National Competent Authority

A body designated by an EU Member State under the AI Act — encompassing market surveillance authorities, notifying authorities, and data protection authorities — responsible for supervising provider and deployer compliance with the Act’s requirements, enforcing penalties, and coordinating with the AI Office on cross-border and GPAI model matters.

Semantic Classification

Content

• A notifying authority, a market surveillance authority, or any other authority designated by a Member State to supervise the application and implementation of the AI Act, including national data protection authorities where relevant.

  Source

  Primary: EU AI Act Article 3(34) Context: Member State implementation bodies

  Regulatory Context

  National competent authorities represent the diverse Member State entities responsible for AI Act implementation. This umbrella term encompasses various authorities with specific AI-related mandates, ensuring comprehensive governance coverage across regulatory domains.

  Categories of National Competent Authorities

  1. Market Surveillance Authorities (Article 74)

  Role: Front-line enforcement and compliance monitoring

  Responsibilities:

• Inspect AI systems

• Test compliance

• Investigate non-compliance

• Impose corrective measures and penalties

  See: Market Surveillance Authority (AI-0135)

  2. Notifying Authorities (Article 28)

  Role: Designation and oversight of notified bodies

  Responsibilities:

• Assess conformity assessment bodies

• Designate qualified bodies as notified bodies

• Monitor notified body performance

• Suspend/withdraw designations

  3. National Data Protection Authorities

  Role: GDPR-AI Act coordination

  Responsibilities:

• Ensure AI Act-GDPR consistency

• Investigate data protection violations in AI context

• Advise market surveillance authorities on personal data issues

• Coordinate with European Data Protection Board

  4. Sectoral Regulators

  Role: Domain-specific AI oversight

  Examples:

• Financial supervisors: Banking AI, insurance pricing AI

• Healthcare regulators: Medical device AI, diagnosis AI

• Telecommunications authorities: Network management AI

• Transport authorities: Autonomous vehicle AI

  5. Regulatory Sandbox Authorities (Article 57)

  Role: Innovation facilitation

  Responsibilities:

• Establish and operate AI regulatory sandboxes

• Provide guidance to sandbox participants

• Monitor real-world testing

• Report learnings to AI Office and AI Board

  Coordination Mechanisms

  Inter-Authority Cooperation (Article 74(10))

  National Level

  Member States ensure:

• Clear competence division: No overlaps or gaps

• Information sharing: Coordinated actions

• Single contact point: Streamlined external communication

  Examples

• Market surveillance authority consults data protection authority on GDPR-AI Act intersection

• Notifying authority coordinates with market surveillance on notified body performance issues

• Financial supervisor liaises with market surveillance on banking AI compliance

  EU Level Coordination

  AI Board Representation (Article 65)

  Each Member State appoints representative to AI Board from:

• Market surveillance authority, OR

• Other national competent authority with AI expertise

  Function: Ensure national perspectives inform EU-wide AI governance

  Information Exchange Platform

  Authorities use secure platform to:

• Share enforcement experiences

• Alert on cross-border risks

• Coordinate investigations

• Disseminate best practices

  Specific Authority Functions

  For High-Risk AI Systems (Articles 74-78)

• Verify conformity assessment completion

• Check CE marking validity

• Review technical documentation

• Inspect deployer compliance (fundamental rights impact assessments)

• Respond to serious incidents

  For GPAI Models (Articles 90-93)

• National authorities support AI Office in GPAI supervision

• Report GPAI-related serious incidents to AI Office

• Provide input on systemic risk assessments

  For Prohibited Practices (Article 5)

• Investigate suspected prohibited AI use

• Order immediate cessation

• Impose maximum penalties (€35M or 7% turnover)

• Inform AI Office of prohibited practice cases

  Powers Across Authority Types

  Common Powers (Articles 74-76)

  All national competent authorities may:

• Request information: From providers, deployers, operators

• Access premises: Conduct inspections

• Examine systems: Test and evaluate

• Order corrective action: Compliance measures

• Impose penalties: Administrative fines

  Sectoral-Specific Powers

  Some authorities have additional powers under sectoral legislation:

• Financial supervisors: Prudential measures, licensing actions

• Healthcare regulators: Clinical trial oversight, device withdrawals

• Data protection authorities: GDPR enforcement (processing limitations, data subject rights)

  Relationship to AI Office

  Division of Responsibilities

  AI Office (Articles 64-68):

• GPAI models: Primary supervision

• Cross-border cases: Coordination

• EU-wide guidance: Standard interpretation

  National competent authorities (Articles 74-78):

• High-risk AI systems: Primary enforcement

• Local deployment: Deployer oversight

• National implementation: Member State-specific execution

  Cooperation Mechanisms

• AI Office provides guidance to national authorities

• National authorities report enforcement to AI Office

• Joint investigations for complex cases

• Mutual assistance in information gathering

  Notification and Registration

  To European Commission

  Member States notify Commission of:

• Designated national competent authorities

• Scope of each authority’s responsibilities

• Contact details for coordination

  Authority Changes

  Member States promptly update Commission when:

• Authority designated or removed

• Competence scope changes

• Organisational restructuring occurs

  Resources and Capacity

  Technical Expertise

  National competent authorities require:

• AI specialists: Machine learning, algorithmic systems, neural networks

• Legal experts: AI Act interpretation, enforcement procedures

• Sector specialists: Domain knowledge (healthcare, finance, law enforcement)

• Data scientists: Performance evaluation, bias detection

  EU Support (Article 78)

  Commission provides national authorities with:

• Training programmes: AI Act implementation, technical assessment

• Testing infrastructure: Access to AI evaluation facilities

• Funding: Capacity building grants

• Knowledge platform: Best practice repository

  Member State Investment

  Member States commit to:

• Adequate staffing levels

• Sufficient budget allocations

• Ongoing training and development

• Technological infrastructure (databases, testing tools)

  Sectoral Integration

  Financial Services

• Coordinate with: EBA, ESMA, EIOPA (EU supervisors)

• Apply: MiFID II, Basel, insurance regulations alongside AI Act

• Focus: Credit scoring AI, fraud detection, algorithmic trading

  Healthcare

• Coordinate with: EMA, MDCG (medical device group)

• Apply: Medical Device Regulations alongside AI Act

• Focus: Diagnostic AI, treatment recommendation, patient monitoring

  Law Enforcement

• Coordinate with: Europol, data protection authorities

• Apply: Law Enforcement Directive, fundamental rights safeguards

• Focus: Biometric identification, risk assessment, evidence evaluation

  Education

• Coordinate with: National education ministries

• Apply: Education regulations, child protection laws

• Focus: Admissions AI, assessment systems, student monitoring

  Accountability and Oversight

  Judicial Review

  National competent authority decisions subject to:

• National courts: Administrative law review

• CJEU: EU law interpretation (preliminary references)

  Parliamentary Oversight

  Member State parliaments may:

• Question authorities on AI Act implementation

• Review annual reports

• Mandate investigations

• Approve budgets

  Transparency Obligations

  Authorities publish:

• Enforcement activities

• Penalty decisions (anonymised)

• Guidance materials

• Annual statistics

  Challenges and Solutions

  Challenge: Limited AI Expertise

  Solution: Commission training, academic partnerships, expert secondments

  Challenge: Resource Constraints

  Solution: Risk-based prioritisation, shared services, EU funding

  Challenge: Regulatory Fragmentation

  Solution: AI Board coordination, common guidelines, mutual recognition

  Challenge: Technological Pace

  Solution: Regulatory sandboxes, continuous learning, stakeholder dialogue

  Related Concepts

• Market Surveillance Authority (AI-0135): Key NCA type

• Notifying Authority: NCA for notified body designation

• AI Office (AI-0132): EU-level coordination

• AI Board (AI-0133): Member State cooperation forum

  Practical Implications

  For Providers

• Identify relevant national competent authorities for systems

• Maintain relationships with authorities in target Member States

• Understand sectoral authority roles

  For Deployers

• Know which authority to contact for complaints or guidance

• Coordinate fundamental rights impact assessments with relevant authority (public authorities)

  For Member States

• Designate authorities with clear mandates

• Ensure adequate resourcing

• Foster inter-authority coordination

  See Also

• EU AI Act Articles 74-78 (National Authorities)

• Article 28 (Notifying Authorities)

• Market Surveillance Regulation (EU) 2019/1020

Provenance