Who enforces the EU AI Act?

How it works

The basic split is between AI systems and GPAI models

The AI Act separates enforcement by object. For AI systems, the default model is national market surveillance. For GPAI models, the Commission has exclusive supervision and enforcement under Chapter V through the AI Office. That means the first question is not "which country am I in?" but "am I dealing with a regulated AI system, a GPAI model, or both?"

There is also a hybrid category. Where an AI system is based on a GPAI model and the same provider developed both the model and the system, Article 75 already gives the AI Office an exceptional direct supervisory role over that system. So even before the Omnibus, some system-level cases are already partly centralised.

What national authorities do

At Member State level, market surveillance authorities supervise and enforce the AI Act's rules for AI systems. Their powers are broad. They can investigate, carry out remote monitoring, access documentation, datasets and source code, propose joint investigations with the Commission, request corrective measures and support penalty enforcement under national law. They are also the main complaint destination for natural and legal persons who believe the AI Act has been infringed.

Separate from that, notifying authorities designate and supervise notified bodies. Those notified bodies are the independent conformity-assessment bodies involved in pre-market assessment for the AI systems that need them. In other words, notifying authorities and notified bodies are not the same thing as market surveillance authorities, even though they are part of the same wider enforcement architecture.

As of 21 July 2026, the public designation picture is plainly incomplete. The Commission's market-surveillance page was last updated on 26 September 2025, says it is updated continuously, and still leaves many countries blank. On that page, named single points of contact appear for Italy, Latvia, Lithuania and Ireland. Luxembourg, Slovenia and Spain are shown with an asterisk, meaning the national designation decision is still pending final adoption on the Commission's own presentation. A Cyprus line appears, but the public rendering is malformed. The following countries still show no public entry on that Commission page: Austria, Belgium, Bulgaria, Croatia, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia and Sweden. That does not prove those states failed to designate nationally. It does prove the Commission's public list is not a definitive live map.

This is the practical lesson: use the Commission page as a starting point, not as conclusive evidence that a country has or has not designated every authority it needs under the AI Act.

What the AI Office does now

The AI Office was created inside the Commission to support implementation of the Act, especially around GPAI. For GPAI models, it is not just a helpdesk. It is the central supervisor and enforcer. The Commission's own materials are explicit that the AI Office supervises and enforces GPAI obligations, and that providers of GPAI models with systemic risk must notify the AI Office.

The current AI Act also gives the AI Office two system-level functions that are easy to miss. First, where the same provider built both the GPAI model and the AI system based on it, the AI Office can monitor and supervise that AI system directly. Second, if a national market surveillance authority cannot finish a high-risk investigation because it cannot access model-layer information, it can request the AI Office to enforce that access and supply the relevant information.

The timing inside this central track is staggered. GPAI obligations have applied since 2 August 2025. But the Commission's formal enforcement powers with fines apply from 2 August 2026. That is why July 2026 is a transition moment: the AI Office already matters, but its coercive fine-backed Chapter V enforcement is about to become much sharper.

What the adopted Omnibus would add

At run time, the Digital Omnibus on AI had been adopted by Parliament and Council and signed, but the OEIL file still showed the procedure as completed and awaiting publication in the Official Journal. So the Omnibus should be treated as adopted law awaiting publication, not as a political deal, and not yet as law in force.

If and when it enters into force, the Omnibus does two different things that matter here. First, it changes several dates, especially for high-risk AI systems and sandboxes. Second, it strengthens the AI Office's centralised enforcement track for certain GPAI-based systems by inserting Articles 75a to 75d.

Those new Articles 75a to 75d matter because they operationalise direct AI Office system-level enforcement. They set out investigation powers, information requests, remote and on-site inspections, commitments, non-compliance decisions, fines, periodic penalty payments, defence rights, access-to-file rules and publication of decisions for operators falling within Article 75(1). In plain English, the AI Office would move from having an exceptional supervisory hook over certain GPAI-based systems to having a much more explicit and procedurally complete enforcement toolkit for them.

On the timing side, the dual track is essential. Under the AI Act currently in force, 2 August 2026 still formally remains the main application date for most remaining rules, including market surveillance and Article 50 transparency, while Article 6(1) product-linked high-risk obligations apply from 2 August 2027. If the Omnibus enters into force before then, the stand-alone Annex III high-risk obligations move to 2 December 2027, Annex I embedded-product high-risk obligations move to 2 August 2028, and the national sandbox deadline moves to 2 August 2027. By contrast, the Omnibus does not move the already-applicable prohibitions, Article 4 AI literacy, or the GPAI rules.

The Board, the Scientific Panel and the EDPS are part of the machinery too

The European Artificial Intelligence Board is the coordination body made up of Member State representatives. It is supported by the AI Office, which acts as the Board's secretariat. Its job is not to replace enforcers, but to help them work consistently across the Union, exchange expertise and contribute to guidelines, delegated acts, implementing acts and practical coordination.

The Scientific Panel is different again. It is a technical advisory body of independent experts. Its role is especially important around GPAI, systemic-risk alerts, evaluation methodologies and support for the Commission and, where relevant, national authorities. In enforcement terms, it is part of the evidence and expert-support layer, not the final decision-maker.

The EDPS has a special place. For EU institutions, bodies, offices and agencies, the EDPS is the market surveillance authority under the AI Act. So if an AI system is used inside the EU administration rather than in a Member State's own public sector or private market, the national-market-surveillance model does not apply in the same way. The EDPS is the regulator in that institutional space.

What changes on 2 August 2026

Under the AI Act currently in force, 2 August 2026 is when most remaining system-level provisions become applicable. That includes Article 50 transparency, registration mechanics under Article 49 for Annex III systems, market surveillance machinery, remedies such as the complaint route, and the broad section of high-risk obligations that is not already postponed to 2 August 2027 by current Article 113.

It is also the date when Commission enforcement of GPAI obligations with fines starts. So from that point the institutional picture is much easier to state. National market surveillance authorities become the normal AI-system enforcers across the Member States, while the Commission, through the AI Office, becomes the fine-backed enforcer for GPAI models.

If the Omnibus enters into force before that date, the big change is not who enforces GPAI. It is that some of the national system-level deadlines move back for high-risk categories and sandboxes, while Article 50 transparency still stays on 2 August 2026. That is one reason why organisations should track law-in-force status, not just consultation or policy pages.

Complaints, reports and practical contact routes

For most AI-system infringements, the practical complaint route is the relevant national market surveillance authority. The AI Act gives any natural or legal person the right to lodge a complaint where they have grounds to consider that the Act has been infringed. If a case also engages privacy, equality, labour, consumer or other fundamental-rights law, the national authority protecting those rights may gain additional cooperation and information powers under the AI Act, but that does not automatically make it the primary AI Act enforcer.

For GPAI models, the reporting route is different. Providers have to deal directly with the AI Office. The Commission's GPAI guidance says providers should use EU SEND to submit documents such as systemic-risk notifications, reassessment requests and serious-incident reports for GPAI models with systemic risk.

For general questions, the AI Act Service Desk is useful. But it is a support and information route, not a substitute for the competent authority. For formal complaints about AI systems, the operative route is still the competent market surveillance authority, or the EDPS for EU institutions, with the AI Office taking the lead in the GPAI lane.

The guidance landscape is growing but uneven. Earlier Commission guidance already exists on prohibited practices and on what counts as an AI system. GPAI guidance and the GPAI Code of Practice have been in place since July 2025. On 20 July 2026 the Commission adopted Article 50 transparency guidelines ahead of the 2 August 2026 transparency date. Draft high-risk classification guidance is still under consultation until 23 July 2026. That means the enforcement architecture is ahead of some of the detailed compliance guidance, especially on the high-risk side.