21JUN

Six states name no AI Act regulator

2 min read

17:51UTC

The Commission's AI Act enforcement register refreshed on 7 September after eleven months untouched, and six of 27 member states still name no market surveillance authority. The statutory deadline fell 402 days ago.

← Back to Hormuz shuts as Vance flies to Geneva Jump to analysis ↓

ConflictAssessed

Key takeaway

The AI Act register moved after eleven months and six member states still list no enforcement authority.

The European Commission's page listing market surveillance authorities under the EU AI Act refreshed on 7 September 2026, its first update since 26 September 2025. Twenty-one of 27 member states name an authority. Six do not: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.⁠¹

Market surveillance authorities are the national regulators that police AI systems on the ground, take complaints and open investigations. Article 70(2) of the AI Act required every member state to communicate the identity of its notifying authority and its market surveillance authority, and to publish contact details, by 2 August 2025. Measured to today, those six rows sit 402 days past that statutory date.⁠²

Five of the six blanks belong to states the stale version of the page did not show as blank. That version carried three, Denmark, Finland and Hungary, and was read in the week the AI Office gained the power to fine a general-purpose model provider. Denmark's row now names Digitaliseringsstyrelsen, the Agency for Digital Government, and Finland's names Traficom, the Transport and Communications Agency. Austria, Belgium, Bulgaria, Croatia and Slovakia have appeared as blank. Only Hungary sits on both lists.

The register now shows twice as many gaps as the stale version did, and the refresh revealed that rather than caused it. An eleven-month-old page was concealing the real position. Somebody went into it, updated it, and after that update six rows are still empty, which is a harder fact than a stale footer. the Commission can fine a model provider at the centre; enforcement against a deployed high-risk system runs through a national authority that six governments have not named.

Deep Analysis

In plain English

The EU's AI Act is the bloc's main AI law. Since 2 August 2026, it lets Brussels fine the makers of large general-purpose AI models, the kind behind ChatGPT or Mistral's own products, up to 15 million euros or 3% of their worldwide revenue. But the law also requires every EU country to name a national regulator these companies can go to. As of 7 September, six of the 27 countries still have not named anyone. An AI company based in one of those six countries has, on paper, nowhere on the Commission's own list to file with, even though the fining power against it is already active.

Deep Analysis

Root Causes

Denmark and Finland closed their gaps by assigning the role to an existing agency, Digitaliseringsstyrelsen and Traficom respectively, bodies that already regulate digital government and telecoms.

The six states still blank have not designated any authority at all, existing or new, which points to a failure to start the institutional-assignment process rather than an administrative delay in publishing a webpage.

Source Landscape

This story draws on neutral-leaning sources from Belgium

Belgium

Primary parallel: GDPR's own national supervisory-authority rollout after 2018 left several member states without a fully resourced authority for years after the regulation took legal effect, without suspending enforcement elsewhere in the bloc.

Counter-parallel: GDPR carried no immediate financial exposure during that gap. The AI Act's GPAI fining power, up to €15m or 3% of global turnover, has been live since 2 August 2026, so the same kind of national gap now sits alongside an active penalty clock rather than a grace period.

Consensus view: The Future of Life Institute's independent AI Act tracker recorded, at its 17 June update, that 9 of 27 member states had designated both required authorities and 12 had partial arrangements, a materially fuller picture than the Commission's own register, which as of the 7 September refresh still names no authority at all for six states: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.

Counter-view: The European Commission has signalled a collaborative, risk-based approach before penalties, and Article 101's own procedure gives a provider the right to be heard before any fine is set, which the Commission's staff would argue softens the practical bite of an incomplete national contact list.

Key tension: Whether a GPAI provider can rely on the Commission's own enforcement-contact register when an independent monitor already recorded a fuller designation picture nearly three months earlier.

Sources:European Commission·EUR-Lex

Mentions:European Commission →EU AI Act →Denmark →Finland →Austria →Belgium →Bulgaria →Croatia →Hungary →Slovakia →Brussels →AI Office →Future of Life Institute →GDPR →ChatGPT →GPAI →

First Reported In

Update #15 · Mistral closes EUR 3bn; Luxembourg buys in

European Commission· 8 Sept 2026

Read original →

Causes and effects

Caused by

AI Act fines land on a stale register

The stale register recorded at the start of August is the baseline the 7 September refresh is measured against.

Occurred 2 Aug 2026

Read story →

This Event

Six states name no AI Act regulator

A company deploying a high-risk system in Austria, Belgium, Bulgaria, Croatia, Hungary or Slovakia cannot find a domestic authority to notify on the Commission's own list.

Different Perspectives

Office for Budget Responsibility

The OBR's 28 October forecast assumed $82 oil for 2026 and 2027, from market prices for the ten working days to 19 August, and blamed dearer wholesale energy on the war without naming Iran. It expects CPI inflation close to 4% in early 2027 even at that price.

Hengaw, Kurdish rights group

Hengaw reported the 3 November hangings of Amirhossein Maleki and Amirhossein Ebrahimi in Isfahan, saying Ebrahimi was tortured into confessing and that nine of 12 people sentenced to death in the case have now been hanged. Iran's judiciary holds that the defendants killed members of the security forces.

FINTRAC, Canada's financial intelligence unit

FINTRAC worked with the US Treasury on the 6 November designation of eight money services businesses in British Columbia, Ontario and Quebec. Treasury says the businesses still operate, some under new names, so closing them falls to Ottawa.

Abdul Qadir al-Dakhil, Governor of Nineveh

Al-Dakhil cancelled three Mosul International Airport contracts on 7 November over alleged links to armed groups, after meeting Prime Minister Ali al-Zaidi in Baghdad. He named no group or company, and said the contracts will go to international companies.

Kuwait

Kuwait condemned the Houthi missile fired towards the Madinah region on 5 November and restated its support for Saudi Arabia, the Qatar News Agency reported. Its state tanker company, Kuwait Oil Tankers Company, is among the Gulf state fleets on Iran's expanded Hormuz list.

Scott Bessent, US Treasury Secretary

Treasury designated an alleged Chandigarh false-flag network on 4 November and eight Canadian exchangers on 6 November, while State sanctioned alleged MANPADS intermediaries. None of the actions touches an oil buyer; they target the paper, cash and procurement around Iran's trade.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.