Who enforces the EU AI Act

Exclusive competence over providers of general purpose AI models under Article 88, expanded by the Digital Omnibus to AI systems built on a general purpose model by the same provider and to AI in or constituting a very large online platform or search engine under the Digital Services Act.

Maximum penalty: 15 million euro or 3 percent of worldwide annual turnover, whichever is higher (Article 101)

Enforces the Digital Services Act against designated platforms, which is currently the fastest route to a generative AI system embedded in a large consumer service.

Maximum penalty: 6 percent of worldwide annual turnover (Digital Services Act)

Coordinates national authorities, issues opinions and guidelines, and runs the taskforces that set the common European position on AI systems.

Maximum penalty: No fining power of its own

Supervises the Union's own institutions, including when they place on the market or use AI systems, and can fine them under Article 100 of the AI Act.

Maximum penalty: 1.5 million euro on a Union institution (AI Act Article 100)

Market surveillance for AI systems placed on the German market, and the German notifying authority, operating alongside the sectoral supervisors that keep their own competences.

Maximum penalty: 35 million euro or 7 percent of worldwide turnover for prohibited practices (AI Act Article 99(3))

Spain's market surveillance authority for AI systems, a purpose built agency rather than a role added to an existing regulator.

Maximum penalty: 35 million euro or 7 percent of worldwide turnover for prohibited practices (AI Act Article 99(3))

Italy's market surveillance authority for AI systems, sitting alongside the Garante, which continues to enforce the GDPR against the same systems.

Maximum penalty: 35 million euro or 7 percent of worldwide turnover for prohibited practices (AI Act Article 99(3))

Enforces the GDPR in Italy. By a distance the most active European authority on AI systems, and the first to cite an AI Act prohibition in a published decision.

Maximum penalty: 20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)

Enforces the GDPR in France, with a published AI action plan and recommendations on the development of AI systems.

Maximum penalty: 20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)

Enforces the GDPR in the Netherlands and publishes a recurring algorithmic risk report.

Maximum penalty: 20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)

Lead supervisory authority under the GDPR one stop shop for controllers whose main establishment is in Ireland, which is where most large AI providers place their European entity.

Maximum penalty: 20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)

Enforces the GDPR in Austria and handles the complaints filed there against generative AI providers.

Maximum penalty: 20 million euro or 4 percent of worldwide annual turnover (GDPR Article 83)