Policy 10 min read

EU AI Act National Implementation Scorecard: Only 3 of 27 Member States Fully Ready

With the August 2026 high-risk deadline approaching, most EU member states have yet to designate their national AI Act enforcement authorities. Italy leads with a comprehensive national framework, while Germany and others lag behind. Our country-by-country tracker.

By Dr. Henri Dubois · Published

A Patchwork of Preparedness

The EU AI Act requires every member state to designate national competent authorities to oversee and enforce the regulation. The deadline for designating market surveillance and notifying authorities was August 2, 2025. Seven months later, the picture across Europe is concerning: only 3 of 27 member states have fully designated both types of authority, while 14 have yet to designate any.

This uneven implementation creates a significant challenge for companies operating across multiple EU markets. Compliance obligations apply uniformly, but the enforcement landscape — and the guidance available — varies dramatically from one member state to another.

Three Types of National Authorities

  1. Market Surveillance Authorities (MSAs): Responsible for post-market enforcement, monitoring compliance, investigating violations, and taking corrective action including fines
  2. Notifying Authorities: Responsible for pre-market oversight, specifically designating and monitoring conformity assessment bodies (Notified Bodies) that conduct third-party assessments of high-risk AI systems
  3. Fundamental Rights Protection Authorities: Ensuring high-risk AI systems respect fundamental rights, particularly when deployed by public bodies

Country-by-Country Breakdown

Leaders: Fully Operational

Italy — Most Advanced Implementation

Italy enacted Law No. 132/2025, which entered into force on October 10, 2025 — making it the first EU member state with a comprehensive national AI Act framework. Key features include AgID (Agency for Digital Italy) handling innovation promotion and conformity procedures, the National Cybersecurity Agency overseeing security enforcement and sanctions, sectoral regulators retaining sector-specific AI oversight powers, maximum fine of €774,685 and criminal offense with 1-5 years imprisonment for certain deepfake violations, and corporate liability measures including license suspension and public contract bans.

Spain — Single Agency Model

Spain established the Spanish Artificial Intelligence Supervisory Agency (AESIA) under the Department of Digital Transformation. AESIA serves as both market surveillance and notifying authority, creating a streamlined single-agency model that other member states are watching with interest.

Finland — First Active Enforcer

Finland activated its national supervision laws on January 1, 2026, becoming the first member state with fully operational enforcement powers. Finland's approach distributes oversight across existing sector regulators rather than creating a new central agency.

In Progress: Partial Implementation

Germany — Still in Draft

Germany missed the August 2025 designation deadline and is still working through its legislative process. The KI-Marktüberwachungsgesetz- und Innovationsförderungsgesetz (KI-MIG) designates the Federal Network Agency (Bundesnetzagentur/BNetzA) as the main market surveillance authority. The law is still pending parliamentary approval.

France

France has appointed CNIL (the data protection authority) as a key actor in AI Act enforcement, leveraging its existing data governance expertise. However, the full institutional framework — particularly for notifying authority functions — is still being finalized.

Netherlands

The Netherlands has been active in AI governance preparedness through its Algorithm Authority (Autoriteit Persoonsgegevens/AP), which has begun publishing guidance on AI Act obligations. Formal designation legislation is advancing but not yet complete.

Not Yet Designated: 14 Member States

A concerning 14 of 27 member states have not yet publicly designated any competent authority for AI Act enforcement. While some of these countries may have internal discussions underway, the lack of public designation creates a guidance vacuum for companies operating in those markets.

Recommendations

  • Don't wait for national guidance: Build your compliance program based on the AI Act text and EU-level guidance. National implementation details should be treated as supplementary, not foundational.
  • Monitor your key markets: If you operate primarily in one or two member states, track their specific implementation progress and engage with any public consultations.
  • Prepare for enforcement in leader countries: If you deploy AI systems in Italy, Spain, or Finland, assume active enforcement and ensure your compliance documentation is ready.
  • Engage with industry associations: National industry associations often have early insight into implementation plans.

Operating across multiple EU markets? Find consultants in our directory who specialize in cross-border AI Act compliance strategies.