11SEP

Six states name no AI Act regulator

2 min read

09:25UTC

The Commission's AI Act enforcement register refreshed on 7 September after eleven months untouched, and six of 27 member states still name no market surveillance authority. The statutory deadline fell 402 days ago.

← Back to 23 to 3: Iran goes to the Security Council Jump to analysis ↓

ConflictAssessed

Key takeaway

The AI Act register moved after eleven months and six member states still list no enforcement authority.

The European Commission's page listing market surveillance authorities under the EU AI Act refreshed on 7 September 2026, its first update since 26 September 2025. Twenty-one of 27 member states name an authority. Six do not: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia. ¹

Market surveillance authorities are the national regulators that police AI systems on the ground, take complaints and open investigations. Article 70(2) of the AI Act required every member state to communicate the identity of its notifying authority and its market surveillance authority, and to publish contact details, by 2 August 2025. Measured to today, those six rows sit 402 days past that statutory date. ²

Five of the six blanks belong to states the stale version of the page did not show as blank. That version carried three, Denmark, Finland and Hungary, and was read in the week the AI Office gained the power to fine a general-purpose model provider . Denmark's row now names Digitaliseringsstyrelsen, the Agency for Digital Government, and Finland's names Traficom, the Transport and Communications Agency. Austria, Belgium, Bulgaria, Croatia and Slovakia have appeared as blank. Only Hungary sits on both lists.

The register now shows twice as many gaps as the stale version did, and the refresh revealed that rather than caused it. An eleven-month-old page was concealing the real position. Somebody went into it, updated it, and after that update six rows are still empty, which is a harder fact than a stale footer. the Commission can fine a model provider at the centre; enforcement against a deployed high-risk system runs through a national authority that six governments have not named.

Deep Analysis

In plain English

The EU's AI Act is the bloc's main AI law. Since 2 August 2026, it lets Brussels fine the makers of large general-purpose AI models, the kind behind ChatGPT or Mistral's own products, up to 15 million euros or 3% of their worldwide revenue. But the law also requires every EU country to name a national regulator these companies can go to. As of 7 September, six of the 27 countries still have not named anyone. An AI company based in one of those six countries has, on paper, nowhere on the Commission's own list to file with, even though the fining power against it is already active.

Deep Analysis

Root Causes

Denmark and Finland closed their gaps by assigning the role to an existing agency, Digitaliseringsstyrelsen and Traficom respectively, bodies that already regulate digital government and telecoms.

The six states still blank have not designated any authority at all, existing or new, which points to a failure to start the institutional-assignment process rather than an administrative delay in publishing a webpage.

Source Landscape

This story draws on neutral-leaning sources from Belgium

Belgium

Primary parallel: GDPR's own national supervisory-authority rollout after 2018 left several member states without a fully resourced authority for years after the regulation took legal effect, without suspending enforcement elsewhere in the bloc.

Counter-parallel: GDPR carried no immediate financial exposure during that gap. The AI Act's GPAI fining power, up to EUR15m or 3% of global turnover, has been live since 2 August 2026, so the same kind of national gap now sits alongside an active penalty clock rather than a grace period.

Consensus view: The Future of Life Institute's independent AI Act tracker recorded, at its 17 June update, that 9 of 27 member states had designated both required authorities and 12 had partial arrangements, a materially fuller picture than the Commission's own register, which as of the 7 September refresh still names no authority at all for six states: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.

Counter-view: The European Commission has signalled a collaborative, risk-based approach before penalties, and Article 101's own procedure gives a provider the right to be heard before any fine is set, which the Commission's staff would argue softens the practical bite of an incomplete national contact list.

Key tension: Whether a GPAI provider can rely on the Commission's own enforcement-contact register when an independent monitor already recorded a fuller designation picture nearly three months earlier.

Sources:EUR-Lex·European Commission

Mentions:European Commission →EU AI Act →Denmark →Finland →Austria →Belgium →Bulgaria →Croatia →Hungary →Slovakia →Brussels →AI Office →Future of Life Institute →GDPR →ChatGPT →GPAI →

First Reported In

Update #15 · Mistral closes EUR 3bn; Luxembourg buys in

EUR-Lex· 8 Sept 2026

Read original →

Causes and effects

Caused by

AI Act fines land on a stale register

The stale register recorded at the start of August is the baseline the 7 September refresh is measured against.

Occurred 2 Aug 2026

Read story →

This Event

Six states name no AI Act regulator

A company deploying a high-risk system in Austria, Belgium, Bulgaria, Croatia, Hungary or Slovakia cannot find a domestic authority to notify on the Commission's own list.

Different Perspectives

Turkey

Golden Global Portfoy Yonetimi closed three funds to new money a day after telling regulators they were legally separate from its sanctioned parent, and the central bank held its rate at 37 per cent citing energy-driven inflation risk. Ankara is absorbing balance-sheet and monetary costs from a war it is not fighting.

Qatar

Qatar's foreign ministry said it was coordinating with China during a Beijing visit to restart negotiations, while filing hundreds of letters at the UN documenting Iranian strikes on its own civilian facilities. Doha is mediating for a neighbour it is also formally accusing, a contradiction the referral's clean vote count does not show.

China and Russia

China and Russia voted against the IAEA referral alongside Niger, and Iran's ambassador told the Board that inspections were impossible during a war Iran did not start. Beijing is separately mediating between Doha and Tehran, meaning the same power blocking the West's legal track is running the diplomatic one that might actually end the war.

Jordan

Jordan said it intercepted 18 of the 20 Iranian ballistic missiles fired at its territory on 8 September, the war's first sustained salvo against a state that is not a combatant. Amman's 90 per cent interception rate held, but a tenfold jump in missiles fired in a single volley raises what the next one might carry.

United States

CENTCOM said its strikes disabled five Iranian tankers only after two failed missile attempts on a US warship, and Treasury moved the same week to a presumption of denial on all Iran licences. Washington now treats commercial shipping and financial plumbing as one enforcement front rather than two separate tracks.

Iran / IRGC

Iran's foreign ministry called the CENTCOM tanker strikes a war crime and a breach of the UN Charter, while the IRGC named two US destroyers it says it damaged without releasing images. Tehran expects the claims, unverifiable either way, to sustain domestic morale after losing five tankers in a single day.