The EU AI Act is not enforced from one Brussels inbox. For an AI system, you write to the market surveillance authority of the country where the system is on the market. For a general-purpose model, you write to the AI Office. This table is the Commission's own Single Point of Contact list, checked 2026-09-17 (Commission last updated 2026-09-07).
9 Member States named · 12 pending final adoption · 6 not named. Six blanks does not mean the duty paused; it means those rows on the Commission page are still a dash. Each country name opens a page written for that search: who enforces the AI Act in this country.
Which country, which authority, what status
| Country | ISO | Authority | Status |
|---|---|---|---|
| Austria | AT | — | not named |
| Belgium | BE | — | not named |
| Bulgaria | BG | — | not named |
| Croatia | HR | — | not named |
| Cyprus | CY | Επίτροπος Επικοινωνιών (Commissioner of Communications) | pending final adoption |
| Czechia | CZ | Český telekomunikační úřad (Czech Telecommunication Office) | pending final adoption |
| Denmark | DK | Digitaliseringsstyrelsen (Agency for Digital Government) | named |
| Estonia | EE | Tarbijakaitse ja Tehnilise Järelevalve Amet (Consumer Protection and Technical Regulatory Authority) | pending final adoption |
| Finland | FI | Traficom (Transport and Communications Agency) | named |
| France | FR | Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF) (Directorate General for Competition Policy, Consumer Affairs and Fraud Control) | pending final adoption |
| Germany | DE | Bundesnetzagentur (Federal Network Agency) | pending final adoption |
| Greece | GR | Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) | named |
| Hungary | HU | — | not named |
| Ireland | IE | Oifig IS na hÉireann (AI Office of Ireland) | named |
| Italy | IT | Agenzia per la cybersicurezza nazionale (National Cybersecurity Agency) | named |
| Latvia | LV | Patērētāju tiesību aizsardzības centrs (Consumer Rights Protection Centre) | named |
| Lithuania | LT | Lietuvos Respublikos ryšių reguliavimo tarnyba (Communications Regulatory Authority of the Republic of Lithuania) | named |
| Luxembourg | LU | Commission nationale pour la protection des données (National Commission for Data Protection) | pending final adoption |
| Malta | MT | L-Awtorità Maltija għall-Innovazzjoni Diġitali (Malta Digital Innovation Authority (MDIA)) | named |
| Netherlands | NL | Rijksinspectie Digitale Infrastructuur (Dutch Authority for Digital Infrastructure) | pending final adoption |
| Poland | PL | Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI) (Commission for the Development and Security of Artificial Intelligence) | named |
| Portugal | PT | ANACOM (National Regulatory Authority for Communications) | pending final adoption |
| Romania | RO | ANCOM (National Authority for Management and Regulation in Communications of Romania) | pending final adoption |
| Slovakia | SK | — | not named |
| Slovenia | SI | Agencija za komunikacijska omrežja in storitve Republike Slovenije (AKOS) (Agency for Communication Networks and Services of the Republic of Slovenia) | pending final adoption |
| Spain | ES | Agencia Española de Supervisión de Inteligencia Artificial (Spanish Artificial Intelligence Surveillance Agency) | pending final adoption |
| Sweden | SE | Post- och telestyrelsen (Swedish Post and Telecom Authority) | pending final adoption |
Union-level desks, not a Member State
| Scope | ISO | Authority | Status |
|---|---|---|---|
| EU institutions, bodies and agencies | EU | European Data Protection Supervisor (EDPS (market surveillance authority for the Union institutions)) | named |
| General-purpose AI models (all Member States) | GPAI | European AI Office (AI Office inside the European Commission — not a national desk) | named |
How to read the status column
- named — on the Commission list with no asterisk.
- pending final adoption — the Commission prints a name marked with an asterisk. The national designation is not final.
- not named — the Commission row is a dash. Do not invent a contact from a press release.
What this table is not
It is not the list of notifying authorities (those designate conformity-assessment bodies). It is not the list of fundamental-rights authorities under Article 77. It does not tell you whether your feature is high-risk. Pair it with the dated obligations table.
Primary sources
- Commission: Market Surveillance Authorities under the AI Act (SPOC register)
- Commission: enforcement framework
- EDPS as AI Act supervisor for Union institutions
Limits
This table is a dated copy of the Commission's Single Point of Contact register, checked on 2026-09-17 against a page the Commission last updated on 2026-09-07. It is not legal advice and it is not a substitute for the live register. A national law can name an authority before this list does. GPAI models are supervised by the AI Office regardless of which country your users sit in.