A hospital group in Bulgaria buying a triage tool, a bank in Belgium running a credit-scoring model, a recruiter in Hungary screening CVs: none of them has a national regulator to answer to. Sixteen of the European Union’s 27 member states have yet to designate an authority to enforce the bloc’s artificial intelligence law, the European Commission confirmed on November 10, more than a year after the deadline for doing so.
Austria, Belgium, Bulgaria, Croatia, Slovakia and Hungary have named no body at all. Ten other countries have taken only provisional decisions that still require formal adoption. The Commission’s tally leaves well over half the single market without a supervisor for the AI Act, the regulation that governs how automated systems are built, sold and monitored across Europe.
The deadline was August 2, 2025. Each government was required to appoint at least one market surveillance authority, the national body that inspects products, handles complaints and opens investigations. The first major enforcement provisions took effect in August 2026, which means companies in much of the bloc now carry obligations that no one at home is checking.
Under the law, those national bodies are meant to handle the overwhelming majority of AI systems: hiring software, medical devices, credit models, industrial robots, exam graders, customer-service chatbots. The Commission’s AI Office in Brussels covers only general-purpose models, the foundation systems sold by a handful of large developers. Everything else falls to the member states.
The penalties are not small. The most serious breaches carry fines of up to 35 million euros or 7% of global annual turnover, whichever is higher. Other violations reach 15 million euros or 3%. A company that markets a prohibited system in a country with no designated authority faces the same legal exposure as one in France or Germany, but with no clear counterpart to notify, no published guidance and no predictable inspection regime.
Officials in several capitals describe a common set of obstacles. Enforcement of the AI Act has landed on agencies already stretched by data-protection work, competition cases and telecom rules, and the technical staff who can read a model card or audit a training set are scarce. In some countries two or three regulators are still arguing over who holds the mandate. In others the appointment needs a parliamentary vote that has been crowded out by budget fights.
The delay is not confined to small administrations. Belgium hosts the European institutions and still has no permanent authority. Austria, with a well-developed tech sector and an active data-protection regulator, has named none. Hungary, which has taken a vocal line on technology sovereignty, is in the same position as the six.
For companies, the practical result is a patchwork. A developer selling the same system in 27 markets may face 12 functioning supervisors, a dozen interim arrangements and several blank spaces. Groups that advise manufacturers say clients are asking whether a conformity assessment signed in one country will be honored in another where no authority exists to challenge or confirm it. Nobody can answer with confidence.
Consumer and civil-liberties groups have begun to fill the vacuum with complaints and litigation, filing cases in national courts where regulators are absent. That route is slower and more expensive than an administrative investigation, and it depends on plaintiffs who can prove harm from a system they often cannot see.
Brussels retains a blunt instrument. The Commission can open infringement proceedings against governments that fail to notify designations, a process that can end at the Court of Justice of the European Union and, eventually, in financial penalties. Officials have said the tool exists for exactly this situation. They have not said when they will use it, and launching cases against 16 governments at once would consume political capital the Commission has been husbanding for other fights.
The timing is awkward for another reason. Leaders of the 27 member states meet in Dublin on Friday, in the first summit-level session given over entirely to artificial intelligence. The agenda is expected to cover compute capacity, energy for data centers and Europe’s dependence on American models. Enforcement capacity, the unglamorous machinery that decides whether any of those promises are kept, sits lower on the list.
Some of the missing authorities will appear in the coming months. Budget cycles turn, coalitions settle, and the embarrassment of being named in a Commission table tends to concentrate minds. The harder question is what kind of authorities they will be: independent regulators with their own technical staff, or small units folded into ministries that also promote the industry they are supposed to police.
That choice will shape how the AI Act is felt in practice far more than the text of the regulation. A law enforced by promoters reads differently from one enforced by skeptics, and Europe is about to run both experiments at once. The first test cases, whenever they arrive, will come from whichever countries moved first, and their decisions will set the tone for everyone still deciding what their new office is for.
