Sixteen EU Countries Missed the AI Act Deadline to Name Enforcers. What It Means for Companies

The EU AI Act told every member state to name the national authorities that would enforce it by August 2, 2025. More than fifteen months later, most have not fully done so. The European Commission has confirmed that 16 of the 27 capitals missed the deadline: six have not picked a market surveillance authority at all, and ten have only a provisional choice that still needs formal adoption. German Green MEP Sergey Lagodinsky has now written to the Commission asking it to start formal proceedings against the countries that are behind, Politico Europe reported on November 8, 2026. For companies that build or use AI in Europe, the gap raises a practical question: who is actually supervising them, and does the delay change what they have to do?

What the AI Act required, and by when

Article 70 sets the basic structure of national enforcement. Each member state must establish or designate at least one notifying authority, which oversees the conformity assessment bodies that certify certain high-risk systems, and at least one market surveillance authority, which investigates AI systems on the market and imposes penalties. Where a country uses more than one market surveillance authority, one of them acts as the single point of contact for the public, other member states and Brussels. Member states must give those authorities adequate staff and budgets, report on their resources, and make their contact details publicly available by August 2, 2025.

That date was not arbitrary. Under Article 113, the governance chapter and the penalties chapter of the Act began to apply on August 2, 2025, a year after the regulation entered into force. The prohibitions in Article 5 and the AI literacy duty in Article 4 had applied since February 2, 2025. The national authorities were supposed to be in place as those rules took hold and before the bulk of the high-risk regime arrived.

The Commission’s own guidance is blunt about the consequence of missing the date. Its page on market surveillance authorities under the AI Act says that if member states fail to designate a market surveillance authority by that date, “the Commission may launch a formal infringement procedure.” The same page keeps a running list of single points of contact and marks designations still pending final adoption with an asterisk.

Who is behind, according to the Commission

Politico’s report, by Pieter Haeck, says the Commission confirmed that six countries, Austria, Belgium, Bulgaria, Croatia, Slovakia and Hungary, have not selected an authority, while ten other capitals have made a provisional decision that still needs to be adopted. That totals 16 states out of compliance with the designation requirement in some form. The remaining 11 have completed their designations.

Italy is an example of a country that has finished the job. It named its authorities in its national AI law in 2025 and then filled in supervision, fines and sandbox rules through a 2026 decree, which we covered in our guide to Italy’s Legislative Decree 179/2026 on AI Act regulators and fines. Its National Cybersecurity Agency appears on the Commission’s list as the single point of contact.

Lagodinsky’s letter and what a “formal procedure” would mean

According to Politico, Lagodinsky asked the Commission in a letter to start a formal procedure against capitals for failing to meet their legal obligations under the AI law. “Stop blaming the EU for missing the race if you miss your own deadlines,” he told the outlet. “Europe’s AI ambitions cannot be delivered if national capitals cannot get their act together.” He has made the same argument before. In a November 2025 interview he said member states had failed to designate competent authorities and that the Commission should already have opened infringement procedures.

An MEP cannot open infringement proceedings. Only the Commission can, under Article 258 of the Treaty on the Functioning of the European Union. The process has well-known stages:

1. Letter of formal notice. The Commission asks the member state to explain the failure, usually with a two-month reply window.
2. Reasoned opinion. If the answer is unsatisfactory, the Commission sets out why the state is in breach and gives a deadline to comply.
3. Referral to the Court of Justice. If the state still does not comply, the Commission can take it to the Court.
4. Financial penalties. If the state ignores a Court judgment, the Commission can go back and ask for lump sums or daily penalty payments under Article 260.

Most cases close at the first or second stage, often because the state adopts the missing measure. For companies, the realistic effect of a Commission move would be to speed up national designations, not to create new obligations.

A correction on the Czech quote

Some summaries of the Politico story attached a quote from Jan Kavalírek to the AI Act authority deadline. That is not what the article reports. Kavalírek, who served as the Czech Republic’s deputy minister of industry and trade and government commissioner for AI in 2025, was commenting on a different delay: the Commission’s second postponement of the deadline for consortia to express interest in building EU-backed AI compute hubs, part of a €30 billion program, which Brussels said would give member states time to complete budget processes. His point that member states “should be able to keep up with the deadlines and deliver all necessary documents in time to Brussels” was about that infrastructure process. The two delays make the same broader point about national follow-through, but they are separate issues.

What the delay does and does not change for companies

The most important legal fact is that the AI Act is a regulation, not a directive. It applies directly in every member state. A missing national authority does not suspend the prohibited-practice rules, the AI literacy obligation, or the transparency and general-purpose AI provisions as they phase in. It does change who can investigate and fine, and how quickly.

• Enforcement may be slower, but liability is not erased. Conduct that breaches the Act while a country has no authority can still be examined once one is appointed. Documentation you produce now is the evidence a future authority will read.
• Other regulators remain active. Data protection authorities still apply the GDPR to personal data processed by AI systems, and sector supervisors in finance, health and product safety still use their own powers.
• Complaints need somewhere to go. Article 85 gives anyone the right to complain to a market surveillance authority. In countries without one, complaints may be redirected or delayed, which can push disputes toward courts or data protection authorities instead.
• Cross-border consistency suffers. Coordination through the European AI Board works best when every country has a seat filled by an authority with real powers.

The timing questions are also moving at EU level. The Digital Omnibus on AI, adopted in July 2026, reworked parts of the Act, and our earlier analysis of how Brussels rewrote the clock on high-risk AI explains why the high-risk timetable became less certain. None of that changes the 2025 designation deadline, which has already passed.

Practical steps for AI governance teams

Build your compliance file as if every authority were already in place. Map each AI system to the countries where you place it on the market or use it, and note which national authority is designated, provisional or missing in each, using the Commission’s list. Keep risk documentation current, using a recognized method such as the NIST AI Risk Management Framework or ISO/IEC 42005 impact assessments to structure the evidence. Track AI literacy training records, since that duty has applied since February 2025. Finally, assign someone to watch national gazettes in the six countries without an authority. When those designations arrive, the new regulators will want to show they are active.

The policy debate is also increasingly linked to security. Politico noted that EU leaders are meeting in Dublin with AI safety on the agenda after a run of incidents and cyberattacks, a theme we explored in our piece on how Europe’s AI cyber debate is missing basic digital defense.

Frequently asked questions

Can a company ignore the AI Act in a country with no authority?

No. The regulation applies directly. The absence of an authority affects enforcement timing, not whether the rules bind you, and breaches can be pursued later.

Which authority supervises general-purpose AI models?

The Commission’s AI Office supervises and enforces the rules for general-purpose AI models. National market surveillance authorities handle AI systems, including prohibited practices and high-risk rules.

Has the Commission opened infringement cases yet?

Politico’s report describes Lagodinsky’s request. It does not report that the Commission has sent letters of formal notice on this issue. Watch the Commission’s monthly infringement package for any move.

Where can I check a country’s status?

The Commission’s list of single points of contact is the best public source, and the text of Article 70 on the AI Act Service Desk sets out what each state must provide.

Empty seats, same rulebook

The missed deadline says more about national administrative capacity than about the AI Act’s substance. For companies, the right response is not to wait for the slowest capital. Supervisors will eventually be appointed in all 27 states, and the first thing they will ask for is the evidence a company should already be keeping.