Direct comparison
EU AI Act Article 70: 4 Countries Compared
Spain, Germany, France, and Ireland built four different Article 70 models — most EU states still have no designated AI Act authority.
Written and maintained by CASRAI Editorial Board
Last updated
Ask CASRAI · free to try
Ask about EU AI Act Article 70: 4 Countries Compared
Ask your first 2 questions free below. Subscribers get 150 a day for $29 a month.
An AI assistant specialized in research administration. It cites the sources behind every answer, labels web answers and says when it can't answer.
Answers draw on CASRAI's guides and dictionary plus the federal and funder documents we index: Federal Register, Grants.gov, Regulations.gov and UKRI.
Works on this site and inside Claude, Cursor and the AI tools you already use.
Everything CASRAI publishes — this page, the dictionary, the guides and the news — stays free to read, with no account and no card.
How do Spain, Germany, France, Ireland, Most Other Member States compare side by side?
The table below compares Spain, Germany, France, Ireland, Most Other Member States across 5 procurement-relevant dimensions, from institutional model through status as of this comparison.
Side-by-side comparison
| Dimension | Spain | Germany | France | Ireland | Most Other Member States |
|---|---|---|---|---|---|
| Institutional model | Dedicated standalone agency — built specifically for AI supervision, not a repurposed regulator. | Single centralized enforcer — an existing regulator (telecoms/networks) took on AI Act duties by statute. | Coordinated multi-authority model — one lead agency fronts a panel of sector regulators, no single AI-only body. | Fully decentralized — fifteen existing sectoral regulators each supervise AI within their own remit, tied together by a coordinating office. | Undetermined or unannounced as of the most recent tracking — no confirmed designation on the public record. |
| Lead authority / who you'd actually deal with | AESIA (Agencia Española de Supervisión de la Inteligencia Artificial), attached to the Ministry for Digital Transformation; coordinates with AEPD (data protection), the Bank of Spain, and CNMV (securities) on overlapping matters. | Bundesnetzagentur (Federal Network Agency) — market surveillance authority, single point of contact, and complaints point in one; Deutsche Akkreditierungsstelle (DAkkS) handles the separate notifying-authority role for conformity assessment. | DGCCRF (Direction générale de la concurrence, de la consommation et de la répression des fraudes) as single point of contact, with CNIL (data protection), ANSSI (cybersecurity), ARCOM (digital/audiovisual content), and HAS (health-sector AI) each leading their own use-case areas. | National AI Office coordinates; day-to-day supervision sits with each system's existing sectoral regulator (e.g. the Central Bank of Ireland for financial AI, the Data Protection Commission where personal data is involved). | Varies or not yet public — for a system provider operating across the EU, this is precisely the gap: no single answer for "who enforces this" in most member states yet. |
| Instrument creating the authority | Royal Decree 729/2023 — enacted 22 Aug 2023, in force 3 Sept 2023. Predates the AI Act itself (which entered into force 1 Aug 2024); AESIA was built in anticipation of the eventual Article 70 duty, not in direct response to it. | KI-MIG (Gesetz über die Marktaufsicht und Innovationsförderung im Bereich Künstliche Intelligenz — Germany's AI market-surveillance and innovation-support act), adopted by the Bundestag in Feb 2026, entered into force 29 July 2026. | A coordinated designation across existing agencies rather than one new statute — CNIL, ANSSI, ARCOM, and HAS each act as market surveillance authority within their own sector under DGCCRF's coordination. | Ministerial designation of fifteen existing sectoral regulators, coordinated by the National AI Office (operational since Sept 2025) rather than a single new AI-specific law. | No confirmed implementing instrument found on the public record as of the most recent tracking. |
| Notable feature | First EU country with an agency dedicated to AI supervision — operations formally launched 19 June 2024, more than a year before Article 70's deadline; first Governing Council meeting held 14 Feb 2025. | Includes a dedicated AI regulatory sandbox at the Bundesnetzagentur for SMEs to develop, train, test, and validate AI systems in a controlled environment. Germany's data-protection authorities publicly criticized routing enforcement through the network regulator instead of a privacy authority. | The most fragmented internal split of the four — one tracking source counts as many as seventeen distinct market surveillance authorities across roughly fifteen AI use-case categories under DGCCRF's umbrella. | One of only two states in this comparison (with Spain) to build dedicated new AI-specific capacity — combining single-point-of-contact and coordination functions in the National AI Office — rather than assigning the job to one pre-existing regulator. | By one tracking source's count, roughly 30% of member states (about 8 of 27) had completed a designation as of the most recent check — a week before the original deadline, only Denmark and Lithuania had done so. |
| Status as of this comparison | In force and operating — AESIA has been running since June 2024, well ahead of the Article 70 deadline. | In force — KI-MIG took effect 29 July 2026, nearly a year after the EU-wide Article 70 deadline had already passed. | Operating on a coordinated basis — DGCCRF and its sector partners are functioning as France's designated structure. | Operating — the National AI Office has coordinated the fifteen-authority model since September 2025. | Deadline missed for most of the bloc — the 2 Aug 2025 date has passed with no confirmed designation for the majority of member states on the public record. |
Common questions
Common questions about Spain vs Germany vs France vs Ireland vs Most Other Member States
What exactly does Article 70 of the EU AI Act require?
+
Article 70 of Regulation (EU) 2024/1689 requires each member state to designate or establish national competent authorities — at minimum a market surveillance authority and, where conformity assessment applies, a notifying authority — plus a single point of contact (SPoC) to represent the state to the European Commission and coordinate with other member states. States must give these bodies adequate technical, financial, and human resources. The deadline for this designation was 2 August 2025.
Why does it matter that member states chose different models?
+
The AI Act's substantive rules are set at EU level, but enforcement is entirely national — who investigates a complaint, who can fine you, and who you'd need to notify all depend on which member state you're operating in and which model that state chose. A single centralized enforcer (Germany's approach), a dedicated new agency (Spain's and Ireland's approach), and a coordinated panel of sector regulators (France's approach) are not interchangeable from a compliance standpoint — they imply different points of contact, different sector expertise, and potentially different enforcement priorities for the same underlying rule.
Is it true that most EU member states missed the deadline?
+
By one specialist tracking source's count, only around 8 of the EU's 27 member states had completed a national competent authority designation as of the most recent check available at publication — roughly 30%. A week before the original 2 August 2025 deadline, only Denmark and Lithuania had officially designated authorities, and the large majority of states had not even submitted implementing legislation to their own parliaments. This page reports that figure as sourced from third-party tracking, not as CASRAI's own count of every member state's status — treat it as directional, not a live compliance registry.
Does a missed national deadline mean the EU AI Act itself isn't in force?
+
No. The AI Act's substantive obligations (prohibited practices, high-risk system requirements, GPAI duties) proceed on their own statutory timeline regardless of whether a given member state has finished designating its enforcement apparatus. A late or missing national designation is a gap in who enforces the Act in that country — not a delay to the Act's own applicability dates, which CASRAI covers separately in its high-risk compliance checklist and GPAI guides.
Where does Germany's KI-MIG fit relative to the EU deadline?
+
Germany's implementing statute, KI-MIG, entered into force on 29 July 2026 — almost a full year after the EU-wide Article 70 deadline of 2 August 2025 had already passed. It designates the Bundesnetzagentur (Federal Network Agency) as market surveillance authority, single point of contact, and complaints point, with the accreditation body DAkkS handling the separate notifying-authority function, and it establishes an AI regulatory sandbox aimed at SMEs.
Going deeper
