EU AI Act in Latvia: Authorities, Enforcement, and What Companies Must Do

Latvia is further along than some small Member States — it has a Cabinet-approved plan that names which body holds each EU AI Act role — but it is not finished. As of mid-2026 the binding national designation is still pending, and Latvia had not formally notified its single point of contact to the European Commission by the 2 August 2025 deadline in Article 70. So the practical answer to "who enforces the AI Act in Latvia?" is: the roles are mapped, the law that locks them in is not yet adopted.

That distinction matters for planning. The EU AI Act, Regulation (EU) 2024/1689, applies directly in Latvia regardless of where the national set-up stands. This guide separates what Latvia has decided from what is still in draft, walks the timeline after the Digital Omnibus, and sets out what Latvian providers and deployers should do.

---

A Regulation, Not a Directive: No Latvian Transposition Needed

The EU AI Act is a Regulation. It entered into force on 1 August 2024 and applies directly in Latvia under Article 288 of the Treaty on the Functioning of the European Union — no transposition into Latvian law is required for the obligations to bind. Article 5's prohibited practices have applied since 2 February 2025, Article 4 AI literacy since the same date, and the Chapter V GPAI duties since 2 August 2025.

What Latvia must still do is the national plumbing: designate authorities by a binding instrument, set domestic penalty procedure, and notify its single point of contact to Brussels. Latvia has planned all of this; it has not yet enacted it.

---

Who Will Enforce the EU AI Act in Latvia?

On 25 February 2025 the Cabinet of Ministers considered an implementation report prepared by VARAM — the Ministry of Smart Administration and Regional Development (Viedās administrācijas un reģionālās attīstības ministrija). That report set out the role allocation. It is the clearest picture available, but it is a plan, not the final designation: the same Cabinet record instructed ministries to draft the necessary legislative amendments, which means the binding instruments were still to come.

The planned architecture:

Market surveillance is spread across a wide set of sectoral bodies — the Consumer Rights Protection Centre (PTAC), the Health Inspectorate, civil aviation, maritime, rail and road safety regulators, the education quality service, and the security services among them — but the two that matter most to a typical company are clear.

The Data State Inspectorate Leads on Prohibited and High-Risk AI

In the plan, the Data State Inspectorate (DVI) — Latvia's data protection supervisor — takes market surveillance of prohibited AI practices and high-risk AI systems. That is the most consequential slice, and it makes the DVI the body most Latvian companies will deal with in practice. But two caveats apply. First, the DVI is one of roughly a dozen sectoral market surveillance bodies, not a single all-purpose AI regulator; the overall coordinating authority is VARAM. Second, this allocation rests on the Cabinet plan plus follow-on legislation that was still being drafted — so describe the DVI as slated to supervise high-risk AI, not as the long-settled authority.

The Single Point of Contact Is Not Yet Notified

Article 70 requires each Member State to notify a single point of contact to the Commission. Latvia is not among the small group of states that had done so by mid-2026. The coordinating role is expected to sit with VARAM, but until Latvia formally notifies, treat the SPoC as unconfirmed.

GPAI Is Supervised From Brussels

As everywhere in the EU, providers of general-purpose AI models are supervised directly by the EU AI Office in Brussels, not by any Latvian body. Latvian foundation-model developers should engage with the AI Office's codes of practice process.

---

National Strategy and the AI Centre Law

Latvia has been active on the policy side. The Law on the Latvian Artificial Intelligence Centre (Mākslīgā intelekta centra likums) was adopted in March 2025 and establishes a national AI technology ecosystem and centre. Note what it is not: it does not perform the Article 70 authority designation. It builds capacity and an ecosystem; the enforcement designation is a separate, still-pending instrument coordinated through VARAM.

For a Latvian company, the practical reading is the same as for its neighbours: plan against the Regulation's own text and dates, not against a Latvian designation law that has not been adopted.

---

The EU AI Act Timeline as It Applies in Latvia

Two points for Latvian businesses.

First, the high-risk deadline is no longer 2 August 2026. Under the Digital Omnibus — the Commission's amendment package, adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026 — stand-alone high-risk Annex III systems are deferred to 2 December 2027 and product-embedded systems to 2 August 2028. The Digital Omnibus enters into force on publication in the Official Journal, expected before 2 August 2026, but the deferral dates themselves are settled. Plan to 2 December 2027 for stand-alone high-risk Annex III.

Second, the fact that Latvia's designation is unfinished does not push back the dates already in force. Article 5 and the GPAI duties are live now, with the GPAI layer enforced from Brussels.

---

Penalties: What Latvian Companies Face

The fine ceilings are set by Article 99 of the Regulation, applied Latvia-wide. There are exactly three tiers, and no Latvia-specific fine amounts exist — do not expect or cite any.

• €35,000,000 or 7% of total worldwide annual turnover (whichever is higher) — for the Article 5 prohibitions. Art 99(3).
• €15,000,000 or 3% — for most other obligations: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency. Art 99(4).
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to authorities or notified bodies. Art 99(5).

For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed sum or the percentage. A Latvian company with €5M turnover cannot be fined €15M for a high-risk breach — 3% of €5M is €150,000, the applicable ceiling. The third tier is 1%, never 1.5%. GPAI model providers face a separate instrument: up to €15 million or 3% under Article 101, imposed by the Commission.

---

Worked Example: A Latvian Fintech Deployer

Consider Daugava Pay SIA, a fictional Riga fintech — about 55 employees, ~€7M turnover — that uses a third-party AI model to score creditworthiness for small consumer loans.

Creditworthiness assessment is an Annex III high-risk use case (access to essential private services). Daugava Pay is a deployer under Article 26: human oversight under Article 14, adherence to the provider's instructions, logging, and — because it assesses creditworthiness — an Article 27 FRIA before deployment. Two Latvian supervisors are relevant under the planned model: the Bank of Latvia, which is slated to cover AI in financial institutions under its supervision, and the Data State Inspectorate, slated for high-risk AI generally. Daugava Pay should not wait for the binding designation to settle the overlap — both are real channels in the plan, and the obligations attach to the system now. If Daugava Pay fine-tuned the model on its own loan data and crossed into substantial modification, it could flip to provider obligations under Article 25; that analysis is worth doing early.

---

How Confir Helps

Latvian teams have a clear plan to read but no final guidance to lean on. Confir is an EU-hosted compliance tool built for this work. Its classification engine is deterministic and rule-based — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake yields the same finding with a human-readable explanation of which rule fired. It builds the AI inventory, derives the provider/deployer role, generates the Annex IV technical documentation and the Article 27 FRIA, and runs a structured assessment across risk classification, data robustness, transparency and human oversight, and post-market monitoring — so a Latvian company is ready whichever supervisor takes the lead.

---

What Latvian Companies Should Do Now

Immediately: Audit for Article 5 prohibited practices — social scoring, untargeted facial-image scraping, biometric categorisation by sensitive traits, workplace or education emotion recognition. These bind today; the GPAI layer is enforced now by the Commission.

Before 2 August 2026: Prepare for Article 50 transparency — label chatbots, mark synthetic content, disclose deepfakes. This date was not deferred.

Through 2026–2027: Build the AI inventory, classify each system, apply the Article 6(3) filter, assign roles, and start the high-risk documentation. Plan against 2 December 2027, the date the Omnibus sets for stand-alone high-risk Annex III. Financial-sector deployers should engage early with the Bank of Latvia's expectations.

Ongoing: Watch for the binding designation and the SPoC notification. The Cabinet plan tells you which doors to expect — the Data State Inspectorate for high-risk and prohibited AI, the Bank of Latvia for financial-sector AI, VARAM coordinating — but the enforcement powers turn on when the legislation lands.

---

Related guides

• EU AI Act fundamentals
• Compliance for small businesses
• Article 5: prohibited practices
• Article 99 penalties explained
• Provider vs deployer roles
• The Digital Omnibus, defined
• Market surveillance authority, defined