point of contact in Denmark. Further market surveillance authorities may be appointed by the Minister of Digitalization.[5]

Estonia

Not yet announced.

Finland

The final government draft for an “Act on the Supervision of Certain Artificial Intelligence Systems and Amendments to Related Act is estimated to be presented in week 19/2025”.[6]

In the initial draft from October 2024, the Finnish Transport and Communications Agency was assigned as the single point of contact.

The Finnish Data Protection Agency will act as the market surveillance authority for prohibited AI practices.[7]

France

Not yet announced.

The “Commission Nationale de l’Informatique et des Libertés” (CNIL) advocates that it be designated as market surveillance authority.[8]

Germany

Not yet announced.

In the first draft of the AI Implementation Act, the German Federal Network Agency (Bundesnetzagentur) was designated as the competent market surveillance authority. German data protection authorities, however, are also keen to take on responsibility in the supervision of AI.

It is not clear whether the newly elected government will build upon this first draft. The coalition contract of the newly elected government only stipulates that the national implementation of the AI Act should be innovation-friendly and avoid red tape and that market supervision shall not be fragmented.[9]

Greece

Not yet announced.

The Ministry of Digital Governance is active in publishing information on the AI Act and its implementation.[10]

Hungary

Not yet announced.

Iceland (EEA)1

Not yet announced.

Ireland

Ireland has adopted a distributed model of implementation of the AI Act and has designated eight public institutions as competent authorities:

• Central Bank of Ireland
• Commission for Communications Regulation
• Commission for Railway Regulation
• Competition and Consumer Protection Commission
• Data Protection Commission
• Health and Safety Authority
• Health Products Regulatory Authority
• Marine Survey Office of the Department of Transport

Further authorities as well as a lead regulator coordinating the enforcement of the AI Act will be designated.[11]

Italy

Not yet announced.

The Italian government proposed to designate the National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale) as market surveillance authority.[12]

Latvia

Latvia has introduced several authorities for the implementation and supervision of the AI Act:[13]

• Ministry of Smart Administration and Regional Development (VARAM) as designated responsible authority for the implementation of the AI Act as a whole
• Ministry of Economy as notifying authority
• Latvian National Accreditation Bureau as national accreditation body
• Market surveillance will be carried out by:
  • the Consumer Rights Protection Centre,
  • the Health Inspectorate,
  • the State Agency "Civil Aviation Agency",
  • the Latvian Maritime Administration,
  • the State Railway Technical Inspectorate,
  • the State Technical Supervision Agency,
  • the Road Traffic Safety Directorate,
  • the State Service for Quality of Education,
  • the State Data Inspectorate,
  • the State Security Service,
  • the Military Intelligence and Security Service,
  • the Office for Constitutional Protection,
  • the State Data Inspectorate for prohibited AI practices and high-risk AI systems and
  • the Bank of Latvia for AI systems on the market that are operated or used by financial institutions under the supervision of the Bank of Latvia.

Liechtenstein (EEA)1

Not yet announced.

Lithuania

Lithuania has designated the following notifying and market surveillance authorities:[14]

• The Innovation Agency as the national notifying authority
• The Communications Regulatory Authority as the market surveillance authority and single point of contact

Luxembourg

The National Commission for Data Protection (Commission Nationale Pour la protection des données (CNPD)) () is the designated competent authority and will be the single point of contact, national coordinator of competent authorities and default market surveillance authority (supervision of AI systems in Annex III of the Regulation and AI systems that do not fall within the competence of sectoral authorities).[15]

Malta

Malta has designated Malta Digital Innovation Authority (MDIA) and Information Data Protection Commission as joint market surveillance authorities.[16]

The Netherlands

The Dutch Authority for Digital Infrastructure and the Dutch Data Protection Authority advocate that they be designated as joint market surveillance authority.[17]

The Dutch Data Protection Authority is already active in the field and is, for example, collecting feedback to AI literacy by Dutch companies.

Norway (EEA)1

Norway has designated the following notifying and market surveillance authorities:[18]

• Norsk akkreditiering (NA) as national accreditation body for technical accreditation
• Norwegian Communications Authority (Nkom) as the national coordinating supervisory authority for AI

In addition, the Norwegian government has created AI Norway as a national expert environment within the Norwegian Digitalisation Agency (Digdir) for innovative and responsible artificial intelligence.

Poland

Poland is planning to introduce a new market surveillance authority, called the “Commission for the Development and Safety of Artificial Intelligence”. The adoption of the proposal is planned for the second quarter of 2025.[19]

Portugal

Not yet announced.

Romania

Not yet announced.

Slovakia

Not yet announced.

Slovenia

Not yet announced.

Spain

The newly introduced Spanish Artificial Intelligence Supervisory Agency (Agencia Española de Supervisión de la Inteligencia Artificial) (AESIA)) will act as the market surveillance authority for AI systems and the single point of contact. Established in September 2023, AESIA is an autonomous agency of the Spanish Department of Digital Transformation.[20]

Sweden

Not yet announced.

The Swedish government has established an AI Commission “with the task of identifying the need for and proposing measures that can help to strengthen the development and use of artificial intelligence (AI) in Sweden in a sustainable and safe way.”[21]

EU

The European Data Protection Supervisory (EDPS) is appointed as the competent authority for supervision of EU institutions, bodies, offices and agencies.

Similarly, the EDPS will act as the market surveillance authority, notifying body and notifying authority of EU institutions that fall within the scope of the AI Act.[22]