11JUN

Six states name no AI Act regulator

2 min read

09:17UTC

The Commission's AI Act enforcement register refreshed on 7 September after eleven months untouched, and six of 27 member states still name no market surveillance authority. The statutory deadline fell 402 days ago.

← Back to IRGC declares Hormuz shut; US strikes again Jump to analysis ↓

ConflictAssessed

Key takeaway

The AI Act register moved after eleven months and six member states still list no enforcement authority.

The European Commission's page listing market surveillance authorities under the EU AI Act refreshed on 7 September 2026, its first update since 26 September 2025. Twenty-one of 27 member states name an authority. Six do not: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia. ¹

Market surveillance authorities are the national regulators that police AI systems on the ground, take complaints and open investigations. Article 70(2) of the AI Act required every member state to communicate the identity of its notifying authority and its market surveillance authority, and to publish contact details, by 2 August 2025. Measured to today, those six rows sit 402 days past that statutory date. ²

Five of the six blanks belong to states the stale version of the page did not show as blank. That version carried three, Denmark, Finland and Hungary, and was read in the week the AI Office gained the power to fine a general-purpose model provider . Denmark's row now names Digitaliseringsstyrelsen, the Agency for Digital Government, and Finland's names Traficom, the Transport and Communications Agency. Austria, Belgium, Bulgaria, Croatia and Slovakia have appeared as blank. Only Hungary sits on both lists.

The register now shows twice as many gaps as the stale version did, and the refresh revealed that rather than caused it. An eleven-month-old page was concealing the real position. Somebody went into it, updated it, and after that update six rows are still empty, which is a harder fact than a stale footer. the Commission can fine a model provider at the centre; enforcement against a deployed high-risk system runs through a national authority that six governments have not named.

Deep Analysis

In plain English

The EU's AI Act is the bloc's main AI law. Since 2 August 2026, it lets Brussels fine the makers of large general-purpose AI models, the kind behind ChatGPT or Mistral's own products, up to 15 million euros or 3% of their worldwide revenue. But the law also requires every EU country to name a national regulator these companies can go to. As of 7 September, six of the 27 countries still have not named anyone. An AI company based in one of those six countries has, on paper, nowhere on the Commission's own list to file with, even though the fining power against it is already active.

Deep Analysis

Root Causes

Denmark and Finland closed their gaps by assigning the role to an existing agency, Digitaliseringsstyrelsen and Traficom respectively, bodies that already regulate digital government and telecoms.

The six states still blank have not designated any authority at all, existing or new, which points to a failure to start the institutional-assignment process rather than an administrative delay in publishing a webpage.

Source Landscape

This story draws on neutral-leaning sources from Belgium

Belgium

Primary parallel: GDPR's own national supervisory-authority rollout after 2018 left several member states without a fully resourced authority for years after the regulation took legal effect, without suspending enforcement elsewhere in the bloc.

Counter-parallel: GDPR carried no immediate financial exposure during that gap. The AI Act's GPAI fining power, up to EUR15m or 3% of global turnover, has been live since 2 August 2026, so the same kind of national gap now sits alongside an active penalty clock rather than a grace period.

Consensus view: The Future of Life Institute's independent AI Act tracker recorded, at its 17 June update, that 9 of 27 member states had designated both required authorities and 12 had partial arrangements, a materially fuller picture than the Commission's own register, which as of the 7 September refresh still names no authority at all for six states: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.

Counter-view: The European Commission has signalled a collaborative, risk-based approach before penalties, and Article 101's own procedure gives a provider the right to be heard before any fine is set, which the Commission's staff would argue softens the practical bite of an incomplete national contact list.

Key tension: Whether a GPAI provider can rely on the Commission's own enforcement-contact register when an independent monitor already recorded a fuller designation picture nearly three months earlier.

Sources:EUR-Lex·European Commission

Mentions:European Commission →EU AI Act →Denmark →Finland →Austria →Belgium →Bulgaria →Croatia →Hungary →Slovakia →Brussels →AI Office →Future of Life Institute →GDPR →ChatGPT →GPAI →

First Reported In

Update #15 · Mistral closes EUR 3bn; Luxembourg buys in

EUR-Lex· 8 Sept 2026

Read original →

Causes and effects

Caused by

AI Act fines land on a stale register

The stale register recorded at the start of August is the baseline the 7 September refresh is measured against.

Occurred 2 Aug 2026

Read story →

This Event

Six states name no AI Act regulator

A company deploying a high-risk system in Austria, Belgium, Bulgaria, Croatia, Hungary or Slovakia cannot find a domestic authority to notify on the Commission's own list.

Different Perspectives

Golden Global Yatirim Bankasi

Golden Global told Turkey's KAP on 4 September that the parties OFAC named are not its customers and it had no dealings with them. It plans to contest the designation.

CENTCOM (US Central Command)

CENTCOM says its ships evaded the IRGC's 5 September missiles unharmed, then disabled two Iranian tankers and destroyed a third within hours. Admiral Cooper named that three-for-two ratio himself.

Islamic Revolutionary Guard Corps

The IRGC Navy claimed strikes on six vessels, three tankers and three US-linked ships, on 5 and 6 September, naming none of them. It conceded its own tankers were hit.

China's foreign ministry

Spokesman Lin Jian rejected Treasury Secretary Scott Bessent's 25 August warning that Iranian oil buyers face an "economic D-Day", saying sanctions do not help and that Beijing would safeguard its own rights and interests. China's Iranian crude imports had already halved for unrelated reasons.

Iraq's government and Erbil authorities

Erbil authorities said 10 explosive-laden drones were shot down over the city on 1-2 September with no casualties. Iraq's government condemned the attacks without naming Iran as their source, and neither Washington nor Baghdad confirmed the IRGC's claim to have hit US bases there.

Bahrain Defence Force

The General Command said air defences intercepted several Iranian missiles and drones on 1-2 September and called the use of such weapons against civilians and private property a flagrant violation of international humanitarian law.