The AI Act entered into force on 1 August 2024 and its provisions on AI governance (Chapter VII) will apply from 2 August 2025. The AI governance on the EU level includes the AI Office, the European Artificial Intelligence Board, an advisory forum and a scientific panel of independent experts should also be established.
At the same time, on the national level, Member States are responsible for implementing and enforcing the AI Act. Each Member State shall establish or designate as national competent authorities at least one notifying authority and at least one market surveillance authority for the purposes of the AI Act (Art. 70 AI Act). Member States shall communicate to the Commission the identity of the notifying authorities and the market surveillance authorities and the tasks of those authorities, as well as any subsequent changes thereto. Member States shall designate a market surveillance authority to act as the single point of contact for the AI Act, and shall notify the Commission of the identity of the single point of contact. The Commission shall make a list of the single points of contact publicly available.
Notifying authority means the national authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. (Point (19) of Art. 3 of the AI Act)
Market surveillance authority means the national authority carrying out the activities and taking the measures pursuant to Regulation (EU) 2019/1020. (Point (26) of Art. 3 of the AI Act)
National competent authority means a notifying authority or a market surveillance authority; as regards AI systems put into service or used by Union institutions, agencies, offices and bodies, references to national competent authorities or market surveillance authorities in this Regulation shall be construed as references to the European Data Protection Supervisor. (Point (48) of Art. 3 of the AI Act)
According to the Recitals of the AI Act (Recital (153) of the AI Act, emphasis added),
[...] Member States may decide to appoint any kind of public entity to perform the tasks of the national competent authorities within the meaning of this Regulation, in accordance with their specific national organisational characteristics and needs. In order to increase organisation efficiency on the side of Member States and to set a single point of contact vis-à-vis the public and other counterparts at Member State and Union levels, each Member State should designate a market surveillance authority to act as a single point of contact.
It´s important to note that some special rules are applicable regarding the designation of market surveillance authorities for certain high-risk systems:
- for high-risk AI systems related to products covered by the Union harmonisation legislation listed in Section A of Annex I of the AI Act:
"[...], the market surveillance authority for the purposes of this Regulation shall be the authority responsible for market surveillance activities designated under those legal acts.
By derogation from the first subparagraph, and in appropriate circumstances, Member States may designate another relevant authority to act as a market surveillance authority, provided they ensure coordination with the relevant sectoral market surveillance authorities responsible for the enforcement of the Union harmonisation legislation listed in Annex I." (Art. 74(3) of the AI Act)
- for high-risk AI systems placed on the market, put into service, or used by financial institutions regulated by Union financial services law:
"[...], the market surveillance authority for the purposes of this Regulation shall be the relevant national authority responsible for the financial supervision of those institutions under that legislation in so far as the placing on the market, putting into service, or the use of the AI system is in direct connection with the provision of those financial services." (Art. 74(6) of the AI Act)
"By way of derogation from paragraph 6, in appropriate circumstances, and provided that coordination is ensured, another relevant authority may be identified by the Member State as market surveillance authority for the purposes of this Regulation." (Art. 74(7) of the AI Act)
- for high-risk AI systems used for (i) biometrics (remote biometric identification systems, AI systems intended to be used for biometric categorisation, AI systems intended to be used for emotion recognition) in so far as the systems are used for law enforcement purposes, border management and justice and democracy, (ii) law enforcement, (iii) migration, asylum and border control management, (iv) administration of justice and democratic processes:
"For high-risk AI systems listed in point 1 of Annex III to this Regulation, in so far as the systems are used for law enforcement purposes, border management and justice and democracy, and for high-risk AI systems listed in points 6, 7 and 8 of Annex III to this Regulation, Member States shall designate as market surveillance authorities for the purposes of this Regulation either the competent data protection supervisory authorities under Regulation (EU) 2016/679 or Directive (EU) 2016/680, or any other authority designated pursuant to the same conditions laid down in Articles 41 to 44 of Directive (EU) 2016/680. Market surveillance activities shall in no way affect the independence of judicial authorities, or otherwise interfere with their activities when acting in their judicial capacity." (Art. 74(8) of the AI Act)
The European Data Protection Board (EDPB) porposed the designation of data protection authorities as market surveillance authority:
The EDPB recommends that DPAs should be designated by Member States as MSAs for the high-risk AI systems mentioned in Article 74(8) AI Act. Further, the EDPB recommends that, taking account of the views of the national DPA, Member States consider appointing DPAs as MSAs for the remaining high-risk AI systems as listed in Annex III, particularly where those high-risk AI systems are in sectors likely to impact natural persons rights and freedoms with regard to the processing of personal data, unless those sectors are covered by a mandatory appointment required by the AI Act (e.g. the financial sector). (Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework, Point 9, p. 4)
In addition to the above, the EDPB also argues that the data protection authorities shouldd be designated as single points of contact under the AI Act:
Considering the above, since the single point of contact under the AI Act should be a MSA as provided for by Article 70(2) AI Act, DPAs (acting as MSAs) should be designated as the single points of contact for the public and counterparts at Member State and Union levels. This would be without prejudice to the representatives of Member State to the European Artificial Intelligence Board, which could be different, as indicated by Article 65(4)(b) AI Act. This would also enable a unified, consistent, and effective approach across the different sectors. (Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework, Point 10, p. 4)
As the application of the AI Act starts with the rules on prohibited AI practices as early as on 2 February 2025 and additional rules, including the ones concerning AI governance will become applicable as of 2 August, 2025, the Member States have limited time to decide on the designation of competent authorities.
An additional piece of the puzzle in the AI Act enforcement structure is provided in the Art. 77 of the AI Act, which sets out that by November 2, 2024, each Member State shall identify the public authorities or bodies supervising or enforcing the obligations under Union law protecting fundamental rights. A list of such authorities and bodies must also be made publicly available. Member States shall notify the list to the Commission and to the other Member States, and shall keep the list up to date.
What will be the role of such authorities or bodies protecting fundamental rights?
- National public authorities or bodies which supervise or enforce the respect of obligations under Union law protecting fundamental rights, including the right to non-discrimination, in relation to the use of high-risk AI systems referred to in Annex III [of the AI Act] shall have the power to request and access any documentation created or maintained [under the AI Act] in accessible language and format when access to that documentation is necessary for effectively fulfilling their mandates within the limits of their jurisdiction. The relevant public authority or body shall inform the market surveillance authority of the Member State concerned of any such request.
- Where the documentation referred to above [i.e. in Art. 77 (1) of the AI Act] is insufficient to ascertain whether an infringement of obligations under Union law protecting fundamental rights has occurred, the public authority or body protecting fundamental rights may make a reasoned request to the market surveillance authority, to organise testing of the high-risk AI system through technical means. The market surveillance authority shall organise the testing with the close involvement of the requesting public authority or body within a reasonable time following the request. (Art. 77 (1) and (3) of the AI Act)
- National authorities supervising and enforcing the respect of fundamental rights must be informed and fully cooperated with by national market surveillance authorities where risks to fundamental rights are identified. Such authorities shall also be involved in defining the necessary measures regarding the non-compliant AI systems (i.e. regarding the AI systems that pose risks to fundamental rights). [see Art. 79 (2) and Art. 82 (1) of the AI Act]
- Market surveillance authorities shall also inform the national authorities supervising and enforcing the respect of fundamental rights about serious incidents regarding AI systems (Art. 3 (49)). [see Art. 73 (7) of the AI Act]
My intention is to keep track of the designation of the national competent authorities in order to see how the AI governance landscape is shaped within the EU. Below, you will find a (continously updated) list of national competent authorities*:
(*If there is no formal designation yet in a Member State, but there are proposals or other sources for possible designation, I will refer to this information.)
Austria:
- KI-Servicestelle (AI Service Desk), which has been established at Rundfunk und Telekom Regulatory GmbH (RTR) supports currently the implementation of AI Act in Austria [Source: § 20c KOG and § 194a TKG + DE / EN]
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- The Austrian Ombudsman Board
- Data Protection Authority (DSB)
- Parliamentary Data Protection Committee (in relation to the members of the Parliament)
- Ombudsman for Equal Treatment and Equal Treatment Commission
- The Federal Disability Ombudsman
- Children´s and youth ombudsman office
- The Austrian Communication Authroiry
- Electoral boards
- Patent advocacy groups
- Federal Office of Meterology and Surveying
- The Federal Cartel Attorney
- Austrian Federal Office for Safety in Health Care
- Telecommunications Office
- Regulatory Authority and Arbitration Body for Rail Transport in Austria [Schienen Control GmbH]
- Financial Market Authority (FMA)
- Supervisory and Regulatory Authority for Energy
- Supervisory and Regulatory Authority fro Telecommunications and Postal Services
- Chambers of Labor
Belgium:
- [Update of 14.03.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: NL]:
- Authorities at the federal level:
- Algemene Directie Economische Inspectie (General Directorate of Economic Inspection)
- Arbeidsinspectie (Algemene Directie Toezicht op de Sociale Wetten; Algemene Directie Toezicht en Welzijn op het Werk) [Labor Inspection (General Directorate of Supervision of Social Laws; General Directorate of Supervision and Welfare at Work)]
- CCB (Centre for Cybersecurity Belgium)
- COC (Controleorgaan op de politionele informatie / Supervisory Authority for Police Information)
- Comité I (Vast Comité van Toezicht op de inlichtingen- en veiligheidsdiensten / Standing Intelligence and Security Services Supervisory Committee)
- Comité P (Vast Comité van Toezicht op de politiediensten / Standing Police Monitoring Committee)
- Federale Ombudsman
- FIRM (Federaal Instituut voor de bescherming en de bevordering van de Rechten van de Mens / Federal Institute for the Protection and Promotion of Human Rights)
- Gegevensbeschermingsautoriteit (Data Protection Authority )
- IGVM (Instituut voor de gelijkheid van vrouwen en mannen / Institute for Gender Equality)
- Myria
- Ombudsdienst voor de postsector (Ombudsperson for the postal sector)
- Ombudsrail (Ombudsdienst voor de treinreizigers / Rail Passenger Ombudsman Service)
- Unia
- Authorities at the Flemish level:
- Kinderrechtencommissariaat (Children's Rights Commissariat)
- Vlaams Mensenrechteninstituut (Flemish Human Rights Institute)
- Vlaamse Ombudsdienst (Flemish Ombudsman Service)
- Vlaamse Regulator voor de Media (Flemish Media Regulator)
- Vlaamse Sociale Inspectie (Flemish Social Inspection)
- Vlaamse Toezichtcommissie (Flemish Supervisory Commission)
- Authorities at the level of the German-speaking Community (Ostbelgien):
- Medienrat der Deutschsprachigen Gemeinschaft (Media Council of the German-speaking Community)
- Ombudsperson der Deutschsprachigen Gemeinschaft (Ombudsperson of the German-speaking Community)
- Authorities at the level of the French Community (Fédération Wallonie-Bruxelles):
- Conseil Supérieur de l’Audiovisuel (CSA) de la Fédération Wallonie-Bruxelles
- Délégué général de la Communauté française aux droits de l’enfant (General Delegate of the French Community for Children's Rights)
- Médiateur de la Wallonie et de la Fédération Wallonie-Bruxelles (Ombudsman of Wallonia and the Wallonia-Brussels Federation)
- Authorities at the level of the Walloon Region:
- Département de l’Inspection du Service Public de Wallonie Economie, Emploi, Recherche (Wallonia Public Service Inspection Department Economy, Employment, Research)
- Médiateur de la Wallonie et de la Fédération Wallonie-Bruxelles (Ombudsman of Wallonia and the Wallonia-Brussels Federation)
Bulgaria:
- [Update of 25.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- Омбудсман на Република България (Ombudsman of the Republic of Bulgaria)
- Комисия за защита на личните данни (Commission for Personal Data Protection)
- Комисия за защита от дискриминация (Commission for Protection against Discrimination)
- Комисия за защита на потребителите (Consumer Protection Commission)
- Комисия за регулиране на съобщенията (Communications Regulation Commission)
- Съвет за електронни медии (Council for Electronic Media)
- Държавна агенция за закрила на детето (State Agency for Child Protection)
- ИА "Главна инспекция по труда" (Executive Agency “General Labour Inspectorate”)
- Централна избирателна комисия (Central Election Commission)
Croatia:
- [Update of 13.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- Ombudswoman of the Republic of Croatia
- Ombudswoman for Children
- Ombudswoman for Gender Equality
- Ombudswoman for Persons with Disabilities
- Personal Data Protection Agency
- State Electoral Commission
- Agency for Electronic Media, Head of Legal and Personnel Department
Republic of Cyprus:
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EL / EN]:
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)
- Επίτροπος Διοικήσεως και Προστασίας Ανθρωπίνων Δικαιωμάτων (Commissioner for Administration and the Protection of Human Rights (Ombudsman))
- Γενικός Εισαγγελέας της Δημοκρατίας (Attorney-General of the Republic)
Czech Republic:
- [Update of 14.03.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: CZ]:
- Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
- Veřejný ochránce práv (Ombudsman)
Denmark:
- market surveillance authority: Digitaliseringsstyrelsen (Danish Agency for Digitisation) [Source: original / EN]
- [Update of 13.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: DA]:
- Datatilsynet (The Danish Data Protection Agency)
- Institut for Menneskerettigheder (The Danish Institute for Human Rights)
- Folketingets Ombudsmand (The Danish Parliamentary Ombudsman)
- Finanstilsynet (The Danish Financial Supervisory Authority)
- Radio- og Tv-nævnet (The Danish Radio and Television Board)
- Indenrigs- og Sundhedsministeriet (Ministry of Internal Affairs and Health)
- Forbrugerombudsmanden (the Danish Consumer Ombudsman)
Estonia:
- [Update of 13.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- Data Protection Inspectorate (Andmekaitse Inspektsioon)
- Gender Equality and Equal Treatment Commissioner (Soolise võrdõiguslikkuse ja võrdse kohtlemise volinik)
- Consumer Protection and Technical Surveillance Authority (Tarbijakaitse ja Tehnilise Järelevalve Amet)
Finland:
- [Update of 12.11.2024] proposed market surveillance authorities: a draft government proposal is available proposing several existing authorities to cover different segments [Source: the government proposal is available here]
- [Update of 13.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- Data Protection Ombudsman
- Non-Discrimination Ombudsman
- Ombudsman for Equality
- National Discrimination and Equality Tribunal of Finland
- Chancellor of Justice
- Parliamentary Ombudsman
- Occupational safety and health authorities (Regional State Administrative Agencies)
- Consumer Ombudsman
France:
- proposed market surveillance authority: Commission Nationale de l’Informatique et des Libertés (CNIL) [Source: CNIL]
- [Update of 13.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: FR]:
- Directorate General for Competition, Consumer Affairs and Fraud Control (la Direction générale de la concurrence, de la consommation et de la répression des frauds; DGCCRF)
- the National Commission for Information Technology and Civil Liberties (la Commission nationale de l’informatique et des libertés; CNIL)
- the Defender of Rights (le Défenseur des Droits)
(This list can be completed in the future.)
Germany:
- proposed market surveillance authority: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) and the data protection authorities of the federal states (proposal from the DSK*) [Source: DSK´s position paper] (*DSK: Datenschutzkonferenz, i.e. the forum of the data protection authorities of Germany) / Bundesnetzagentur (Federal Network Agency) was also proposed by experts to be designated as market surveillance authority [Source: Heise Online]
- [Update of 14.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: DE]:
- Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (The Federal Commissioner for Data Protection and Freedom of Information)
- Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner of Baden-Württemberg for Data Protection and Freedom of Information)
- Der Bayerische Landesbeauftragte für den Datenschutz The Bavarian State Commissioner for Data Protection)
- Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision)
- Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
- Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (The State Commissioner for Data Protection and the Right of Access to Files Brandenburg)
- Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen)
- Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (The Hamburg Commissioner for Data Protection and Freedom of Information)
- Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (The Hessian Commissioner for Data Protection and Freedom of Information)
- Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern (The State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania)
- Der Landesbeauftragte für den Datenschutz Niedersachsen (The State Commissioner for Data Protection of Lower Saxony)
- Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia)
- Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate)
- Unabhängiges Datenschutzzentrum Saarland Landesbeauftragte für Datenschutz und Informationsfreiheit (Independent Data Protection Center Saarland State Commissioner for Data Protection and Freedom of Information)
- Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner)
- Landesbeauftragte für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection Saxony-Anhalt)
- Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (Independent State Center for Data Protection Schleswig-Holstein)
- Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (Thuringian State Commissioner for Data Protection and Freedom of Information)
- Antidiskriminierungsstelle des Bundes (Federal Anti-Discrimination Agency)
- Ombudsstelle der Landesstelle für Gleichbehandlung – gegen Diskriminierung Senatsverwaltung für Arbeit, Soziales, Gleichstellung, Integration, Vielfalt und Antidiskriminierung (Ombudsman's Office of the State Office for Equal Treatment - against Discrimination Senate Department for Labor, Social Affairs, Equality, Integration, Diversity and Anti-Discrimination)
Greece:
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [source: EL]:
- Η Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (The Hellenic Data Protection Authority)
- Ο Συνήγορος του Πολίτη (The Ombudsman)
- Η Αρχή Διασφάλισης του Απορρήτου των Επικοινωνιών (The Hellenic Authority for the Safeguarding of the Privacy of Communications)
- Η Εθνική Επιτροπή Δικαιωμάτων του Ανθρώπου (The National Commission for Human Rights)
Hungary:
- market surveillance authority: a new authority should be set up as market surveillance authority [Source: 1301/2024. (IX. 30.) Gov. Resolution published in the Official Journal], this authority will operate the regulatory sandbox* (see Art. 57 of the AI Act)
Ireland:
- [Update of 18.03.2025] market surveillance authorities [Source: EN]:
- Central Bank of Ireland
- Commission for Communications Regulation
- Commission for Railway Regulation
- Competition and Consumer Protection Commission
- Data Protection Commission
- Health and Safety Authority
- Health Products Regulatory Authority
- Marine Survey Office of the Department of Transport
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [source: EN]:
- An Coimisiún Toghcháin
- Coimisiún na Meán
- Data Protection Commission
- Environmental Protection Agency
- Financial Services & Pensions Ombudsman
- Irish Human Rights & Equality Commission
- Ombudsman
- Ombudsman for Children
- Ombudsman for the Defence Forces
Italy:
- proposed market surveillance authority: Agenzia per l'Italia Digitale (AgID, Agency for Digital Italy) and Agenzia per la cybersicurezza nazionale (ACN, National Cybersecurity Agency) [Source: Dentons, Covington, Atto Senato n. 1146] (please also see the letter of Garante, the Italian data protection authority regarding the proposed structure of enforcement)
Latvia:
- [Update of 08.05.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- Tiesībsargs (Ombudsman of the Republic of Latvia)
Lithuania:
- [Update of 12.11.2024] proposed market surveillance authority [source: EN]: The Communications Regulatory Authority
- [Update of 12.11.2024] proposed notifying authority [source: EN]: The Innovation Agency
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [source: EN / LT]:
- Lygių galimybių kontrolieriaus tarnyba (Office of the Equal Opportunities Ombudsperson)
- Seimo kontrolierių įstaiga (The Seimas Ombudsmen's Office)
- Vaiko teisių apsaugos kontrolieriaus įstaiga (The Office of the Ombudsperson of Child's Rights)
- Žurnalistų etikos inspektoriaus tarnyba (The Office of the Inspector of Journalist Ethics)
Luxembourg:
- [Update of 05.12.2024] proposed market surveillance authority [source: FR]: National Data Protection Commission (La Commission nationale pour la protection des données)
- [Update of 14.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [source: FR]:
- Autorité luxembourgeoise indépendante de l’audiovisuel (ALIA) [Luxembourg Independent Audiovisual Authority]
- Commission nationale pour la protection des données (CNPD) [National Commission for Data Protection]
- Inspection du Travail et des Mines (ITM) [Labour and Mines Inspectorate]
Malta:
- [Update of 12.11.2024] market surveillance authorities [source: EN]: The Malta Digital Innovation Auhtority (MDIA) and the Information Data Protection Commission (IPC) have already been identified as market surveillance authorities.
- [Update of 12.11.2024] notifying authorities [source: EN]: The MDIA and the National Accreditation Board have been identified as notifying authorities.
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [source: EN]:
- Office of the Information and Data Protection Commissioner (Website: https://idpc.org.mt/)
- Malta Competition and Consumer Affairs Authority (Website: https://www.mccaa.org.mt/)
- National Commission for the Promotion of Equality (Website: https://ncpe.gov.mt/)
- Commission for the Rights of Persons with Disability (Website: https://www.crpd.org.mt/)
- The Office of the Ombudsman (Website: https://ombudsman.org.mt/)
- Department for Industrial and Employment Relations (Website: https://dier.gov.mt)
- JobsPlus Malta (Website: https://jobsplus.gov.mt/)
- Malta Broadcasting Authority (Website: https://ba.org.mt/)
- Director for the Protection of Minors (Website: https://fsws.gov.mt/)
- Electoral Commission Malta (Website: https://electoral.gov.mt/)
Netherlands:
- proposed market surveillance authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority) with some (mainly sectoral) exceptions [Source: 2nd (interim) advice on the Dutch supervisory structure for the AI Act]
- [Update of 20.11.2024] authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [source: NL]:
- For fundamental rights in the broad sense (EU Charter):
- College voor de Rechten van de Mens (Netherlands Institute for Human Rights, CRM)
- For data protection law (GDPR, 2016/679 and RGR, 2016/680):
- Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP)
- Supervision in the exercise of judicial functions
- Procureur-generaal bij de Hoge Raad (Procurator General at the Supreme Court)
- De voorzitter van de Afdeling Bestuursrechtspraak Raad van State (The chairman of the Administrative Jurisdiction Division of the Council of State, ABRvS)
- Het gerechtsbestuur van de Centrale Raad van Beroep (The court board of the Central Appeals Court, CRvB)
- Het gerechtsbestuur van het College van Beroep voor het bedrijfsleven (The court board of the Trade and Industry Appeals Tribunal, CBb)
- For fundamental rights in the broad sense (EU Charter):
Poland:
- [Update of 15.11.2024] proposed market surveillance authority [Source: draft law available in PL)]: a new authority is proposed to be set up as market surveillance authority, the Committee on Development and Security of Artificial Intelligence (Biura Komisji Rozwoju i Bezpieczeństwa Sztucznej Inteligencji)
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: PL / EN]:*
- Rzecznik Praw Dziecka (Ombudsman for Children´s Rights)
- Rzecznik Praw Pacjenta (Ombudsman for Patients' Rights)
- Państwowa Inspekcja Pracy (National Labour Inspectorate)[*The Data Protection Authority of Poland (UODO) expressed its concerns that UODO is not on the list of authorities responsible for the protection of fundamental rights.]
Portugal:
- [Update of 12.11.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [source: PT]:
- Inspeção-Geral das Finanças (IGF) [General Inspectorate of Finance]
- Gabinete Nacional de Segurança (GNS) [National Security Office]
- Entidade Reguladora da Comunicação Social (ERC) [Media Regulatory Authority]
- Inspeção-Geral da Defesa Nacional (IGDN) [General Inspection of National Defense]
- Inspeção-Geral dos Serviços de Justiça (IGSJ) [General Inspection of Justice Services]
- Polícia Judiciária [Judiciary Police]
- Inspeção-Geral da Administração Interna (IGAI) [Inspectorate-General for Internal Administration]
- Inspeção-Geral da Educação e Ciência (IGEC) [General Inspectorate for Education and Science]
- Entidade Reguladora da Saúde (ERS) [Health Regulatory Authority]
- Autoridade Nacional de Comunicações (ICP - ANACOM) [National Communications Authority]
- Autoridade de Segurança Alimentar e Económica (ASAE) [Food and Economic Safety Authority]
- Inspeção-Geral do Ministério do Trabalho, Solidariedade e Segurança Social (IGMTSSS) [General Inspectorate of the Ministry of Labor, Solidarity and Social Security]
- Autoridade para as Condições do Trabalho (ACT) [Authority for Working Conditions]
- Entidade Reguladora dos Serviços Energéticos (ERSE) [Energy Services Regulatory Authority]
Romania:
- [Update of 14.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: RO]:
- Avocatul Poporului (Ombudsman)
- Autoritatea Națională pentru Protecția Consumatorilor (National Authority for Consumer Protection)
- Consiliul Național pentru Combaterea Discriminării (CNCD) [National Council for Combating Discrimination]
- Agenţia Naţională pentru Egalitatea de Şanse între Femei şi Bărbaţi [National Agency for Equal Opportunities for Women and Men]
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) [National Supervisory Authority for Personal Data Processing]
- Autoritatea Națională pentru Protecția Drepturilor Copilului și Adopție [National Authority for the Protection of Children's Rights and Adoption]
- Ministerul Muncii și Solidarității Sociale / Inspecția Muncii [Ministry of Labor and Social Solidarity / Labor Inspectorate]
- Consiliul Național al Audiovizualului [National Audiovisual Council]
- Autoritatea Electorală Permanentă [Permanent Electoral Authority]
Slovakia:
- [Update of 17.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: SK/EN]:
- Úrad na ochranu osobných údajov SR (Office for Personal Data Protection of the Slovak Republic)
- Verejný ochranca práv – ombudsman (VOP), JUDr. Róbert Dobrovodský, PhD., LL.M. (Public defender of rights – ombudsman)
Slovenia:
- [Update of 13.03.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: SL]:
- Zagovornik načela enakosti (The Equality Ombudsman)
- Informacijski pooblaščenec (Information Commissioner)
- Agencija za komunikacijska omrežja in storitve RS (The Agency for Communication Networks and Services of the Republic of Slovenia)
- Tržni inšpektorat RS (the Market Inspectorate of the Republic of Slovenia)
- Inšpektorat RS za notranje zadeve (Inspectorate of Internal Affairs of the Republic of Slovenia)
- Inšpektorat RS za delo (Labour Inspectorate of the Republic of Slovenia)
- Inšpektorat RS za šolstvo (Inspectorate of Education of the Republic of Slovenia)
- Inšpektorat RS za kulturo in medije (Inspectorate of Culture and Media of the Republic of Slovenia)
- Inšpektorat RS za okolje in energijo (Inspectorate of Environment and Energy of the Republic of Slovenia)
- Inšpektorat RS za naravne vire in prostor (Inspectorate of Natural Resources and Spatial Planning)
Spain:
- market surveillance authority: Agencia Española de Supervisión de Inteligencia Artificial (AESIA, Artificial Intelligence Supervisory Agency) [Source: AESIA Statute approved by Royal Decree 729/2023 / EN]
- [Update of 10.12.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- Consejo General del Poder Judicial (General Council of the Judiciary)
- Inspección de Trabajo y Seguridad Social (Labor and Social Security Inspection)
- Junta Electoral Central (Central Electoral Board)
- Comisión Nacional de los Mercados y Competencia (National Commission for Markets and Competition)
- Defensor del Pueblo (Ombudsman)
- Agencia Española de Protección de Datos (Spanish Data Protection Agency)
- Consejo de Transparencia de Gobierno (Government Transparency Council)
- Unidad de Coordinación de Ciberseguridad, dependiente de la Dirección General de Coordinación y Estudios (Cybersecurity Coordination Unit, under the General Directorate of Coordination and Studies)
- Autoritat Catalana de Protecció de Dades (Catalan Data Protection Authority)
- Inspecció de Treball de Catalunya (Labor Inspection of Catalonia)
- Consejo de Transparencia y de Protección de Datos de Andalucía (Andalusian Council for Transparency and Data Protection)
- Subdirección de Inspección de Trabajo del País Vasco (Dirección de Trabajo y Seguridad Social) [Basque Country Labor Inspection Sub-directorate (Directorate of Labor and Social Security)]
Sweden:
- [Update of 08.05.2025] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
- Diskrimineringsombudsmannen (DO) (Equality Ombudsman)
- Integritetsskyddsmyndigheten (IMY) (Swedish Authority for Privacy Protection)
- Justitiekanslern (Chancellor of Justice)
- Riksdagens Ombudsmän (JO) (Parliamentary Ombudsmen)
EU:
- [Update of 10.12.2024] market surveillance authority of the European Union Institutions, Agencies and Bodies: European Data Protection Supervisor (EDPS)
- [Update of 10.12.2024] Authorities identified in line with Art. 77 of the AI Act (authorities protecting fundamental rights) [Source: EN]:
