Who Enforces the EU AI Act? The Authorities and How It Is Split
The EU AI Act is enforced by national authorities for AI systems and the European AI Office for GPAI models. Penalties run up to €35M or 7%.
Enforcement of the EU AI Act, Regulation (EU) 2024/1689, is split between national authorities (for AI systems) and the European AI Office (for general-purpose AI models). Knowing which body deals with what tells you who can ask you questions, and who imposes the fines.
National authorities handle AI systems
Each member state designates national competent authorities under Article 70, including market-surveillance authorities that supervise AI systems on their market. They handle high-risk classification disputes, conformity, and the enforcement of provider and deployer obligations within the country, and they can require information, investigate, and order corrective action under the market-surveillance regime (Article 74 onward). They also impose the penalties under Article 99, which member states lay down in national law.
So if you are a provider or deployer of an AI system, your day-to-day supervisor is the relevant national authority in the member state(s) where you operate.
The AI Office handles GPAI models
The European AI Office, within the Commission, supervises general-purpose AI models under Chapter V. It can request information, evaluate models, and is central to enforcing the GPAI obligations. Crucially, fines on GPAI model providers are imposed by the Commission under Article 101 (up to €15 million or 3% of worldwide turnover) — not by national authorities under Article 99.
The coordinating bodies
Around these sit the coordination layer: the AI Board, bringing together member-state representatives for consistent application; the scientific panel of independent experts (Article 68), which can issue qualified alerts about systemic risks (Article 90); and an advisory forum of stakeholders. The European Data Protection Supervisor acts as the competent authority for EU institutions, and can fine them under Article 100.
The penalty tiers (Article 99)
For AI systems, national authorities apply the three tiers: €35 million or 7% for Article 5 prohibitions (99(3)); €15 million or 3% for most other obligations (99(4)); €7.5 million or 1% for incorrect or misleading information to authorities (99(5)). SMEs and start-ups are capped at the lower of the percentage or fixed amount (99(6)).
How Confir helps
Confir keeps your systems classified and documented so that whichever authority asks — a national market-surveillance authority about a high-risk system, or a question routed through a model provider supervised by the AI Office — you have a cited, reproducible record rather than a scramble. The engine is deterministic and rule-based.
Frequently asked questions
Who enforces the EU AI Act?
National market-surveillance authorities, designated under Article 70, enforce the rules on AI systems within each member state, including the penalties under Article 99. The European AI Office, within the Commission, supervises general-purpose AI models under Chapter V, with fines on GPAI providers imposed by the Commission under Article 101.
Which authority deals with my company?
If you provide or deploy AI systems, the relevant national competent authority in the member state(s) where you operate is your supervisor. The AI Office matters to you mainly through the general-purpose model providers you rely on, not directly.
Who imposes the fines?
For AI systems, the national authorities under Article 99, as laid down in national law. For GPAI model providers, the Commission under Article 101. For EU institutions, the European Data Protection Supervisor under Article 100.
What coordinating bodies exist?
The AI Board (member-state coordination), the scientific panel of independent experts (Article 68, which can raise systemic-risk alerts under Article 90), and an advisory forum of stakeholders. They support consistent application across the EU.
What are the penalty tiers?
Up to €35 million or 7% of worldwide turnover for Article 5 prohibitions (99(3)); up to €15 million or 3% for most other obligations (99(4)); up to €7.5 million or 1% for incorrect or misleading information to authorities (99(5)). SMEs and start-ups are capped at the lower figure (99(6)).
Related guides
- The AI Office, defined
- EU AI Act penalties
- National competent authorities
- Extraterritorial scope of the EU AI Act
- How AI risk classification works
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →