EU sets out AI Act governance and enforcement roles

The AI Act’s enforcement framework is built around the AI Office, established within the European Commission, and national market surveillance authorities responsible for implementing, supervising and enforcing the rules. The AI Office sits within a multistakeholder governance structure steered by 3 advisory bodies: the European Artificial Intelligence Board, the Scientific Panel and the Advisory Forum.

The Commission and the AI Office will work with national competent authorities that supervise implementation at national level. Market surveillance authorities oversee compliance for AI systems, including prohibitions and high-risk AI rules, while notifying authorities designate and supervise notified bodies that conduct pre-market conformity assessments. Each Member State should have designated and empowered national competent authorities until 2 August 2025.

The July 2026 action plan on Cybersecurity and AI outlines coordination to help Member States, businesses and public authorities address cybersecurity and resilience challenges linked to advanced AI models. The Commission also plans a call to expand EU evaluation capacity for AI models before they enter the EU market, with operations expected by 2027.

The AI Act also establishes cooperation channels for incidents involving potential violations of fundamental rights laws, including privacy and non-discrimination protections. Fundamental rights protection authorities gain rights to be informed by market surveillance authorities and to request information, documentation and cooperation.