What it is
The EU AI Act is a regulation, which means it applies directly in all member states without each country passing its own version into domestic law. But a regulation still needs enforcers. The “national implementation layer” is the term of art for the authorities each of the 27 member states must designate, staff, and empower to actually apply the Act — the officials who will receive complaints, inspect systems, and levy fines, as opposed to the text of the law itself.
The Act requires each member state to designate at least two kinds of body. A notifying authority sets up and oversees the conformity-assessment process that high-risk AI systems must pass before reaching the market — it designates and supervises the independent “notified bodies” that do the actual technical evaluation. A market surveillance authority is the day-to-day regulator: it monitors AI systems once they are in use, handles complaints, demands documentation, and can impose penalties. Collectively these are called “national competent authorities.” Member states must also identify which existing bodies — data protection authorities, equality bodies, sectoral regulators — will act as “fundamental rights protection authorities,” with powers to be notified of serious incidents and request information from the market surveillance authority.
Countries have taken sharply different approaches to this design choice. Cyprus centralized everything in a single body, its Commissioner of Communications, acting as notifying authority, market surveillance authority, and single point of contact at once. Germany split the roles, naming its Federal Accreditation Body as notifying authority and its Federal Network Agency as market surveillance authority. Finland went further toward decentralization, distributing market surveillance across existing sectoral regulators — transport, energy, medicines — rather than creating anything new.
Why it matters for AI governance and narratives
This is the layer where the Act’s credibility is actually tested. A regulation that exists only as treaty text has no practical bite; it acquires one only when a named office, with a budget and a phone number, can open an investigation. The gap between the Act’s August 2025 deadline for designating these authorities and the slow pace of actual designations — well into 2026, still fewer than half of member states had fully staffed both roles — has become its own narrative thread: critics citing it as evidence that European AI regulation is long on ambition and short on capacity, defenders noting that deployers’ legal obligations run directly from the Regulation regardless of whether a national office exists yet to enforce them.
The uneven rollout also feeds a broader contest over whether EU AI governance is becoming more centralized or more fragmented. A November 2025 “digital omnibus” proposal would expand the EU-level AI Office’s own supervisory reach over AI systems embedded in major online platforms — a move toward centralization that some read as compensating for the slow, uneven national layer beneath it. For actors skeptical of the Act generally, the implementation gap is evidence the law is unworkable as designed; for the Commission, it is a transitional problem being actively managed. How this layer fills in — and who ends up actually holding enforcement power, Brussels or 27 separate national offices — will shape how much authority the Act has in practice, independent of what it says on paper.
Key facts and dates
Member states faced an August 2, 2025 deadline to establish and empower both a market surveillance authority and a notifying authority; an earlier November 2, 2024 deadline required publishing lists of fundamental rights protection authorities, which all 27 states met. The market-surveillance deadline fared worse: trackers in early-to-mid 2026 counted roughly 8 to 9 of 27 member states with both authorities fully designated, a dozen or so with partial or pending designations, and several with none yet in place (exact counts vary slightly by tracker and update date). At EU level, the European Commission’s AI Office is the sole enforcer of rules governing general-purpose AI models, while enforcement of AI systems generally is decentralized to the national layer — a hybrid structure that European Parliament researchers have flagged as a source of likely uneven enforcement across the bloc.
Where to learn more
- AI Act National Implementation Plans — artificialintelligenceact.eu — running tracker of each member state’s designated authorities and status
- AI Act Governance and Enforcement — European Commission, Digital Strategy — primary source on the EU-level and national governance structure
- Enforcement of the AI Act — European Parliamentary Research Service, March 2026 — parliamentary briefing on implementation status and the centralization debate
- Article 70 — Designation of National Competent Authorities, AI Act text — the statutory provision itself