National Competent Authorities for the EU AI Act: Who Enforces in Your Country

Posted on Oct 20 • Originally published at charz.ai • AI-assisted

Originally published at https://charz.ai/blog/national-competent-authorities-ai-act by Char-Z AI.

What Are National Competent Authorities Under the EU AI Act?

National competent authorities are the bodies each EU member state designates to supervise and enforce the EU AI Act within its territory (European Commission, 2024). While the AI Office at the European Commission handles cross-border and systemic-risk GPAI models, most day-to-day enforcement — market surveillance, complaints, and sanctions for individual high-risk systems — falls to these national authorities. Under the Act's governance structure, every member state must designate at least one notifying authority and one market surveillance authority by August 2, 2025.

The enforcement architecture is deliberately layered. The European Commission's impact assessment noted that a central authority alone could not practically supervise thousands of AI systems deployed across 27 member states, which is why the Act assigns territorial enforcement to national bodies while reserving GPAI oversight for the AI Office (European Commission, 2024). The AI Office, operational since July 2025, added the first GPAI and systemic-risk enforcement powers in August 2025.

How the Enforcement Architecture Is Split

GPAI + systemic-risk models — body AI Office (European Commission) — scope cross-border, EU-wide.

High-risk system conformity — notifying authority — designates conformity assessment bodies.

Market surveillance — national market surveillance authority — products placed on national market.

Complaints + sanctions — national competent authority — local complaints and penalties.

Fundamental rights advice — monitoring authorities / national bodies — civil-society and rights oversight.

The practical consequence: even organizations operating entirely cross-border will interact first with their national authority, not the AI Office. A company based in France deploying a high-risk AI system fields enforcement from the French authority; a company in Germany deals with the German body. The AI Office only steps in for GPAI foundation models and systemic risks that span national borders.

The AI Act's enforcement powers arrive on a staggered schedule, and national authorities' responsibilities follow the same phasing (European Commission, 2026):

August 2, 2025 — Designation of national authorities; prohibitions, transparency obligations, and GPAI obligations begin (governance groundwork)

December 2, 2026 — New prohibitions (Art. 5 additions) + watermarking/transparency grace period ends

December 2, 2027 — High-risk Annex III obligations (rescheduled by the Digital Omnibus) begin

August 2, 2028 — High-risk Annex I (safety-component) products begin

August 2, 2030 — Remaining high-risk obligations (public sector) begin

National authorities will enforce these in waves. During the current pre-high-risk window, their focus is on the Art. 5 prohibitions, transparency (Art. 50), and GPAI obligations that are already in force.

To identify your authority, determine three things:

Your role. Are you a provider (developing/deploying your own model), a deployer (using a third-party system), an importer, or a distributor? Each role has distinct obligations and a distinct relationship with the authority.

Your member state. You answer to the authority of the member state where you are established, or — if you are established outside the EU — the member state where your AI system is first placed on the market or put into service.

Your system type. If you deploy a general-purpose AI foundation model, the AI Office may be your primary point of contact regardless of your national authority.

Treat the national authority as your primary regulator. Practical steps to prepare:

Maintain technical documentation. Article 11 high-risk documentation must be ready for inspection. For most companies this means a current AI system inventory plus per-system technical files (European Commission, 2024).

Designate a responsible contact. Appoint a name and role that the authority can reach — many member states require or expect an internal point of contact for AI oversight.

Log complaints and incidents. National authorities handle complaints from the public and other authorities. A documented incident and complaint log demonstrates a working risk management system.

Watch for authority-specific guidance. While the Act is harmonized, member states issue local practical guidance, registration requirements, and digital contact points. Check your authority's portal regularly.

Alongside enforcement authorities, member states designate independent monitoring authorities that protect fundamental rights — often aligned with data protection authorities or human-rights bodies. They handle rights-related complaints about AI systems, including bias and discrimination concerns. Where a complaint implicates both data protection (GDPR) and AI risk, you may interact with both the national DPA and the AI monitoring authority.