Skip to content

EU Member States — AI Regulatory Implementation

Overview

Section titled “Overview”

The EU AI Act is a directly applicable Regulation and does not require Member State transposition. But work at the Member State level happens along three dimensions:

  1. Designation of national competent authorities (AI Act Article 70) — market-surveillance authorities (MSAs) + notified bodies.
  2. National AI legislation (supplementary to, not replacing, the AI Act).
  3. DPA (data protection authority) enforcement of GDPR as applied to AI.

By the deadline of 2025-07-10, only 3 of the 27 Member States (Lithuania, Luxembourg, Malta) had completed the designation of AI Act competent authorities. Major jurisdictions including Germany, France, Italy, Spain, and Austria had not; this is one of the main reasons behind the Digital Omnibus proposal’s suggested delay.

Collected

Section titled “Collected”

Early-mover / dedicated AI authorities

Section titled “Early-mover / dedicated AI authorities”
  • Spain — AESIA — the EU’s first dedicated AI regulator, operational 2024-06, issuing 16 compliance guidance documents in 2024-12.

DPA-led AI oversight

Section titled “DPA-led AI oversight”
  • France — CNIL AI — France’s most active line of AI × GDPR regulation; 12+ guidance documents since 2023, two key recommendations in 2025-02.

National implementation legislation

Section titled “National implementation legislation”

May–June 2026 DPA practice

Section titled “May–June 2026 DPA practice”
  • Italy’s Garante decision of 14 May examined an AI-supported workplace wellbeing system and stressed model reliability, representative data, explainability, effective human control and the danger of opaque inferences. It found no specific employer-side GDPR responsibility on the evidence before it. This is an application of existing data-protection law, not a new AI Act sanction.

Primary source: Italian Garante, 14 May 2026.

Comparison with non-EU neighbours

Section titled “Comparison with non-EU neighbours”
  • UK: AI Safety Institute (2023), a pro-innovation non-legislative approach.
  • Norway / Switzerland: follow the EU AI Act with adjustments on specifics.
  • Ukraine / Western Balkans: EU-candidate states aligning to the AI Act.