Who is enforcing the EU AI Act — and what has happened so far
Every verified enforcement development in one place: authority designations, guidance, formal investigations and fines — plus which authority is competent in each member state, and what becomes enforceable next.
No headline AI Act fines have been published yet. That is not because the Act is dormant — prohibitions have been enforceable since February 2025 and national penalty regimes were due by August 2025 — but because the enforcement machinery is still being assembled: a European Parliament briefing found only 8 of 27 member states had designated their single point of contact by March 2026. The machinery is now coming online, and the Commission's own fining powers for general-purpose AI activate on 2 August 2026. Here is the map. This tracker records zero published fines to date and only events we could verify against a public source.
What becomes enforceable next
Article 50 transparency duties apply (chatbot disclosure, content marking, deepfake labels) and the Commission's GPAI enforcement powers — including fines — activate.
End of the Article 50(2) transition: generative systems already on the market before 2 August 2026 must now machine-readably mark synthetic outputs.
High-risk obligations apply for stand-alone Annex III systems (moved from 2 August 2026 by the Digital Omnibus). National market surveillance of high-risk AI begins in earnest.
High-risk obligations apply for AI embedded in regulated products (Annex I) — the final major application date.
Post–Digital-Omnibus dates (Annex III high-risk moved to 2 Dec 2027, Annex I to 2 Aug 2028). Track them live with the deadline countdown.
Enforcement timeline
Newest first. Kinds: regime milestones, guidance, authority designations, formal investigations and fines. Sources are cited on every entry.
- 11 Jun 2026Authority designationPoland
Poland's lower house adopts AI implementation law
The Sejm adopts the implementation law creating a new Commission on the Development and Safety of Artificial Intelligence as market surveillance authority, with the Minister of Digitalisation as notifying authority. Awaiting Senate approval.
Source: Polish AI implementation act, adopted by Sejm 11 Jun 2026; artificialintelligenceact.eu
- 10 Jun 2026GuidanceEU
Final Code of Practice on marking and labelling AI-generated content
The Commission publishes the final Code of Practice operationalising Article 50 transparency: machine-readable marking of synthetic content (secured metadata plus watermarking, with optional fingerprinting) for providers, and deepfake / public-interest-text labelling for deployers — seven weeks before Article 50 becomes binding.
Source: European Commission, Code of Practice on marking and labelling of AI-generated content, 10 Jun 2026, digital-strategy.ec.europa.eu
- 7 May 2026Regime milestoneEU
Digital Omnibus on AI: provisional agreement moves the high-risk dates
Trilogue negotiators agree the Digital Omnibus on AI: high-risk obligations for stand-alone (Annex III) systems move from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products (Annex I) to 2 August 2028. Parliament formally endorsed on 16 June 2026 and the Council gave final approval on 29 June 2026.
Source: Digital Omnibus on AI, provisional agreement 7 May 2026; Council final approval 29 June 2026
- 15 Apr 2026Authority designationNetherlands
Netherlands publishes draft designating ten sectoral authorities
Draft implementation legislation proposes a decentralised model with ten sectoral market surveillance authorities, coordinated by the Data Protection Authority (AP) and the State Inspectorate for Digital Infrastructure (RDI). Not yet enacted.
Source: Dutch draft AI Act implementation legislation, April 2026; artificialintelligenceact.eu
- 18 Mar 2026GuidanceEU
European Parliament briefing: 8 of 27 single points of contact designated
An EPRS enforcement briefing records that, seven months after the deadline, only 8 of 27 member states had designated their single point of contact — and flags the risk of uneven enforcement under the Act's decentralised model. No fines or named enforcement actions are reported.
Source: EPRS, "Enforcement of the AI Act", 18 Mar 2026, epthinktank.eu
- 10 Feb 2026Authority designationGermany
Germany's cabinet adopts draft implementation act (Bundesnetzagentur)
The Federal Cabinet adopts the draft AI Act implementation law proposing the Federal Network Agency (Bundesnetzagentur) as central market surveillance and notifying authority. Parliamentary approval is still pending — Germany does not yet have a legally designated enforcer.
Source: German Federal Government draft implementation act, 10 Feb 2026; artificialintelligenceact.eu
- 10 Oct 2025Authority designationItaly
Italy's national AI law enters into force
Law No. 132/2025 — the first comprehensive national AI framework law in the EU — enters into force, designating the National Cybersecurity Agency (ACN) as market surveillance authority and the Agency for Digital Italy (AgID) as notifying authority.
Source: Legge 132/2025 (Italy); artificialintelligenceact.eu national implementation tracker
- 2 Aug 2025Regime milestoneEU
GPAI obligations apply; national penalty regimes and authority designations due
Obligations for general-purpose AI model providers apply, member states must have laid down penalty rules, and every member state was required to designate its market surveillance and notifying authorities plus a single point of contact. Many member states missed the designation deadline — the gap the rest of this tracker documents.
Source: Regulation (EU) 2024/1689, Arts. 70, 99, 113(b)
- 24 Jul 2025Authority designationIreland
Ireland designates 15 market surveillance authorities
Statutory Instrument No. 366 of 2025 designates fifteen existing sectoral bodies as market surveillance authorities and identifies four notifying authorities — a distributed model, with a central National AI Office expected by August 2026.
Source: S.I. No. 366/2025 (Ireland); artificialintelligenceact.eu national implementation tracker
- 10 Jul 2025GuidanceEU
General-Purpose AI Code of Practice published
The voluntary GPAI Code of Practice (transparency, copyright and safety & security chapters) is published as the main compliance vehicle for GPAI model providers. Signing it does not immunise against fines, but the AI Office weighs adherence when assessing penalties.
Source: European Commission, GPAI Code of Practice, digital-strategy.ec.europa.eu
- 4 Feb 2025GuidanceEU
Commission guidelines on prohibited AI practices
Two days after the bans took effect, the Commission approved guidelines interpreting Article 5 — the reference text national authorities use when assessing whether a practice is prohibited.
Source: European Commission, guidelines on prohibited AI practices (C(2025) 884), digital-strategy.ec.europa.eu
- 2 Feb 2025Regime milestoneEU
Prohibited practices become enforceable
Article 5 prohibitions (social scoring, untargeted facial-image scraping, workplace/education emotion recognition, and other banned practices) and the Article 4 AI-literacy duty apply across the EU. Breaches sit in the top penalty tier: €35M / 7% of worldwide turnover.
Source: Regulation (EU) 2024/1689, Art. 113(a)
Who is competent where
The designated — or expected — market surveillance authority per major member state. Anything not yet fixed in law is marked pending rather than guessed. Verified against the public national-implementation record, July 2026.
| Jurisdiction | Authority | Status | Detail |
|---|---|---|---|
| EU level | European Commission — AI Office | Designated | Exclusive enforcer for general-purpose AI models; its fining powers (up to €15M / 3%) activate on 2 August 2026. Also issues the guidance and codes of practice national authorities rely on. |
| Germany | Bundesnetzagentur (proposed) | Pending legislation | Federal Cabinet adopted the draft implementation act on 10 February 2026 proposing the Federal Network Agency as central market surveillance and notifying authority; parliamentary approval still pending. |
| France | DGCCRF as coordinator (proposed) | Pending legislation | A legislative proposal outlines a decentralised model coordinated by the consumer-protection authority DGCCRF, but France had still not legally designated its competent authorities as of mid-2026. |
| Italy | ACN (market surveillance) + AgID (notifying) | Designated | Law No. 132/2025, in force since 10 October 2025 — the first comprehensive national AI law in the EU. |
| Spain | AESIA | Pending legislation | AESIA (the dedicated AI supervisory agency, operating since 2024) acts as single point of contact and market surveillance authority; the draft law completing the framework — including the notifying authority — is still under review. |
| Netherlands | AP + RDI as coordinators (proposed) | Pending legislation | Draft legislation published April 2026: ten sectoral market surveillance authorities coordinated by the Data Protection Authority and the State Inspectorate for Digital Infrastructure. Not yet enacted. |
| Poland | Commission on Development and Safety of AI (proposed) | Pending legislation | Implementation law adopted by the Sejm on 11 June 2026 (new dedicated AI supervision body; Minister of Digitalisation as notifying authority); awaiting Senate approval. |
| Ireland | 15 sectoral market surveillance authorities | Designated | S.I. No. 366/2025 designates fifteen existing regulators as market surveillance authorities and four notifying authorities; a central National AI Office is expected by 2 August 2026. |
| Sweden | PTS as coordinator (proposed) | Pending legislation | Government proposal: the Post and Telecom Authority coordinates market surveillance, with Swedac and the Medical Products Agency as notifying authorities. Not yet enacted. |
Know where you stand before the enforcers do
Classify your AI system in 2 minutes with the free risk checker — leave your email there and you'll get your obligations roadmap plus follow-ups as the regime tightens. Or follow every regulatory development on our updates feed.
Frequently asked questions
Has anyone been fined under the EU AI Act yet?
No. As of July 2026, no fines under the EU AI Act have been published. Prohibitions have been enforceable since 2 February 2025 and national penalty regimes were due by 2 August 2025, but many member states have not yet designated their enforcement authorities — and the Commission's own fining powers for general-purpose AI only activate on 2 August 2026.
Who enforces the EU AI Act?
Enforcement is split: national market surveillance authorities (one or more per member state) enforce the rules for AI systems, while the European Commission's AI Office is the exclusive enforcer for general-purpose AI models. A European AI Board coordinates the national authorities.
Which countries have designated their AI Act authorities?
Only a minority. A European Parliament briefing recorded that as of March 2026 just 8 of 27 member states had designated their single point of contact. Italy (ACN/AgID) and Ireland (15 sectoral authorities) are among the states with completed designations; Germany, France, Spain, the Netherlands, Poland and Sweden all still had legislation pending as of mid-2026.
What becomes enforceable next?
On 2 August 2026, Article 50 transparency duties apply and the Commission's GPAI enforcement powers (fines up to €15M or 3% of turnover) activate. The Article 50(2) content-marking transition ends 2 December 2026. High-risk obligations follow on 2 December 2027 (Annex III) and 2 August 2028 (Annex I embedded systems), after the Digital Omnibus moved those dates.
Curated from public sources; every entry verified before inclusion. Last reviewed July 2026. This page is general information, not legal advice.