{
  "meta": {
    "buildDate": "2026-08-20",
    "note": "Designation status tracks whether a member state has designated the market surveillance authority that Article 70 of the AI Act requires. Designation and notification to the Commission are different steps: the European Parliamentary Research Service recorded eight of 27 member states as having notified a single point of contact as of March 2026, while more states than that have designated an authority in national law."
  },
  "authorities": [
    {
      "id": "ai-office",
      "name": "European AI Office",
      "short": "AI Office",
      "country": "EU",
      "type": "AI_OFFICE",
      "url": "https://digital-strategy.ec.europa.eu/en/policies/ai-office",
      "designation": "established",
      "designation_note": "Established inside DG CONNECT by Commission Decision of 24 January 2024. Enforcement toolkit fully applicable from 2 August 2026.",
      "mandate": "Exclusive competence over providers of general purpose AI models under Article 88, expanded by the Digital Omnibus to AI systems built on a general purpose model by the same provider and to AI in or constituting a very large online platform or search engine under the Digital Services Act.",
      "powers": [
        "Request information from providers under Article 91",
        "Evaluate models, including access to source code, under Article 92",
        "Require measures, including restriction, withdrawal or recall from the market, and make commitments binding through structured dialogue, under Article 93",
        "Impose fines of up to 15 million euro or 3 percent of worldwide turnover under Article 101",
        "Adopt interim measures under Implementing Regulation (EU) 2026/1755"
      ],
      "penalty_ceiling": "15 million euro or 3 percent of worldwide annual turnover, whichever is higher (Article 101)"
    },
    {
      "id": "european-commission",
      "name": "European Commission",
      "short": "Commission",
      "country": "EU",
      "type": "COMMISSION",
      "url": "https://ec.europa.eu",
      "designation": "established",
      "designation_note": "Sole enforcer of the Digital Services Act against designated very large online platforms and search engines, and the institution the AI Office sits within.",
      "mandate": "Enforces the Digital Services Act against designated platforms, which is currently the fastest route to a generative AI system embedded in a large consumer service.",
      "powers": [
        "Open formal proceedings against a designated platform",
        "Send requests for information under DSA Article 67",
        "Impose fines of up to 6 percent of worldwide turnover under the Digital Services Act",
        "Accept and make binding commitments"
      ],
      "penalty_ceiling": "6 percent of worldwide annual turnover (Digital Services Act)"
    },
    {
      "id": "garante",
      "name": "Garante per la protezione dei dati personali",
      "short": "Garante",
      "country": "IT",
      "type": "DPA",
      "url": "https://www.garanteprivacy.it",
      "designation": "dpa",
      "designation_note": "Italy's data protection authority. Not the designated AI Act market surveillance authority: Law 132/2025 gives that role to ACN and AgID.",
      "mandate": "Enforces the GDPR in Italy. By a distance the most active European authority on AI systems, and the first to cite an AI Act prohibition in a published decision.",
      "powers": [
        "Urgent limitation of processing, which can take a service offline within days",
        "Administrative fines of up to 20 million euro or 4 percent of worldwide turnover",
        "Corrective orders, including deletion and mandatory information campaigns"
      ],
      "penalty_ceiling": "20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)"
    },
    {
      "id": "cnil",
      "name": "Commission nationale de l'informatique et des libertés",
      "short": "CNIL",
      "country": "FR",
      "type": "DPA",
      "url": "https://www.cnil.fr",
      "designation": "dpa",
      "designation_note": "France's data protection authority. France has proposed the CNIL and the DGCCRF for AI Act roles but has not completed designation.",
      "mandate": "Enforces the GDPR in France, with a published AI action plan and recommendations on the development of AI systems.",
      "powers": [
        "Formal notice to comply",
        "Administrative fines of up to 20 million euro or 4 percent of worldwide turnover",
        "Injunctions with daily penalty payments, which can be liquidated later"
      ],
      "penalty_ceiling": "20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)"
    },
    {
      "id": "ap-nl",
      "name": "Autoriteit Persoonsgegevens",
      "short": "Dutch DPA",
      "country": "NL",
      "type": "DPA",
      "url": "https://www.autoriteitpersoonsgegevens.nl",
      "designation": "dpa",
      "designation_note": "Netherlands data protection authority, which also runs a directorate for algorithmic coordination. The Netherlands has proposed the AP and the RDI as AI Act authorities but has not completed designation.",
      "mandate": "Enforces the GDPR in the Netherlands and publishes a recurring algorithmic risk report.",
      "powers": [
        "Administrative fines of up to 20 million euro or 4 percent of worldwide turnover",
        "Orders subject to non compliance penalties",
        "Investigation of personal liability of company directors"
      ],
      "penalty_ceiling": "20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)"
    },
    {
      "id": "dpc-ie",
      "name": "Data Protection Commission",
      "short": "Irish DPC",
      "country": "IE",
      "type": "DPA",
      "url": "https://www.dataprotection.ie",
      "designation": "dpa",
      "designation_note": "Ireland's data protection authority and the lead supervisory authority for most large model providers with a European establishment.",
      "mandate": "Lead supervisory authority under the GDPR one stop shop for controllers whose main establishment is in Ireland, which is where most large AI providers place their European entity.",
      "powers": [
        "Statutory inquiries under section 110 of the Data Protection Act 2018",
        "Urgent High Court applications under section 134 to suspend processing",
        "Draft decisions binding across the Union through the Article 60 cooperation procedure"
      ],
      "penalty_ceiling": "20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)"
    },
    {
      "id": "dsb-at",
      "name": "Datenschutzbehörde",
      "short": "Austrian DSB",
      "country": "AT",
      "type": "DPA",
      "url": "https://www.dsb.gv.at",
      "designation": "dpa",
      "designation_note": "Austria's data protection authority. Austria had not designated an AI Act market surveillance authority as of the last verification date.",
      "mandate": "Enforces the GDPR in Austria and handles the complaints filed there against generative AI providers.",
      "powers": [
        "Investigate complaints",
        "Administrative fines of up to 20 million euro or 4 percent of worldwide turnover"
      ],
      "penalty_ceiling": "20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)"
    },
    {
      "id": "edpb",
      "name": "European Data Protection Board",
      "short": "EDPB",
      "country": "EU",
      "type": "BOARD",
      "url": "https://www.edpb.europa.eu",
      "designation": "established",
      "designation_note": "Coordinating body of the national data protection authorities. Not an enforcement authority in its own right.",
      "mandate": "Coordinates national authorities, issues opinions and guidelines, and runs the taskforces that set the common European position on AI systems.",
      "powers": [
        "Binding dispute resolution between national authorities under GDPR Article 65",
        "Opinions and guidelines",
        "Coordinated enforcement actions"
      ],
      "penalty_ceiling": "No fining power of its own"
    },
    {
      "id": "edps",
      "name": "European Data Protection Supervisor",
      "short": "EDPS",
      "country": "EU",
      "type": "EDPS",
      "url": "https://www.edps.europa.eu",
      "designation": "established",
      "designation_note": "Designated by Article 70(9) of the AI Act as the market surveillance authority for Union institutions, bodies, offices and agencies.",
      "mandate": "Supervises the Union's own institutions, including when they place on the market or use AI systems, and can fine them under Article 100 of the AI Act.",
      "powers": [
        "Supervise Union institutions under Article 100",
        "Administrative fines on Union institutions of up to 1.5 million euro, and 750,000 euro in the lower tier"
      ],
      "penalty_ceiling": "1.5 million euro on a Union institution (AI Act Article 100)"
    },
    {
      "id": "bnetza",
      "name": "Bundesnetzagentur",
      "short": "Bundesnetzagentur",
      "country": "DE",
      "type": "MSA",
      "url": "https://www.bundesnetzagentur.de",
      "designation": "designated",
      "designation_note": "Designated as Germany's market surveillance authority and single point of contact. The national implementing law, the KI Marktueberwachungs und Innovationsfoerderungsgesetz, entered into force on 29 July 2026.",
      "mandate": "Market surveillance for AI systems placed on the German market, and the German notifying authority, operating alongside the sectoral supervisors that keep their own competences.",
      "powers": [
        "Market surveillance under Article 74 and Regulation (EU) 2019/1020",
        "Require corrective action, restrict, withdraw or recall a system",
        "Administrative fines under Article 99 as implemented in German law"
      ],
      "penalty_ceiling": "35 million euro or 7 percent of worldwide turnover for prohibited practices (AI Act Article 99(3))"
    },
    {
      "id": "aesia",
      "name": "Agencia Española de Supervisión de la Inteligencia Artificial",
      "short": "AESIA",
      "country": "ES",
      "type": "MSA",
      "url": "https://www.aesia.gob.es",
      "designation": "designated",
      "designation_note": "The first dedicated AI supervisory agency in Europe, created by Royal Decree 729/2023 and based in A Coruña.",
      "mandate": "Spain's market surveillance authority for AI systems, a purpose built agency rather than a role added to an existing regulator.",
      "powers": [
        "Market surveillance under Article 74",
        "Require corrective action, restrict, withdraw or recall a system",
        "Administrative fines under Article 99 as implemented in Spanish law"
      ],
      "penalty_ceiling": "35 million euro or 7 percent of worldwide turnover for prohibited practices (AI Act Article 99(3))"
    },
    {
      "id": "acn",
      "name": "Agenzia per la Cybersicurezza Nazionale",
      "short": "ACN",
      "country": "IT",
      "type": "MSA",
      "url": "https://www.acn.gov.it",
      "designation": "designated",
      "designation_note": "Designated with AgID by Law 132/2025, Italy's national AI law. ACN takes market surveillance and AgID takes notification and innovation support.",
      "mandate": "Italy's market surveillance authority for AI systems, sitting alongside the Garante, which continues to enforce the GDPR against the same systems.",
      "powers": [
        "Market surveillance under Article 74",
        "Require corrective action, restrict, withdraw or recall a system",
        "Administrative fines under Article 99 as implemented in Italian law"
      ],
      "penalty_ceiling": "35 million euro or 7 percent of worldwide turnover for prohibited practices (AI Act Article 99(3))"
    }
  ],
  "countries": [
    { "code": "AT", "name": "Austria", "status": "not_yet", "authorities": ["dsb-at"], "note": "No market surveillance authority designated as of the last verification date. An AI service desk sits in the telecommunications regulator RTR, which is an advisory function rather than an enforcement one." },
    { "code": "BE", "name": "Belgium", "status": "proposed", "authorities": [], "note": "BIPT, the telecommunications regulator, is the proposed coordinating authority. Designation is not complete." },
    { "code": "BG", "name": "Bulgaria", "status": "not_yet", "authorities": [], "note": "No market surveillance authority designated as of the last verification date." },
    { "code": "HR", "name": "Croatia", "status": "not_yet", "authorities": [], "note": "No market surveillance authority designated as of the last verification date." },
    { "code": "CY", "name": "Cyprus", "status": "designated", "authorities": [], "note": "The Office of the Commissioner of Electronic Communications and Postal Regulation, OCECPR, is designated." },
    { "code": "CZ", "name": "Czechia", "status": "proposed", "authorities": [], "note": "The Czech Telecommunication Office is the proposed authority. Designation is not complete." },
    { "code": "DK", "name": "Denmark", "status": "designated", "authorities": [], "note": "The Agency for Digital Government, Digitaliseringsstyrelsen, is designated as coordinating market surveillance authority." },
    { "code": "EE", "name": "Estonia", "status": "proposed", "authorities": [], "note": "Designation proposed in draft national legislation and not complete." },
    { "code": "FI", "name": "Finland", "status": "designated", "authorities": [], "note": "Traficom coordinates market surveillance, with sectoral supervisors keeping their own competences." },
    { "code": "FR", "name": "France", "status": "proposed", "authorities": ["cnil"], "note": "The DGCCRF and the CNIL are proposed for AI Act roles. Designation is not complete, which has not stopped the CNIL enforcing the GDPR against AI systems." },
    { "code": "DE", "name": "Germany", "status": "designated", "authorities": ["bnetza"], "note": "Bundesnetzagentur designated as market surveillance authority and single point of contact. National implementing law in force 29 July 2026." },
    { "code": "GR", "name": "Greece", "status": "not_yet", "authorities": [], "note": "No market surveillance authority designated as of the last verification date." },
    { "code": "HU", "name": "Hungary", "status": "designated", "authorities": [], "note": "Designated in national law." },
    { "code": "IE", "name": "Ireland", "status": "designated", "authorities": ["dpc-ie"], "note": "Statutory Instrument 366 of 2025 designates a distributed model of fifteen sectoral authorities rather than one regulator. The Data Protection Commission continues to lead on the GDPR side for most large model providers." },
    { "code": "IT", "name": "Italy", "status": "designated", "authorities": ["acn", "garante"], "note": "Law 132/2025 designates ACN for market surveillance and AgID for notification. The Garante remains the authority that has actually taken action against AI systems." },
    { "code": "LV", "name": "Latvia", "status": "designated", "authorities": [], "note": "VARAM, the Ministry of Environmental Protection and Regional Development, is designated." },
    { "code": "LT", "name": "Lithuania", "status": "designated", "authorities": [], "note": "RRT, the Communications Regulatory Authority, is designated." },
    { "code": "LU", "name": "Luxembourg", "status": "proposed", "authorities": [], "note": "The CNPD is proposed. Designation is not complete." },
    { "code": "MT", "name": "Malta", "status": "designated", "authorities": [], "note": "The Malta Digital Innovation Authority is designated." },
    { "code": "NL", "name": "Netherlands", "status": "proposed", "authorities": ["ap-nl"], "note": "The Autoriteit Persoonsgegevens and the RDI are proposed as coordinating authorities. Designation is not complete, and the AP has been one of the most active authorities against AI systems under the GDPR." },
    { "code": "PL", "name": "Poland", "status": "proposed", "authorities": [], "note": "A new Commission for the Development and Safety of AI, KRiBSI, is proposed in draft legislation." },
    { "code": "PT", "name": "Portugal", "status": "designated", "authorities": [], "note": "ANACOM is designated as coordinating market surveillance authority." },
    { "code": "RO", "name": "Romania", "status": "designated", "authorities": [], "note": "ANCOM is designated." },
    { "code": "SK", "name": "Slovakia", "status": "proposed", "authorities": [], "note": "Designation proposed in draft national legislation and not complete." },
    { "code": "SI", "name": "Slovenia", "status": "designated", "authorities": [], "note": "AKOS is designated." },
    { "code": "ES", "name": "Spain", "status": "designated", "authorities": ["aesia"], "note": "AESIA, created by Royal Decree 729/2023, is the first purpose built AI supervisory agency in Europe." },
    { "code": "SE", "name": "Sweden", "status": "designated", "authorities": [], "note": "PTS, the Post and Telecom Authority, is designated as coordinating authority." }
  ]
}