17JUN

Six states name no AI Act regulator

2 min read

10:21UTC

The Commission's AI Act enforcement register refreshed on 7 September after eleven months untouched, and six of 27 member states still name no market surveillance authority. The statutory deadline fell 402 days ago.

← Back to Three records fall in one afternoon Jump to analysis ↓

SportAssessed

Key takeaway

The AI Act register moved after eleven months and six member states still list no enforcement authority.

The European Commission's page listing market surveillance authorities under the EU AI Act refreshed on 7 September 2026, its first update since 26 September 2025. Twenty-one of 27 member states name an authority. Six do not: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.⁠¹

Market surveillance authorities are the national regulators that police AI systems on the ground, take complaints and open investigations. Article 70(2) of the AI Act required every member state to communicate the identity of its notifying authority and its market surveillance authority, and to publish contact details, by 2 August 2025. Measured to today, those six rows sit 402 days past that statutory date.⁠²

Five of the six blanks belong to states the stale version of the page did not show as blank. That version carried three, Denmark, Finland and Hungary, and was read in the week the AI Office gained the power to fine a general-purpose model provider. Denmark's row now names Digitaliseringsstyrelsen, the Agency for Digital Government, and Finland's names Traficom, the Transport and Communications Agency. Austria, Belgium, Bulgaria, Croatia and Slovakia have appeared as blank. Only Hungary sits on both lists.

The register now shows twice as many gaps as the stale version did, and the refresh revealed that rather than caused it. An eleven-month-old page was concealing the real position. Somebody went into it, updated it, and after that update six rows are still empty, which is a harder fact than a stale footer. the Commission can fine a model provider at the centre; enforcement against a deployed high-risk system runs through a national authority that six governments have not named.

Deep Analysis

In plain English

The EU's AI Act is the bloc's main AI law. Since 2 August 2026, it lets Brussels fine the makers of large general-purpose AI models, the kind behind ChatGPT or Mistral's own products, up to 15 million euros or 3% of their worldwide revenue. But the law also requires every EU country to name a national regulator these companies can go to. As of 7 September, six of the 27 countries still have not named anyone. An AI company based in one of those six countries has, on paper, nowhere on the Commission's own list to file with, even though the fining power against it is already active.

Deep Analysis

Root Causes

Denmark and Finland closed their gaps by assigning the role to an existing agency, Digitaliseringsstyrelsen and Traficom respectively, bodies that already regulate digital government and telecoms.

The six states still blank have not designated any authority at all, existing or new, which points to a failure to start the institutional-assignment process rather than an administrative delay in publishing a webpage.

Source Landscape

This story draws on neutral-leaning sources from Belgium

Belgium

Primary parallel: GDPR's own national supervisory-authority rollout after 2018 left several member states without a fully resourced authority for years after the regulation took legal effect, without suspending enforcement elsewhere in the bloc.

Counter-parallel: GDPR carried no immediate financial exposure during that gap. The AI Act's GPAI fining power, up to €15m or 3% of global turnover, has been live since 2 August 2026, so the same kind of national gap now sits alongside an active penalty clock rather than a grace period.

Consensus view: The Future of Life Institute's independent AI Act tracker recorded, at its 17 June update, that 9 of 27 member states had designated both required authorities and 12 had partial arrangements, a materially fuller picture than the Commission's own register, which as of the 7 September refresh still names no authority at all for six states: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.

Counter-view: The European Commission has signalled a collaborative, risk-based approach before penalties, and Article 101's own procedure gives a provider the right to be heard before any fine is set, which the Commission's staff would argue softens the practical bite of an incomplete national contact list.

Key tension: Whether a GPAI provider can rely on the Commission's own enforcement-contact register when an independent monitor already recorded a fuller designation picture nearly three months earlier.

Sources:EUR-Lex·European Commission

Mentions:European Commission →EU AI Act →Denmark →Finland →Austria →Belgium →Bulgaria →Croatia →Hungary →Slovakia →Brussels →AI Office →Future of Life Institute →GDPR →ChatGPT →GPAI →

First Reported In

Update #15 · Mistral closes EUR 3bn; Luxembourg buys in

EUR-Lex· 8 Sept 2026

Read original →

Causes and effects

Caused by

AI Act fines land on a stale register

The stale register recorded at the start of August is the baseline the 7 September refresh is measured against.

Occurred 2 Aug 2026

Read story →

This Event

Six states name no AI Act regulator

A company deploying a high-risk system in Austria, Belgium, Bulgaria, Croatia, Hungary or Slovakia cannot find a domestic authority to notify on the Commission's own list.

Different Perspectives

French Football Federation

The FFF called an 11:00 CEST press conference for 28 July, at its Paris headquarters, following an extraordinary executive committee meeting, at which Zinedine Zidane is expected to be presented as head coach succeeding Didier Deschamps. As of this writing no communique confirms the appointment, contract length or start date.

Morocco

Morocco is pushing for the 2030 final at its Grand Stade Hassan II in Casablanca, a planned 115,000-seat venue that would be the world's largest football stadium on completion. The venue is contested by a Spanish petition for the Santiago Bernabeu, and FIFA has fixed neither the venue nor the tournament's proposed 64-team format.

FIFA

FIFA's first tournament report, published 27 July, itemises nearly 300,000 accredited personnel, 73,700 security staff and 300,000 square metres of custom-grown turf, with no revenue or cost figure attached. As a Swiss association answering to its own Congress rather than a treasury, FIFA has followed the same operational-before-financial sequence it used after Qatar 2022.

Javier Tebas / La Liga

La Liga president Javier Tebas said on 21 July that FIFA's system is rotten from the root and that Gianni Infantino's time as president has, in his words, concluded. Tebas has no vote in FIFA's process, so days after the IOC declined jurisdiction over a separate ethics complaint, he used the only instrument he has.

Mexico City government

Head of government Clara Brugada presented a closing report on 22 July crediting the tournament with 44 billion pesos of economic activity, 2,000-plus accelerated public works and 100,000 formal jobs in June alone. The city has not published the method behind that figure, and three other Mexican bodies count the same five weeks differently.

Town of Foxborough

Foxborough answered Kraft Group's June lawsuit on 7 July with a 61-page counterclaim, calling the stadium's owners 'a collection of multibillion-dollar corporations' trying to shift its $7.8 million security bill onto taxpayers. The town says its licensing power and its billing power run through the same board, and it wants the court to award its own costs too.