“Who enforces the EU AI Act?” has no useful one-line answer. The route changes with the system, the actor, the Member State or Union institution involved, and the provision in question.
This map uses official sources checked from September 18 to 21, 2026. It helps a team find the authority it should research next. It does not classify a particular system or decide which obligations apply.
This article provides general operational education. It is not legal advice or a compliance determination. No attorney-client relationship exists, and none of its protections apply.
Read the amendment with the original act
Regulation (EU) 2024/1689 was adopted on June 13, 2024. Its original text entered into force on August 1, 2024 and set staged application dates.
Do not stop at that original version. EUR-Lex identifies a consolidated text dated July 27, 2026. It incorporates enacted changes for reading convenience. The July 2026 Digital Omnibus on AI was enacted as Regulation (EU) 2026/1744. It was published on July 24 and entered into force on July 27, 2026. It is not merely a proposal.
Use the consolidated text to locate the provision, then check the authentic acts published in the Official Journal. The consolidation itself has no legal effect. Keep later proposals separate from enacted law until they are adopted and in force.
The AI Office has a defined remit
The Commission's AI Office supports implementation and enforces rules for general-purpose AI models.
Current Article 75 gives the AI Office exclusive supervision and enforcement for 2 categories. The first covers certain systems based on general-purpose AI models from the same provider or undertaking, subject to listed exceptions.
The second covers systems that constitute or are integrated into designated very large online platforms or search engines. This competence applies to providers. It reaches deployers only when they are also the provider or belong to the same undertaking.
Use the authentic legal acts for the binding rule. Use the Commission page to locate the responsible institution and current implementation material.
The amendment also added Articles 75a through 75d. Those provisions give the AI Office tools for information requests and remote or on-site inspections. They also address sealing premises or records where the stated conditions are met, accepting binding commitments, and imposing periodic penalties. Article 75c caps a periodic penalty at 5 percent of average daily income or worldwide annual turnover for each day of delay. That figure describes the legal ceiling in the amended text; it does not predict an outcome in a particular case.
A periodic penalty is not a fine. It is a daily payment that compels a step, such as answering an information request or submitting to an inspection. Fines follow Article 99. Its ceiling for an undertaking is EUR 35 million or 7 percent of worldwide annual turnover for prohibited practices, whichever is higher. For the listed obligations of operators and notified bodies, the ceiling is EUR 15 million or 3 percent. A separate ceiling covers incorrect, incomplete, or misleading information supplied in reply to a request. It applies to replies to notified bodies or national competent authorities, and it is EUR 7.5 million or 1 percent. For SMEs, the lower of the two figures applies. Article 75c lets the AI Office apply those fine provisions within its Article 75 competence. Every figure here is a ceiling in the amended text. None predicts an outcome in a particular case.
National competent authorities
Member States designate one or more national competent authorities. These include market surveillance authorities and notifying authorities, with a single point of contact for the Regulation.
The Commission keeps a country list of market surveillance authorities and notes that it is updated continuously. Use that list as a route to the relevant current national source. Do not infer a country's appointment from an older article, a vendor summary, or another Member State's structure.
National authorities supervise and enforce rules for AI systems within their remit. The exact authority can depend on the system, sector, and national designation.
European Data Protection Supervisor
The European Data Protection Supervisor acts as market surveillance authority for Union institutions, bodies, offices, and agencies within the scope described by the Regulation. This role is different from supervising private organizations in a Member State.
AI Act work may also intersect with data protection, consumer protection, product safety, financial supervision, or sector-specific rules. The AI Act authority map does not replace those separate sources.
European AI Board and supporting bodies
The European Artificial Intelligence Board brings together Member State representatives and advises and assists the Commission and Member States. The AI Office provides its secretariat. Its role includes coordination and guidance; it is not a substitute for identifying the competent enforcement authority for a specific question.
The Regulation also provides for a scientific panel and an advisory forum. These bodies contribute expertise and stakeholder input. Their existence does not make them the default place to send every operational question.
Two questions this map cannot answer
This map locates an authority. It does not classify your system. It does not tell you whether a provision applies to a deployer in your Member State on your facts. Both answers depend on the consolidated text, the sector, and a qualified reading.
What the map does let a team do is stop guessing. For each AI workflow, keep a dated note of 6 things:
- the system and intended use;
- the actor being assessed: provider, deployer, importer, distributor, or other;
- the country, sector, and Union-institution context;
- the consolidated provision consulted and any amending act;
- the official authority page and the date checked; and
- the person responsible for obtaining qualified advice when the classification is uncertain.
Six lines in a register the team already maintains. When the next amendment is enacted, the note tells you what to reread. That is more useful than a timeline graphic, and it costs nothing.
The AI Inventory framework in Ortaire's AI Governance Toolkit keeps the use cases, systems, and vendors this note attaches to in 1 register.
Sources used
- Current consolidated Regulation (EU) 2024/1689, including Articles 75, 75c, and 99; consolidated July 27, 2026 and checked September 21, 2026.
- Regulation (EU) 2026/1744, adopted July 8, 2026, published July 24, 2026, and in force July 27, 2026; checked September 19, 2026.
- European Commission: enforcement of the AI Act, checked September 18, 2026.
- European Commission: national market surveillance authorities, checked September 18, 2026.
- European AI Board, checked September 18, 2026.
