The EU AI Act establishes a coordinated governance framework to ensure the effective enforcement and implementation of the Regulation. At the Union level, the AI Act establishes the AI Office, the AI Board, an Advisory Forum and a pool of independent experts (Chapter VII, Section 1). At the national level, Member States shall designate authorities to act as market surveillance authorities and notifying authorities for the purpose of supervising the application of the Regulation. National competent authorities play a critical role in the effective enforcement of the AI Act and are responsible for, inter alia, monitoring conformity assessment bodies (Article 28), enforcing the applicability of high-risk AI systems classification rule (Article 6), and receiving complaints for infringement of the AI Act (Article 85). Additionally, the AI Act also requires Member States to appoint existing national public authorities or bodies, such as data protection authorities or equality bodies, to act as “authorities protecting fundamental rights” under Article 77. In light of their critical role in the AI Act governance structure, Member States shall ensure that the designated authorities have sufficient technical and legal expertise and economic and material resources to effectively fulfil their mandate.
In this blog post, the editorial team of DigiCon wants to offer a comprehensive overview of the identity and tasks of national competent authorities designated by Member States. We are working to keep this information updated and we invite readers to send us missing information (you can contact us at submission@digi-con.org).
Market Surveillance Authorities
Definition:‘market surveillance authority’ means the national authority carrying out the activities and taking the measures pursuant to Regulation (EU) 2019/1020; (Article 3.26)
Core tasks:
– Enforce the high-risk classification rules in Article 6 (Article 80)
– Receive complaints on infringement of the Regulation (Article 85)
– Receive reporting of serious incidents (Article 73)
– Exercise their powers under Article 14 of Regulation (EU) 2019/1020
– Propose joint activities and investigations with the Commission (Article 74.11)
Deadline for designation: 2 August 2025
Note: For high risk AI systems listed in Annex I point 1 (biometrics), point 6 (law enforcement), point 7 (migration and asylum) and 8 (administration of justice), the market surveillance authority shall be either the competent data protection supervisory authority established under the GDPR or the Law Enforcement Directive (Article 74.9).
Notifying Authorities
Definition: ‘notifying authority’ means the national authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring” (Article 3.19)
Core tasks:
– Setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies (Article 28.1)
– Monitoring of conformity assessment bodies (Article 28.1)
Deadline for designation: 2 August 2025
Authorities Protecting Fundamental Rights
Core tasks:
– Supervision and enforcement of obligations under Union law to protect fundamental rights, including the right to non-discrimination, in relation to the use of high-risk AI systems (Article 70.1)
– Power to request and access any documentation created or maintained under the AI Act to fulfill their mandate (Article 70.2)
– Power to make a reasoned request to the market surveillance authority to organise testing of the AI system (Article 70.3)
Deadline for designation: 2 November 2024
List of Designated National Competent Authorities
| Country | Market Surveillance Authority | Notifying Authority | Authority Protecting Fundamental Rights |
| Austria | Full list here | ||
| Belgium | |||
| Bulgaria | |||
| Croatia | |||
| Cyprus | Full list here | ||
| Czechia | |||
| Denmark | Danish Agency for Digital Government | Not designated yet | Not clear |
| Estonia | |||
| Finland | 10 already existing market surveillance authorities (see here) and the Finnish Transport and Communications Agency will act as the single point of contact | ||
| France | Not designated yet | Not designated yet | |
| Germany | |||
| Greece | Hellenic Data Protection AuthorityGreek OmbudsmanHellenic Authority for Communication Security & PrivacyGreek National Commission for Human Rights(full list here) | ||
| Hungary | Minister responsible for Justice (as proposed 17. § here) | ||
| Ireland | Full list here | ||
| Italy | Agenzia per la Cybersicurezza Nazionale | Agenzia per l’Italia Digitale | Garante per la protezione dei dati Personali (proposal) |
| Latvia | |||
| Lithuania | Regulatory Communications Authority (pending implementing law) | Innovation Agency (pending implementing law) | Full list here |
| Luxemburg | |||
| Malta | MDIA and the IDPC (Information Data Protection Commission) | MDIA and the National Accreditation Board | Full list here |
| Netherlands | Full list here | ||
| Poland | The proposed establishment of a new body (see here): Komisja Rozwoju I Bezpieczeństwa Sztucznej Inteligencji; Commission for the Development and Security of Artificial Intelligence | Polskie Centrum Akredytacj; Polish Center for Accreditation (pending implementing law); | Full list here NB: no DPA or Ombudsman are listed |
| Portugal | Full list here | ||
| Romania | Full list here | ||
| Slovakia | |||
| Slovenia | |||
| Spain | Agencia Española de la Supervisión de la Inteligencia Artificial | ||
| Sweden | Full list here | ||
| EU | EDPS as Market Surveillance Authority of the European Union Institutions, Agencies and Bodies | European Data Protection Supervisor (EDPS)European OmbudsmanAuthority for European Political Parties and Political Foundations (APPF) |
Signatures
Francesca Palmiotto, chief editor at DigiCon and Assistant Professor at IE Law School
Sarah Tas, Assistant Professor Maastricht University
Natalia Menéndez, Research Associate at Centre for a Digital Society (European University Institute)
Alexandra Karaiskou, PhD researcher in Law at European University Institute
Sümeyye Elif Biber, University of Luxembourg, Head of Digital Rights at the Digital Constitutionalist
Maria Magierska, Senior Lecturer ECPC Maastricht, Doctoral Researcher with the European University Institute
Lucas Henrique Muniz da Conceição, PhD researcher in Legal Studies at Bocconi University, Head of Platform Governance at the Digital Constitutionalist
