National Competent Authority Under the EU AI Act (Article 70)

A national competent authority is the body — or bodies — a Member State designates to supervise and enforce the EU AI Act on its territory, under Article 70 of Regulation (EU) 2024/1689. It is the authority that will police compliance where you operate, and the one you would deal with in an inspection, a request for information, or an enforcement action.

The term is plural in practice. Article 70 requires each Member State to designate at least two functions — a notifying authority and a market-surveillance authority — and to name a single point of contact for the EU. Understanding which body does what, and how the national layer differs from the EU AI Office, is the difference between sending your incident report to the right desk and the wrong one.

---

What Article 70 requires of each Member State

Article 70 obliges every Member State to establish or designate national competent authorities, comprising at least two roles:

• a notifying authority — responsible for setting up and overseeing the procedures for assessing and designating the notified bodies that carry out third-party conformity assessments; and
• a market-surveillance authority — responsible for supervising AI systems on the market, with investigatory and enforcement powers.

Each Member State must also identify one market-surveillance authority to act as the single point of contact for the Act, and communicate the designations to the Commission. The authorities must be given adequate resources and act independently.

A Member State can put these roles in one agency or spread them across several — many split competence by sector (data protection, finance, medical devices, justice), so "the competent authority" in a given country is often a set of bodies.

---

National competent authority vs the EU AI Office

This is the distinction that trips people up. The two operate on different layers of the regulation.

• National competent authorities (Article 70) supervise AI systems — high-risk systems, transparency duties, prohibited-practice enforcement — on their territory. Fines on providers and deployers of AI systems are imposed at national level under Article 99 (up to €35M/7% for Article 5 breaches; €15M/3% for most others; €7.5M/1% for supplying incorrect information to authorities).
• The EU AI Office — a body within the European Commission — supervises the GPAI model layer (Chapter V): general-purpose AI models and systemic-risk models. Fines on GPAI model providers are imposed by the Commission under Article 101 (up to €15M/3%), not by national authorities.

So: a high-risk recruitment system on the market is a national matter (Article 70 authority, Article 99 fines); a foundation-model provider's training-data-summary failure is an EU AI Office / Commission matter (Article 101). A separate body, the European Artificial Intelligence Board, coordinates the national authorities to keep enforcement consistent across the Union.

---

Designation status: hedge it

The designation deadline under the Act was 2 August 2025. In practice, many Member States are still finalising their set-ups well into 2026 — confirming which agency holds which role, passing national implementing legislation, and standing up the market-surveillance function. Some have named a lead authority; others have published only draft arrangements; a few designations are framed in the future tense on the authorities' own pages.

The practical rule: confirm a country's competent authority against that authority's own current source before relying on it. Do not assume the body that handled GDPR is automatically the AI Act market-surveillance authority — sometimes it is, often it is shared. National pages on this site hedge designations to what each authority itself claims, precisely because the picture is still settling.

Timeline note: the headline high-risk obligations these authorities will enforce moved under the Digital Omnibus. Stand-alone Annex III high-risk applies from 2 December 2027 and product-embedded high-risk from 2 August 2028 — adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), with entry into force on Official Journal publication expected before 2 August 2026. The Article 5 prohibitions (since 2 February 2025) and the GPAI regime (since 2 August 2025) are already live and enforced.

---

Worked example: Meridiaan Logistiek BV

Meridiaan Logistiek BV is a fictional Dutch logistics company — about 220 employees, ~€48M turnover — deploying a high-risk AI system for workforce scheduling and evaluation (an Annex III point 4 employment use).

When Meridiaan needs to know who supervises it, the answer is its national competent authority under Article 70 — the Dutch market-surveillance authority designated for the AI Act — not the EU AI Office, which has no role in a deployed high-risk system. If Meridiaan suffers a serious incident, the report goes to that national authority (the provider's Article 73 duty); an enforcement fine would come under Article 99, with the Article 99(6) SME-style cap taking the lower figure where it qualifies. Because the Dutch designation, like several others, was still being finalised through 2026, Meridiaan's compliance lead does the sensible thing: checks the authority's own current published position rather than assuming, and keeps the single-point-of-contact details on file. The EU AI Office only enters the picture if Meridiaan were itself a GPAI model provider — which it is not.

---

How Confir helps

Confir's rule-based engine classifies each system you build or deploy under Articles 5, 6 and 50, derives your role (provider, deployer, importer, distributor) and lays out the obligations that the relevant Article 70 authority would check — including the Article 73 serious-incident reporting path and the Article 49 registration duty. It keeps an org-wide risk register and an immutable audit log, so when an authority asks, the evidence is in one place. The logic is deterministic and reproducible: same intake, same cited finding.

---

Related guides

• Who enforces the EU AI Act?
• Market surveillance under the EU AI Act
• Notifying authority, defined
• Market-surveillance authority, defined
• EU AI Act penalties (Article 99)
• What is a GPAI model?