For AI systems developed or used by Union institutions, bodies, offices and agencies, references to national competent authorities and market surveillance authorities in the Regulation are construed as references to the European Data Protection Supervisor, except in relation to the Court of Justice of the European Union acting in its judicial capacity. The Supervisor therefore acts as the supervisory authority for EU institutions under the Act, carrying out the supervision, evaluation and enforcement tasks that national authorities carry out in the Member States. The allocation is outlined here and should be checked in the consolidated text, including Article 74(9) and the definition of national competent authority, before any filing or response is directed to a particular authority.
Why is supervision different for EU institutions?
EU institutions, bodies, offices and agencies are not established in a Member State in the way a company or a national authority is, so the Act provides a Union-level supervisor for their AI development and use rather than assigning them to a national authority. The European Data Protection Supervisor is given that role because it already supervises the processing of personal data by EU institutions under the data protection rules that apply to them, and because many of the AI systems they use process personal data or affect fundamental rights. The arrangement avoids a gap in which an EU institution's AI use would have no supervisory authority, and it avoids assigning supervision to a single Member State whose connection to the institution would be incidental. An EU institution should therefore direct its AI Act filings, registrations and supervisory correspondence to the Supervisor, and should not file with a national authority on the assumption that national supervision applies to it.
What does the Supervisor do under the AI Act?
The Supervisor carries out, for EU institutions, the supervision tasks that national competent and market surveillance authorities carry out in the Member States, including evaluating systems, requiring information and documentation, requiring corrective action and handling the supervisory aspects of complaints and incidents within its competence. The Supervisor's powers and procedures should be checked in the consolidated text, including the provisions that adapt Chapter IX to the institutional context, since the Supervisor's role is defined by reference to the national-authority provisions rather than by a separate code. The Supervisor also cooperates with the AI Office, the Board and national authorities where a case touches both institutional and national supervision, for example where an EU institution deploys a system supplied by a provider supervised nationally. An institution should keep a single supervisory file for each system, recording which authority was contacted, for what, and with what outcome, so cross-authority cases can be followed without duplication.
For the broader regulatory framework, see enforcement and market surveillance.
What is the exception for the Court of Justice?
The Act excepts the Court of Justice of the European Union acting in its judicial capacity from the Supervisor's role as the supervisory authority for EU institutions. That exception reflects judicial independence: the Court's judicial work is not supervised by another Union body in the way an administrative deployment would be. The exception is narrow and capacity-specific: it concerns the Court acting in its judicial capacity, not every activity of the Court as an institution, and the boundary should be checked in the consolidated text before any reliance. An institution that is unsure whether an activity falls within the exception should seek confirmation from the Supervisor or legal advice, and should record the basis for its conclusion. The exception does not remove the Act's substantive requirements from the Court's other activities, and it does not create a general exemption for the judiciary in the Member States, whose AI use is supervised under the national arrangements.
How does institutional supervision relate to data protection?
Institutional supervision under the AI Act and data protection supervision of EU institutions are closely connected, because the Supervisor carries out both roles and because the same system will often engage both regimes. An EU institution deploying an AI system should therefore coordinate its AI Act and data protection records, assessments and authority contacts, and should ensure that a position taken under one regime does not contradict the position taken under the other. Data protection impact assessments, AI Act classification records, fundamental-rights impact assessments where required, and registration entries should describe the same system, purpose and data, and should be kept together in the system's file. Where the two regimes impose different timescales or different recipients for a notification, each timescale and recipient should be diarised separately, so compliance with one is not mistaken for compliance with the other.
What should an EU institution record for supervision?
An EU institution should record, for each AI system it develops or uses, the classification, the operator role, the registration position, the Supervisor as the supervisory authority, the documentation and logs, the oversight arrangements, and any complaints, incidents or supervisory contacts. The record should show that the institution identified the Supervisor as its authority, that it filed or registered as required, and that it responded to supervisory requests within the periods set. Where the institution acts as a deployer of a provider's system, it should also record the provider's registration and conformity information, and the link between its deployer use record and the provider's system entry. That file is what allows the institution to demonstrate, to the Supervisor or to an auditor, that its AI use was supervised and documented, and it should be maintained for the period the Act and the institution's retention rules require.
Continue with national competent authorities under Article 70.
What does this guide not decide?
This guide gives only an outline of institutional supervision and does not decide which authority supervises a particular activity, whether the Court of Justice exception applies to a given case, or what the Supervisor will require in a particular evaluation. Those questions depend on the institution, the activity, the capacity in which it is carried out and the consolidated text, and they require the specific facts to be examined. The guide also does not describe the Supervisor's procedures in detail, which should be checked in the Supervisor's current material. Where institutional supervision is in issue, confirm the authority and procedure with the Supervisor or a legal adviser before filing or responding.
Frequently asked questions
Does a national authority supervise an EU institution's AI use?
No, as a general rule. References to national competent and market surveillance authorities are construed as references to the European Data Protection Supervisor for Union institutions, bodies, offices and agencies, except for the Court of Justice acting in its judicial capacity.
Does the Court of Justice exception cover all Court activities?
No. It concerns the Court acting in its judicial capacity. The boundary is capacity-specific and should be checked in the consolidated text before any reliance.
Must an EU institution register its use of a high-risk system?
Where Article 49(3) applies, a deployer that is a Union institution, body, office or agency must register itself, select the system and register its use in the EU database, subject to the restricted-section and national-route limits.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗