EU AI Act tracker

EU AI Act authorities, national measures and sandboxes by country

Find the single point of contact, named authorities and roles, binding national implementation measure, and AI regulatory sandbox status for each of the EU’s 27 member states. Every country profile links to the official sources supporting its claims.

Data snapshot: 1 September 2026. Data version: 2026-09-01.1. The status labels are Kritia research classifications, not official EU status labels.

Binding national measures in force: 11

Country notes preserve any important limit on scope.

Binding designations verified: 4

A designation exists without a broader national measure recorded.

No binding designation verified: 12

Proposed or announced arrangements remain explicitly labelled.

Sandbox snapshot: 3 operational, 19 planned and 5 with no status verified or none identified.

How to read the tracker

The EU AI Act applies directly; this tracker describes the national layer around it. A country does not need a national act to make the regulation apply. The three labels below say only what binding national measure or Article 70 designation Kritia could verify on the snapshot date.

Binding national measure in force

A binding national implementation measure is recorded as in force. The country note preserves important limits on its scope.

Binding authority designation verified

A binding authority designation is verified, but no broader national implementation measure is recorded in this snapshot.

No binding designation verified

Kritia could verify neither a binding national implementation measure nor an Article 70 authority designation at the snapshot date. Proposed arrangements are labelled as such.

Authority roles are different

A market-surveillance authority enforces compliance; a notifying authority handles conformity-assessment bodies; and the single point of contact coordinates the national contact layer. An Article 77 fundamental-rights authority, advisory office or proposed body is not automatically an Article 70 market-surveillance authority.

Sandbox labels are bounded

Operational means official material supports a live national programme. Planned includes a programme, framework or pilot still being prepared. Status not verified means Kritia found no reliable confirmation at the snapshot date; it does not prove that no sandbox activity exists.

Evidence standard

Official EU material, national legislation and official government or regulator publications are preferred.
A draft, consultation or announcement does not change a status unless a binding instrument can be verified.
A source may support one field without supporting every statement in the profile; each source says what it supports.
Material caveats remain in the country note instead of being flattened into the headline label.

Official starting points

Those official materials and national instruments control. This page is Kritia’s dated compilation, not an official EU register and not legal advice. The tracker is reviewed as a versioned snapshot; a material source or status correction requires an updated data version.

At a glance

Compare all 27 member states

Use this table for the shortest answer, then open the country profile for authority roles, legal caveats and field-level sources.

EU AI Act national implementation, contact point and regulatory sandbox comparison for all 27 member states
Country	National status	Single point of contact	Sandbox	Evidence
Austria	Not verified	Not verified	Planned	View profile
Belgium	Not verified	Not verified	Planned	View profile
Bulgaria	Not verified	Not verified	Status not verified	View profile
Croatia	Not verified	Not verified	Status not verified	View profile
Cyprus	Designation verified	Commissioner of Communications	Status not verified	View profile
Czechia	Not verified	Not verified	Planned	View profile
Denmark	Measure in force	Danish Agency for Digital Government (Digitaliseringsstyrelsen)	Operational	View profile
Estonia	Not verified	Not verified	Status not verified	View profile
Finland	Measure in force	Finnish Transport and Communications Agency (Traficom)	Planned	View profile
France	Not verified	Not verified	Planned	View profile
Germany	Measure in force	Federal Network Agency (Bundesnetzagentur)	Planned	View profile
Greece	Measure in force	Hellenic Data Protection Authority (HDPA)	Planned	View profile
Hungary	Measure in force	Minister of Enterprise Development	Planned	View profile
Ireland	Measure in force	AI Office of Ireland (Oifig IS na hÉireann)	Planned	View profile
Italy	Measure in force	National Cybersecurity Agency (ACN)	Planned	View profile
Latvia	Designation verified	Consumer Rights Protection Centre (PTAC)	Operational	View profile
Lithuania	Measure in force	Communications Regulatory Authority (RRT)	Operational	View profile
Luxembourg	Not verified	Not verified	Planned	View profile
Malta	Measure in force	Malta Digital Innovation Authority (MDIA)	Planned	View profile
Netherlands	Not verified	Not verified	Planned	View profile
Poland	Measure in force	Commission for the Development and Safety of Artificial Intelligence	Planned	View profile
Portugal	Not verified	Not verified	Planned	View profile
Romania	Not verified	Not verified	Status not verified	View profile
Slovakia	Not verified	Not verified	Planned	View profile
Slovenia	Measure in force	Agency for Communication Networks and Services (AKOS)	Planned	View profile
Spain	Designation verified	Spanish Artificial Intelligence Supervisory Agency (AESIA)	Planned	View profile
Sweden	Designation verified	Swedish Post and Telecom Authority (PTS)	Planned	View profile

All 27 member states

Country profiles

Snapshot 1 September 2026 · version 2026-09-01.1

AT · EU member state
Austria
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Austria at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
No binding authority designation verified at this snapshot.
Regulatory sandbox
Planned
Country note. Austria has designated no AI Act authority. RTR's KI-Servicestelle is an advisory help desk, not a supervisor, and must not be treated as one.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- AI Act implementation FAQ — Austrian Regulatory Authority for Broadcasting and Telecommunications. The absence of a completed national authority implementation and the service desk's advisory role.
- Parliamentary answer on national AI sandboxes — Austrian Parliament. Preparatory sandbox work without a settled host or timetable.
BE · EU member state
Belgium
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Belgium at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
No binding authority designation verified at this snapshot.
Regulatory sandbox
Planned
Country note. BIPT is the government's intended lead, but implementing legislation and the cooperation agreement remain in preparation. Belgium's notified Article 77 bodies are not market surveillance authorities; draft work also provides for a national sandbox.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Draft BIPT operational plan 2026 — Belgian Institute for Postal Services and Telecommunications. BIPT's proposed coordination role and legislation still in preparation.
- Committee report on AI Act implementation — Belgian Chamber of Representatives. Ongoing bill, cooperation-agreement and national-sandbox work.
BG · EU member state
Bulgaria
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Bulgaria at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: status not verified.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
No binding authority designation verified at this snapshot.
Regulatory sandbox
Status not verified
Country note. No binding authority designation or implementing law was verified. An unadopted member-sponsored bill proposes an authority structure and sandbox, while the government says its own law is planned for autumn 2026.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Council of Ministers agenda — 9 July 2026 — Council of Ministers of Bulgaria. The government's stated timetable for a national implementation law.
- Artificial-intelligence bill dossier — National Assembly of Bulgaria. The existing member-sponsored proposal and its unadopted status.
HR · EU member state
Croatia
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Croatia at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: status not verified.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
No binding authority designation verified at this snapshot.
Regulatory sandbox
Status not verified
Country note. No authority designated. An implementing bill is being prepared by the Ministry of Justice, Administration and Digital Transformation.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- 2026 public-consultation plan — Croatian Ministry of Justice, Public Administration and Digital Transformation. The planned Q3 2026 consultation for an implementing bill.
- Register of legislative drafting groups — Croatian Ministry of Justice, Public Administration and Digital Transformation. The active national drafting group.
CY · EU member state
Cyprus
Designation verified
Cyprus has a binding authority designation, but Kritia records no broader national implementation measure in this snapshot. Commissioner of Communications is recorded as the single point of contact. Regulatory sandbox: status not verified.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
Commissioner of Communications
Named authorities and roles
Commissioner of Communications
Commissioner for Personal Data Protection (specified Annex III areas)
Regulatory sandbox
Status not verified
Country note. Designated early, by Council of Ministers decision of 22 January 2025 — a designation instrument, not an implementing statute.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Cyprus AI Act authority designation — Deputy Ministry of Research, Innovation and Digital Policy. The 22 January 2025 decision, contact point and designated authority remits.
CZ · EU member state
Czechia
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Czechia at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
Czech Telecommunication Office (proposed)
Czech National Bank (proposed, financial services)
Office for Personal Data Protection (proposed)
Office for Standards, Metrology and Testing (proposed notifying authority)
Regulatory sandbox
Planned
Country note. An adaptation act cleared interministerial comment but had not been enacted. Treat the authorities below as proposed.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Draft Artificial Intelligence Act announcement — Czech Ministry of Industry and Trade. The draft status, proposed authority allocation and planned sandbox.
DK · EU member state
Denmark
Measure in force
Denmark has a binding national implementation measure in force. Danish Agency for Digital Government (Digitaliseringsstyrelsen) is recorded as the single point of contact. Regulatory sandbox: operational.
National implementation measure
Act No. 467 of 14 May 2025 (Denmark)
Single point of contact
Danish Agency for Digital Government (Digitaliseringsstyrelsen)
Named authorities and roles
Danish Agency for Digital Government (Digitaliseringsstyrelsen)
Danish Data Protection Agency (Datatilsynet)
Danish Court Administration (Domstolsstyrelsen)
Regulatory sandbox
Operational
Country note. Scope limit worth knowing: the Danish Act currently makes only the Article 5 prohibited practices enforceable. The bill extending supervision and sanctions to high-risk and Article 50 transparency duties has not passed.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Act No. 467 of 14 May 2025 — Danish Legal Information. Denmark's central contact and market-surveillance authority allocation.
- Regulatory sandbox for AI — Danish Agency for Digital Government. The operational national sandbox.
EE · EU member state
Estonia
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Estonia at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: status not verified.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
Consumer Protection and Technical Regulatory Authority (TTJA, proposed)
Regulatory sandbox
Status not verified
Country note. No binding Article 70 designation or implementing law was verified. Estonia's 2026–2029 market-surveillance strategy names TTJA as the responsible authority in planning and marks the implementing measures to be confirmed.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- National Market Surveillance Strategy 2026–2029 — Estonian Ministry of Economic Affairs and Communications. TTJA's planned role and implementing measures still marked to be confirmed.
FI · EU member state
Finland
Measure in force
Finland has a binding national implementation measure in force. Finnish Transport and Communications Agency (Traficom) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Act on the Supervision of Certain Artificial Intelligence Systems (1377/2025) (Finland)
Single point of contact
Finnish Transport and Communications Agency (Traficom)
Named authorities and roles
Finnish Transport and Communications Agency (Traficom)
Finnish Safety and Chemicals Agency (Tukes)
Finnish Supervisory Agency (Lupa- ja valvontavirasto)
Regulatory sandbox
Planned
Country note. Decentralised model: supervision is split across nine sectoral authorities, with Traficom coordinating and supervising the Article 50 transparency duties.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Act on the Supervision of Certain Artificial Intelligence Systems 1377/2025 — Finlex. Finland's distributed authority model and Traficom's coordinating role.
- AI regulatory sandboxes — Traficom. The planned framework and current pilot activity.
FR · EU member state
France
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for France at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
Directorate-General for Competition, Consumer Affairs and Fraud Control (DGCCRF, coordinating)
National Commission on Informatics and Liberty (CNIL)
Regulatory Authority for Audiovisual and Digital Communication (ARCOM)
Regulatory sandbox
Planned
Country note. The authority allocation is a government scheme announced in September 2025 and is conditional on legislation that has not passed. No binding designation is in force.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Proposed French AI Act supervision structure — Directorate-General for Competition, Consumer Affairs and Fraud Control. The proposed DGCCRF coordination role and distributed authority scheme.
- AI Act implementation bill dossier — French Senate. The bill's parliamentary status rather than an enacted designation.
DE · EU member state
Germany
Measure in force
Germany has a binding national implementation measure in force. Federal Network Agency (Bundesnetzagentur) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
KI-Marktüberwachungs- und -Innovationsförderungs-Gesetz (KI-MIG), BGBl. 2026 I Nr. 223, in force 29 July 2026 (Germany)
Single point of contact
Federal Network Agency (Bundesnetzagentur)
Named authorities and roles
Federal Network Agency (Bundesnetzagentur) — central market surveillance authority
Independent AI Market Surveillance Chamber at the Bundesnetzagentur
Federal Financial Supervisory Authority (BaFin) — regulated financial services
Regulatory sandbox
Planned
Country note. KI-MIG centralises supervision at the Bundesnetzagentur, which is also the single point of contact and runs an AI service desk and testing sandboxes.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- KI-Marktüberwachungs- und -Innovationsförderungsgesetz — Federal Ministry of Justice — Laws on the Internet. BNetzA, BaFin, the independent chamber, contact point and statutory sandbox mandate.
GR · EU member state
Greece
Measure in force
Greece has a binding national implementation measure in force. Hellenic Data Protection Authority (HDPA) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Law 5321/2026 (Greece), Government Gazette 20 July 2026
Single point of contact
Hellenic Data Protection Authority (HDPA)
Named authorities and roles
Hellenic Data Protection Authority (HDPA) — prohibited practices, high-risk and transparency
Hellenic Telecommunications and Post Commission (EETT) — notifying authority
Regulatory sandbox
Planned
Country note. Greece goes beyond the EU baseline in places. EETT is the notifying authority and hosts the national sandbox jointly with the HDPA.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Law 5321/2026 — Government Gazette record — National Printing Office of Greece. Greece's national implementation statute.
- Hellenic DPA role in AI Act implementation — Hellenic Data Protection Authority. The HDPA contact, surveillance and joint-sandbox roles.
HU · EU member state
Hungary
Measure in force
Hungary has a binding national implementation measure in force. Minister of Enterprise Development is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Act LXXV of 2025 (Hungary), in force 1 December 2025
Single point of contact
Minister of Enterprise Development
Named authorities and roles
Minister of Enterprise Development — AI market surveillance authority
Central Bank of Hungary (Magyar Nemzeti Bank) — financial services
National Accreditation Authority — notifying authority
Regulatory sandbox
Planned
Country note. Act LXXV is a framework act; Government Decree 344/2025 makes the actual designations. The market surveillance authority sits inside the ministry rather than being a standalone agency.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Act LXXV of 2025 — Hungarian National Legislation Database. Hungary's national AI framework and sandbox duty.
- Government Decree 344/2025 — Hungarian National Legislation Database. The authority designations and sector allocation.
IE · EU member state
Ireland
Measure in force
Ireland has a binding national implementation measure in force. AI Office of Ireland (Oifig IS na hÉireann) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Regulation of Artificial Intelligence Act 2026 (Ireland)
Single point of contact
AI Office of Ireland (Oifig IS na hÉireann)
Named authorities and roles
AI Office of Ireland (coordination and single point of contact)
Central Bank of Ireland
Coimisiún na Meán
Commission for Communications Regulation (ComReg)
Commission for Railway Regulation
Commission for Regulation of Utilities
Competition and Consumer Protection Commission
Data Protection Commission
Health and Safety Authority
Health Products Regulatory Authority
Health Service Executive
Marine Survey Office
National Transport Authority
Workplace Relations Commission
Regulatory sandbox
Planned
Country note. Distributed model: the AI Office and thirteen existing sector bodies are designated for market surveillance. Two ministers additionally act as notifying authorities; the designation instrument assigns specific remits rather than one catch-all regulator.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Regulation of Artificial Intelligence Act 2026 — Oireachtas. The enacted Irish implementation statute and AI Office functions.
- S.I. No. 403/2026 — commencement order — Irish Statute Book. The 31 July commencement and its two specified exceptions.
- S.I. No. 405/2026 — competent-authority designations — Irish Statute Book. The market-surveillance and notifying-authority remits.
- EU Artificial Intelligence Act — Irish implementation and authorities — Department of Enterprise, Tourism and Employment. Ireland's distributed model, competent-authority list and AI Office role.
- National competent authorities — AI Office of Ireland. The AI Office's live description of designated Irish authorities.
- Ireland's AI Regulatory Sandbox Programme — AI Office of Ireland. The sandbox programme's current development status.
IT · EU member state
Italy
Measure in force
Italy has a binding national implementation measure in force. National Cybersecurity Agency (ACN) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Law No. 132 of 23 September 2025, Article 20(2) (Italy)
Single point of contact
National Cybersecurity Agency (ACN)
Named authorities and roles
National Cybersecurity Agency (ACN) — general market surveillance
Agency for Digital Italy (AgID) — notifying authority
Bank of Italy (Banca d'Italia) — financial services
Italian Companies and Exchange Commission (CONSOB) — financial markets
Institute for Insurance Supervision (IVASS) — insurance
Regulatory sandbox
Planned
Country note. The strongest designation in the union: it is explicit in Article 20(2) of the statute itself, not in a secondary instrument.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Law No. 132 of 23 September 2025 — Italian Official Gazette. Article 20's ACN, AgID, financial-sector and contact-point designations.
LV · EU member state
Latvia
Designation verified
Latvia has a binding authority designation, but Kritia records no broader national implementation measure in this snapshot. Consumer Rights Protection Centre (PTAC) is recorded as the single point of contact. Regulatory sandbox: operational.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
Consumer Rights Protection Centre (PTAC)
Named authorities and roles
Consumer Rights Protection Centre (PTAC)
Health Inspectorate (Veselības inspekcija)
Regulatory sandbox
Operational
Country note. PTAC is notified to the Commission as supervisor and single point of contact, and Latvia's special regulatory environment is operating; Latvia has no implementing statute in this snapshot.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Special regulatory environment (AI sandbox) — State Digital Development Agency of Latvia. The operational sandbox, application count and selected participants.
LT · EU member state
Lithuania
Measure in force
Lithuania has a binding national implementation measure in force. Communications Regulatory Authority (RRT) is recorded as the single point of contact. Regulatory sandbox: operational.
National implementation measure
Laws XV-106 (Information Society Services amendment) and XV-105 (Technology and Innovation amendment), in force 1 April 2025 (Lithuania)
Single point of contact
Communications Regulatory Authority (RRT)
Named authorities and roles
Communications Regulatory Authority (RRT) — market surveillance and single point of contact
Innovation Agency Lithuania — notifying authority and regulatory sandbox
Regulatory sandbox
Operational
Country note. Designated ahead of the deadline by two amending laws effective 1 April 2025, with an operational sandbox.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Law XV-106 amending the Law on Information Society Services — Seimas of the Republic of Lithuania. RRT's market-surveillance and contact-point role.
- Law XV-105 amending the Law on Technology and Innovation — Seimas of the Republic of Lithuania. The Innovation Agency's notifying-authority and sandbox functions.
- Lithuanian AI regulatory sandbox — Ministry of the Economy and Innovation of Lithuania. The sandbox's operational status since October 2025.
LU · EU member state
Luxembourg
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Luxembourg at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
National Commission for Data Protection (CNPD, proposed)
Regulatory sandbox
Planned
Country note. No authority is legally designated. Draft law 8476 has been before the Media and Communications Committee since January 2025.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Bill 8476 dossier — Chamber of Deputies of Luxembourg. The draft's committee status and absence of an enacted designation.
- Deposited text of Bill 8476 — Chamber of Deputies of Luxembourg. The proposed CNPD coordination, sector authorities and sandbox.
MT · EU member state
Malta
Measure in force
Malta has a binding national implementation measure in force. Malta Digital Innovation Authority (MDIA) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Artificial Intelligence Regulations, 2025 (Legal Notices 226 and 227 of 2025) (Malta)
Single point of contact
Malta Digital Innovation Authority (MDIA)
Named authorities and roles
Malta Digital Innovation Authority (MDIA) — lead market surveillance authority
Information and Data Protection Commissioner (IDPC)
Regulatory sandbox
Planned
Country note. Legislated by legal notices under the Malta Digital Innovation Authority Act rather than by a standalone statute.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Artificial Intelligence Regulations, 2025 — Legal Notice 226 — Legislation Malta. MDIA's lead authority, contact-point and sandbox functions.
- Artificial Intelligence Regulations, 2025 — Legal Notice 227 — Legislation Malta. The complementary Maltese authority allocation.
NL · EU member state
Netherlands
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Netherlands at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
Dutch Data Protection Authority (Autoriteit Persoonsgegevens) — co-coordinating
State Inspectorate for Digital Infrastructure (RDI) — co-coordinating
Human Environment and Transport Inspectorate (ILT)
Regulatory sandbox
Planned
Country note. Treat these designations as intended rather than enacted: the implementing Act is still a pre-parliamentary draft. The Netherlands plans no national top-up beyond the Act.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- AI Regulation Implementation Act consultation — Government of the Netherlands. The consultation-draft status, proposed authority structure and sandbox provisions.
- Proposed AP and RDI supervision roles — Dutch Data Protection Authority. The intended co-coordination roles, not enacted powers.
PL · EU member state
Poland
Measure in force
Poland has a binding national implementation measure in force. Commission for the Development and Safety of Artificial Intelligence is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Act of 3 July 2026 on Artificial Intelligence Systems, Dz.U. 2026 poz. 1003, in force 11 August 2026 (Poland)
Single point of contact
Commission for the Development and Safety of Artificial Intelligence
Named authorities and roles
Commission for the Development and Safety of Artificial Intelligence
Regulatory sandbox
Planned
Country note. The Act entered into force on 11 August 2026, but substantial institutional and enforcement provisions commence on 28 October 2026. KRiBSI is the named market-surveillance authority and single point of contact.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Act of 3 July 2026 on Artificial Intelligence Systems — Polish Legal Acts Database. The Polish authority, contact-point, commencement and sandbox framework.
- AI regulatory sandboxes — Polish Ministry of Digital Affairs. The sandbox's planned rather than operational status.
PT · EU member state
Portugal
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Portugal at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
National Communications Authority (ANACOM, proposed role)
Regulatory sandbox
Planned
Country note. Official governance material gives ANACOM roles in AI coordination and lists it under Article 77, but Kritia could not verify a binding Article 70 market-surveillance or single-point-of-contact designation.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- AI Act governance model — Government of Portugal — Digital Portugal. ANACOM's announced governance role without proving a binding Article 70 designation.
- Article 77 fundamental-rights authorities — Government of Portugal — Digital Portugal. The Article 77 list, which must not be presented as Article 70 market-surveillance designation.
RO · EU member state
Romania
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Romania at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: status not verified.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
National Authority for Management and Regulation in Communications (ANCOM, proposed)
Financial Supervisory Authority (ASF) and National Bank of Romania (proposed, financial services)
Regulatory sandbox
Status not verified
Country note. ANCOM is named by a government memorandum, but ANCOM itself still describes the role as proposed. Not yet enforceable.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Artificial Intelligence Act in Romania — implementation status — National Authority for Management and Regulation in Communications. The proposed ANCOM and sectoral roles and their dependence on future national legislation.
SK · EU member state
Slovakia
Not verified
Kritia could not verify a binding national implementation measure or Article 70 authority designation for Slovakia at this snapshot. Any authority names below are explicitly proposed or announced. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
No single point of contact verified at this snapshot.
Proposed or announced authorities
Office for Digital Integrity (proposed single point of contact)
Office for Standardisation, Metrology and Testing (proposed notifying authority)
Regulatory sandbox
Planned
Country note. The draft act remains in the official Slov-Lex legislative process and has not been enacted. The authorities and sandbox below are proposed, not binding designations.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Legislative process LP/2026/17 — Slov-Lex. The implementation measure's continuing draft status.
- Consultation comments for LP/2026/17 — Slov-Lex. The official consultation record without relying on an unverified objection count.
SI · EU member state
Slovenia
Measure in force
Slovenia has a binding national implementation measure in force. Agency for Communication Networks and Services (AKOS) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
Act on the Implementation of Regulation (EU) 2024/1689 (ZIUDHPUI), Uradni list RS 85/2025, in force 21 November 2025 (Slovenia)
Single point of contact
Agency for Communication Networks and Services (AKOS)
Named authorities and roles
Agency for Communication Networks and Services (AKOS)
Information Commissioner
Bank of Slovenia
Insurance Supervision Agency
Market Inspectorate of the Republic of Slovenia
Regulatory sandbox
Planned
Country note. One of the earliest member states to legislate. The Act adds no substantive obligations beyond the Regulation itself.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Act implementing Regulation (EU) 2024/1689 — Official Gazette of the Republic of Slovenia. AKOS, sector authorities and the national sandbox mandate.
- AI Act implementation overview — Agency for Communication Networks and Services of Slovenia. The sandbox's planned status and AKOS coordination role.
ES · EU member state
Spain
Designation verified
Spain has a binding authority designation, but Kritia records no broader national implementation measure in this snapshot. Spanish Artificial Intelligence Supervisory Agency (AESIA) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
Spanish Artificial Intelligence Supervisory Agency (AESIA)
Named authorities and roles
Spanish Artificial Intelligence Supervisory Agency (AESIA)
Spanish Data Protection Agency (AEPD)
Bank of Spain (Banco de España)
Regulatory sandbox
Planned
Country note. AESIA exists under Royal Decree 729/2023, but Spain's AI Act implementing bill is still in committee. The 2023 sandbox was a time-limited pilot; the successor national sandbox remains tied to pending legislation.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Royal Decree 817/2023 — controlled AI testing environment — Spanish Official State Gazette. The time limit on Spain's pilot sandbox rather than a continuing national sandbox.
SE · EU member state
Sweden
Designation verified
Sweden has a binding authority designation, but Kritia records no broader national implementation measure in this snapshot. Swedish Post and Telecom Authority (PTS) is recorded as the single point of contact. Regulatory sandbox: planned.
National implementation measure
No binding national implementation measure verified at this snapshot.
Single point of contact
Swedish Post and Telecom Authority (PTS)
Named authorities and roles
Swedish Post and Telecom Authority (PTS) — coordinating
Swedish Authority for Privacy Protection (IMY)
Swedish Financial Supervisory Authority (Finansinspektionen)
Swedish Medical Products Agency (Läkemedelsverket)
Swedish Board for Accreditation and Conformity Assessment (Swedac)
Regulatory sandbox
Planned
Country note. Five authorities were tasked by government decision of 4 June 2026 (Fi2026/01365). No complementing statute is in force.
Official sources for this profile
Reviewed for the 1 September 2026 snapshot. Each description states the field or claim that source supports.
- Market Surveillance Authorities under the AI Act — European Commission. The Commission's published contact-point and authority layer; its own update date remains part of the evidence.
- Government decision Fi2026/01365 — Government of Sweden. The 4 June 2026 tasking of five national authorities.

A regulator name is not a scope answer

This tracker records the national authority layer. It does not decide which AI Act or GDPR duties reach a particular business. For general context on the underlying regulation, read the EU AI Act guides.

Corrections and source updates

Found a newer binding instrument, a changed official source or a classification that needs review? Email info@kritia.ai with the country and primary source. Read Kritia’s sources, review and correction policy.

EU AI Act authorities, national measures and sandboxes by country

How to read the tracker

Authority roles are different

Sandbox labels are bounded

Evidence standard

Official starting points

Compare all 27 member states

Country profiles

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

Official sources for this profile

A regulator name is not a scope answer

Corrections and source updates