22OCT

Six states name no AI Act regulator

2 min read

19:10UTC

The Commission's AI Act enforcement register refreshed on 7 September after eleven months untouched, and six of 27 member states still name no market surveillance authority. The statutory deadline fell 402 days ago.

← Back to Kremlin floats 10 November talks as diesel deal work begins Jump to analysis ↓

ConflictAssessed

Key takeaway

The AI Act register moved after eleven months and six member states still list no enforcement authority.

The European Commission's page listing market surveillance authorities under the EU AI Act refreshed on 7 September 2026, its first update since 26 September 2025. Twenty-one of 27 member states name an authority. Six do not: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.⁠¹

Market surveillance authorities are the national regulators that police AI systems on the ground, take complaints and open investigations. Article 70(2) of the AI Act required every member state to communicate the identity of its notifying authority and its market surveillance authority, and to publish contact details, by 2 August 2025. Measured to today, those six rows sit 402 days past that statutory date.⁠²

Five of the six blanks belong to states the stale version of the page did not show as blank. That version carried three, Denmark, Finland and Hungary, and was read in the week the AI Office gained the power to fine a general-purpose model provider. Denmark's row now names Digitaliseringsstyrelsen, the Agency for Digital Government, and Finland's names Traficom, the Transport and Communications Agency. Austria, Belgium, Bulgaria, Croatia and Slovakia have appeared as blank. Only Hungary sits on both lists.

The register now shows twice as many gaps as the stale version did, and the refresh revealed that rather than caused it. An eleven-month-old page was concealing the real position. Somebody went into it, updated it, and after that update six rows are still empty, which is a harder fact than a stale footer. the Commission can fine a model provider at the centre; enforcement against a deployed high-risk system runs through a national authority that six governments have not named.

Deep Analysis

In plain English

The EU's AI Act is the bloc's main AI law. Since 2 August 2026, it lets Brussels fine the makers of large general-purpose AI models, the kind behind ChatGPT or Mistral's own products, up to 15 million euros or 3% of their worldwide revenue. But the law also requires every EU country to name a national regulator these companies can go to. As of 7 September, six of the 27 countries still have not named anyone. An AI company based in one of those six countries has, on paper, nowhere on the Commission's own list to file with, even though the fining power against it is already active.

Deep Analysis

Root Causes

Denmark and Finland closed their gaps by assigning the role to an existing agency, Digitaliseringsstyrelsen and Traficom respectively, bodies that already regulate digital government and telecoms.

The six states still blank have not designated any authority at all, existing or new, which points to a failure to start the institutional-assignment process rather than an administrative delay in publishing a webpage.

Source Landscape

This story draws on neutral-leaning sources from Belgium

Belgium

Primary parallel: GDPR's own national supervisory-authority rollout after 2018 left several member states without a fully resourced authority for years after the regulation took legal effect, without suspending enforcement elsewhere in the bloc.

Counter-parallel: GDPR carried no immediate financial exposure during that gap. The AI Act's GPAI fining power, up to €15m or 3% of global turnover, has been live since 2 August 2026, so the same kind of national gap now sits alongside an active penalty clock rather than a grace period.

Consensus view: The Future of Life Institute's independent AI Act tracker recorded, at its 17 June update, that 9 of 27 member states had designated both required authorities and 12 had partial arrangements, a materially fuller picture than the Commission's own register, which as of the 7 September refresh still names no authority at all for six states: Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia.

Counter-view: The European Commission has signalled a collaborative, risk-based approach before penalties, and Article 101's own procedure gives a provider the right to be heard before any fine is set, which the Commission's staff would argue softens the practical bite of an incomplete national contact list.

Key tension: Whether a GPAI provider can rely on the Commission's own enforcement-contact register when an independent monitor already recorded a fuller designation picture nearly three months earlier.

Sources:European Commission·EUR-Lex

Mentions:European Commission →EU AI Act →Denmark →Finland →Austria →Belgium →Bulgaria →Croatia →Hungary →Slovakia →Brussels →AI Office →Future of Life Institute →GDPR →ChatGPT →GPAI →

First Reported In

Update #15 · Mistral closes EUR 3bn; Luxembourg buys in

European Commission· 8 Sept 2026

Read original →

Causes and effects

Caused by

AI Act fines land on a stale register

The stale register recorded at the start of August is the baseline the 7 September refresh is measured against.

Occurred 2 Aug 2026

Read story →

This Event

Six states name no AI Act regulator

A company deploying a high-risk system in Austria, Belgium, Bulgaria, Croatia, Hungary or Slovakia cannot find a domestic authority to notify on the Commission's own list.

Different Perspectives

South Korean foreign ministry

Seoul said on 20 October it will withdraw some Kyiv embassy staff, citing no constructive steps from Kyiv since it recalled its ambassador over the disclosure of two North Korean prisoners. A chargé d'affaires and consular staff stay, and Seoul says its aid continues.

Alexander Lukashenko

Lukashenko said on 22 October that talks with the US show progress despite problems, which he said were highlighted with the exchange of political prisoners for the lifting of sanctions. He said Minsk keeps its promises and wants the US to deliver its side in full.

Moldovan government (Daniella Misail-Nichitin)

Moldova has pulled its border guards and customs officers from four crossings on Ukrainian soil after Russian strikes near the border. Interior Minister Daniella Misail-Nichitin said Chisinau is weighing moving Ukrainian checkpoints onto Moldovan territory.

Péter Magyar

Magyar told RTL that Ukrainian maize may cross Hungary in sealed trains bound for Western Europe. He set one condition: the cargo must only transit the country.

Donald Tusk

Tusk said Warsaw would seek an explanation from Kyiv for the drone's route across Poland. He said Poland allows no operations over its territory without its explicit consent.

Mindaugas Sinkevičius

Lithuania's prime minister said the Ukrainian drone that exploded in Pasvalys district on 18 October carried explosives and entered from Poland through the Schengen zone. Earlier drones over Lithuania had come from Belarus, not through allied airspace.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.