Under Article 70, each Member State must establish or designate at least one notifying authority and at least one market surveillance authority as national competent authorities, and must designate one of them as a single point of contact. National competent authorities exercise their powers independently, impartially and without bias, and must have adequate technical, financial and human resources. They supervise AI systems in their Member State, carry out market surveillance under Chapter IX, and cooperate with the Commission, the Board and authorities in other Member States. The identity of the authority, and any national implementation measure, varies by Member State and must be confirmed for the Member State concerned.
Which authorities must a Member State designate?
Article 70 requires each Member State to establish or designate at least one notifying authority and at least one market surveillance authority as its national competent authorities for the purposes of the Act. The notifying authority is responsible for the assessment, designation, notification and monitoring of notified bodies, which carry out conformity assessments for high-risk systems where third-party assessment is required. The market surveillance authority carries out market surveillance of AI systems, including evaluating risks, requiring corrective action and handling complaints. A Member State may designate existing authorities, such as a product safety, communications or data protection authority, to perform these roles, or may create new bodies, and the choice varies by Member State. An organisation operating in a Member State should therefore identify the designated authorities for that State by name, rather than assuming the authority structure of another Member State applies.
What is the single point of contact?
Each Member State must designate one national competent authority as a single point of contact, which serves as the coordination point for the Act in that Member State and for cooperation with the Commission, the Board and authorities in other Member States. The single point of contact is the route through which cross-border questions, information requests and coordination are channelled, and it helps prevent an operator from facing uncoordinated approaches from several authorities in the same State. That does not mean every question goes to the single point of contact: market surveillance action, conformity body oversight and sector supervision remain with the authority competent for the matter. An organisation should record the single point of contact for each Member State in which it operates, together with the market surveillance authority and any sector authority concerned, so a supervisory contact can be routed correctly and promptly when it arrives.
For the broader regulatory framework, see enforcement and market surveillance.
How independent and resourced must authorities be?
National competent authorities must exercise their powers independently, impartially and without bias, safeguarding objectivity and ensuring the application and implementation of the Act. Member States must ensure that their national competent authorities have adequate technical, financial and human resources, premises and infrastructure to carry out their tasks effectively, including access to expertise in artificial intelligence, data, computing, fundamental rights and product safety as relevant. Those requirements matter for operators because they set the expectation that supervision will be competent and evidence-based, and that an authority will be able to assess technical documentation, logs and evaluation evidence rather than relying on summaries. An operator should therefore prepare its records to a standard that can withstand expert assessment, and should not assume that a supervisory request will be superficial. Independence also means that an authority's decision should be addressed on its legal and evidential merits, through the remedies the Act provides.
What is the role of data protection authorities?
Data protection authorities have a defined role in the supervision of specified AI systems, reflecting the overlap between the AI Act and data protection law. For high-risk AI systems in the areas of law enforcement, migration, asylum and border control management, and for specified other uses, the national data protection authority acts as the market surveillance authority, or the market surveillance authority works in close cooperation with it, as the consolidated text provides. That allocation recognises that those systems process personal data, including biometric and other sensitive data, and that their supervision requires data protection expertise. An operator in one of those areas should therefore expect data protection law and AI Act supervision to be closely connected, and should coordinate its data protection and AI Act records, assessments and authority contacts. A position taken under one regime that contradicts the position taken under the other will be visible to an authority that supervises both.
How do national authorities cooperate across borders?
National authorities cooperate with each other, with the Commission and with the Board through information exchange, joint investigations, mutual assistance and coordination of market surveillance action, as Chapter IX and the cooperation provisions provide. Where a system is made available in more than one Member State, the authority of the Member State where the risk arises or the non-compliance is identified can take action, and other authorities can be informed and involved. The Act also provides for the Commission to support coordination where a cross-border case requires a Union-level response. An organisation operating across borders should therefore keep a single, consistent compliance record for each system version, so that information given to one authority matches information given to another, and should designate a central contact for cross-border supervisory correspondence. Inconsistent accounts given to different authorities, even inadvertently, can damage credibility and prolong an investigation.
Continue with the market surveillance procedure under Article 74.
What has Italy designated under Legislative Decree 179/2026?
Italy published Legislative Decree No. 179 of 7 October 2026 in the Official Gazette (No. 234, 8 October 2026), adapting national law to the AI Act under Law No. 132/2025. The decree designates the Agency for Digital Italy (AgID) as the notifying authority for conformity assessment bodies, and the National Cybersecurity Agency (ACN) as the market surveillance authority and single point of contact. The Bank of Italy, CONSOB and IVASS supervise high-risk AI systems in their sectors. Penalties reach 35 million euro or 7% of worldwide annual turnover for the most serious breaches, including prohibited practices. The decree also creates a national regulatory sandbox jointly managed by AgID and ACN. On employment, Article 41 is reported to reserve the final decision to a natural person: decisions on hiring, changing or ending an employment relationship, including discipline and performance evaluation, may not rest solely on automated processing, and a dismissal taken in breach is reported to be void. Check the decree text before relying on the employment detail, as it rests on professional reporting rather than the published article text.
What does this guide not decide?
Apart from the Italy example above, this guide does not name the designated authority for any Member State, does not describe any national implementation measure, and does not decide which authority supervises a particular system. Designation, structure and national measures vary by Member State and change over time, and they must be confirmed from the Member State's official material and the Commission's list of authorities at the time of reliance. The guide also does not cover the designation and supervision of notified bodies in detail, which is addressed in the conformity assessment cluster. Where the relevant authority is uncertain, confirm it with the Member State's single point of contact or a legal adviser before filing, registering or responding to a supervisory request.
Frequently asked questions
Must every Member State designate a market surveillance authority?
Yes. Under Article 70, each Member State must establish or designate at least one notifying authority and at least one market surveillance authority as national competent authorities, and must designate one of them as a single point of contact.
Are national competent authorities independent?
Yes. They must exercise their powers independently, impartially and without bias, and Member States must provide them with adequate technical, financial and human resources to carry out their tasks.
Do data protection authorities supervise AI systems?
In defined areas, including law enforcement, migration, asylum and border control, the national data protection authority acts as, or works closely with, the market surveillance authority. The exact allocation should be checked in the consolidated text for the use concerned.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗