EU AI Act National Competent Authorities 2026: Who Enforces the AI Act in Your Country?

Post #1 in the sota.io EU AI Act NCA Enforcement Series

The EU AI Act's August 2, 2026 deadline for transparency and GPAI obligations is weeks away. But knowing what you need to implement is only half the answer. The question developers are now asking is: who will actually knock on the door?

That answer differs depending on where your SaaS product operates. Germany routes complaints through the Bundesnetzagentur. Spain has built the EU's first standalone AI supervision agency. France blends multiple regulators into an overlapping enforcement web. The Netherlands just gave its consumer authority a digital enforcement mandate.

This guide maps every major EU member state's National Competent Authority (NCA) structure, explains what each body is looking for, and gives you a concrete pre-August 2026 developer checklist for each jurisdiction.

The Two-Layer Enforcement Architecture

Before getting into country specifics, understand the fundamental split in EU AI Act enforcement:

Layer 1 — EU AI Office (European Commission level) Handles General-Purpose AI (GPAI) model providers — companies that train and release foundation models (think: Anthropic, OpenAI, Google, Mistral). Jurisdiction: model-level obligations under Art. 53 and 55. SaaS deployers are largely outside this scope unless they also train and release GPAI models.

Layer 2 — National Competent Authorities (Member State level) Handles everything else: high-risk AI system operators, transparency obligations for deployers (Art. 50), market surveillance of AI products, and enforcement of prohibited practices (Art. 5). This is where most SaaS developers face direct audit risk.

If you're building on top of a GPAI model (Claude, GPT-4, Gemini), your NCA is a Layer 2 authority — the one in the country where your users or your business is established.

NCA Designation Timeline

Article 70 of the EU AI Act required member states to designate their NCAs. The regulation entered into force August 1, 2024. The designation process was expected to complete by mid-2025, with full enforcement authority active by August 2, 2026.

As of May 2026, the designation landscape looks like this:

Germany — BNetzA as Lead NCA

Authority: Bundesnetzagentur (Federal Network Agency) Secondary bodies: BSI (cybersecurity), BfDI (federal data protection) Focus areas: Market surveillance, product conformity, network/telecom AI systems

Germany designated BNetzA as its primary NCA in December 2024. This is a significant choice: the Bundesnetzagentur has existing market surveillance infrastructure from the Radio Equipment Directive and the Machinery Regulation. It knows how to run conformity assessment audits.

What BNetzA audits for SaaS developers:

• Is your AI system correctly classified (non-high-risk, limited-risk, or high-risk)?
• If you deploy chatbots or synthetic content generators: does Art. 50(a) disclosure appear before user interaction?
• Do you have a documented risk management process for any high-risk AI use case?
• Are you using a GPAI model? Can you demonstrate the provider's compliance documentation (technical summary, copyright policy)?

Germany-specific developer checklist:

□ Product documentation in German available (BNetzA may request)
□ Art. 50(a) disclosure: "Diese Konversation verwendet KI" — visible, not buried
□ EU Declaration of Conformity (if high-risk): in German or with German translation
□ Incident reporting contact: BNetzA reporting form (expected operational Q3 2026)
□ Log retention: 6 months minimum for AI system interactions (BNetzA guidance)

Key BNetzA enforcement posture: BNetzA operates with a product-safety mindset. Expect document requests for technical files before any on-site inspection. The first wave of enforcement is likely to target companies that self-register as high-risk AI system operators under Art. 49.

Spain — AESIA: The EU's Only Standalone AI Agency

Authority: AESIA (Agencia Española de Supervisión de la Inteligencia Artificial) Secondary bodies: AEPD (data protection), CNMC (competition/markets) Focus areas: Full AI Act implementation, GPAI model oversight, innovation sandboxes

Spain moved faster than any other EU member state. AESIA was established by Royal Decree 729/2023 and has been operational since 2024. It is the only purpose-built AI supervision agency in the EU, staffed exclusively for AI Act enforcement.

AESIA is also Spain's contact point for the EU AI Office's GPAI model supervision — meaning Spain already has a functioning relationship with Anthropic, OpenAI, and Google at the regulatory level.

What AESIA audits for SaaS developers:

• Prohibited practice compliance: facial recognition in public spaces, social scoring, manipulative subliminal techniques (Art. 5)
• Transparency: Art. 50 obligations for deployers of emotion recognition systems, biometric categorization, chatbots
• High-risk AI in employment, education, and credit scoring: technical documentation + conformity assessment
• Regulatory sandbox participation (Spain was first EU state to launch AI Act sandboxes)

Spain-specific developer checklist:

□ AESIA self-registration: expected H2 2026 for high-risk system operators
□ Art. 50(b) disclosure: emotion recognition systems → inform users before use
□ Prohibited practices audit: verify your system does NOT use subliminal techniques
□ Sandbox eligibility: AESIA sandbox open for startups — 12-month limited-risk testing
□ Documentation language: Spanish accepted, English acceptable for technical files

Key AESIA enforcement posture: AESIA is active, well-staffed, and eager to establish case precedent. It has already published sector-specific guidance for HR AI (recruitment screening) and financial AI (credit scoring). Expect first enforcement actions in Q4 2026.

France — CNIAI + CNIL Multi-Authority Model

Authority: CNIAI (Commission Nationale de l'Intelligence Artificielle) Secondary bodies: CNIL (data protection + Art. 50 transparency), ARCOM (media/content), AMF (finance) Focus areas: Fundamental rights, high-risk AI in public sector, GPAI content labeling

France chose a coordination model rather than a single NCA. The CNIAI coordinates between regulators, while CNIL handles personal-data-adjacent AI obligations (which includes most Art. 50 transparency requirements).

For SaaS developers operating in France, this means two enforcement vectors:

1. CNIL — if your AI system processes personal data or involves chatbot/synthetic content disclosure
2. CNIAI — if your AI system is high-risk under Annex III (credit, employment, education, law enforcement)

What French authorities audit for SaaS developers:

• CNIL audit focus: GDPR + AI Act overlap — technical documentation for automated decision-making AI, data minimization in AI training pipelines, Art. 50 disclosure for any AI-generated content presented to French users
• CNIAI focus: high-risk AI in public procurement (France has extensive public-sector AI deployments), biometric systems at events/public spaces
• ARCOM focus: AI-generated audiovisual content labeling under DSA + AI Act combined obligations

France-specific developer checklist:

□ CNIL pre-consultation: AI systems with personal data in high-risk categories → mandatory DPIA
□ Art. 50(a) chatbot disclosure: in French ("Cet agent conversationnel utilise l'intelligence artificielle")
□ AI-generated content: if creating synthetic media → ARCOM notification expected H2 2026
□ Employment AI: if used for French users in hiring → high-risk classification mandatory
□ Incident reporting: CNIL notification for AI-related personal data breaches (72h deadline)

Key French enforcement posture: France combines GDPR enforcement muscle (CNIL) with AI Act mandates. Expect CNIL to lead first enforcement actions because it can apply both GDPR and AI Act simultaneously — maximizing fines. Maximum penalty: €35M or 7% global revenue (whichever higher).

Netherlands — ACM + RDI Consumer-First Approach

Authority: ACM (Autoriteit Consument & Markt / Netherlands Authority for Consumers & Markets) Secondary bodies: RDI (Rijksinspectie Digitale Infrastructuur), AP (Data Protection Authority) Focus areas: Consumer-facing AI, deceptive practices, digital markets

The Netherlands designated ACM as its primary AI Act NCA in Q1 2025. ACM has a strong existing reputation for digital enforcement — it led early action against app store practices and cookie banners. Expect ACM to approach AI Act enforcement through a consumer-harm lens.

RDI (formerly Radiocommunications Agency Netherlands) handles technical market surveillance for AI products as physical goods — relevant for embedded AI systems, not typically for pure SaaS.

What ACM audits for SaaS developers:

• Deceptive AI design: systems that manipulate consumers through fake urgency, false personalization, or undisclosed AI decision-making (ACM sees this as consumer protection, not just AI Act)
• Chatbot transparency: Art. 50(a) disclosure — ACM coordinates with existing misleading-practices regulation
• Price discrimination via AI: algorithmic pricing that discriminates against protected groups
• High-risk consumer credit AI: classification and conformity

Netherlands-specific developer checklist:

□ Disclosure language: Dutch preferred ("Dit systeem gebruikt kunstmatige intelligentie")
□ ACM complaint mechanism: Dutch users must be able to report AI-related complaints easily
□ No dark patterns: ACM actively monitors for countdown timers, false scarcity, AI-assisted manipulation
□ GDPR-AI overlap: AP and ACM coordinate — one complaint can trigger both regulators
□ Importer liability: if you sell AI-enabled software products in NL → ACM market surveillance applies

Key ACM enforcement posture: ACM is a fast-moving, consumer-focused regulator. It is likely to bring the first AI Act enforcement actions in the Netherlands by early 2027, building on existing consumer protection infrastructure.

Italy — Sector-Split Between AgID, ACN, and AGCM

Authority: AgID (Agenzia per l'Italia Digitale) + ACN (Agenzia per la Cybersicurezza Nazionale) Secondary bodies: AGCM (competition/consumer), Garante (data protection), AGCOM (communications) Focus areas: Public administration AI, cybersecurity of AI systems, consumer markets

Italy designated a split-NCA model. AgID handles AI in the public sector (which is vast in Italy — healthcare, courts, education). ACN handles cybersecurity aspects of AI systems (connecting AI Act obligations to NIS2 compliance). AGCM handles private-sector consumer-facing AI enforcement.

This fragmented model is both a challenge and an opportunity: reaching the right authority requires knowing which category your AI system falls into.

What Italian authorities audit for SaaS developers:

• AgID: AI systems sold to or used by Italian public administration — prior conformity assessment mandatory
• ACN: AI system cybersecurity — does your system have adequate resilience against adversarial attacks? Is your GPAI API integration secure?
• AGCM: consumer-facing manipulation, deceptive pricing AI, recommendation algorithms that harm consumers
• Garante: GDPR + AI Act data processing overlap — automated decision-making in consumer contracts

Italy-specific developer checklist:

□ Public sector sales: AgID pre-qualification expected for AI tools sold to PA
□ Cybersecurity documentation: ACN alignment with NIS2 + AI Act security requirements
□ Italian language disclosure: Art. 50(a) in Italian for Italian-language interfaces
□ AGCM watch-list: price comparison, insurance, credit — already under active Italian scrutiny
□ Garante DPIA: if AI system processes special categories (health, political opinion) in Italy

Poland — UOKiK Consumer Protection First

Authority: UOKiK (Urząd Ochrony Konkurencji i Konsumentów — Office of Competition and Consumer Protection) Secondary bodies: UODO (data protection), UKE (telecom) Focus areas: Consumer protection, unfair commercial practices, algorithmic pricing

Poland designated UOKiK as its NCA, fitting AI Act enforcement into existing consumer protection authority. UOKiK has been active in digital markets — it investigated Apple, Google, and Microsoft in recent years.

What UOKiK audits for SaaS developers:

• Algorithmic pricing discrimination against Polish consumers
• Chatbot transparency: Polish-language disclosure obligations
• Unfair AI-generated personalization (dynamic pricing in travel, e-commerce)
• High-risk AI in employment screening used by Polish employers

Poland-specific developer checklist:

□ Polish language disclosure: "Ten system używa sztucznej inteligencji"
□ Algorithmic pricing: document that your AI pricing system does not discriminate
□ UOKiK complaint mechanism: accessible in Polish
□ Employment AI: if used by Polish companies → coordinate with UODO for GDPR-AI overlap

What Every NCA Audit Has in Common

Despite the country-specific differences, every NCA is working from the same base regulation. Here is the common evidence set every SaaS developer should have ready:

1. System Classification Document (Pre-August 2026)

Write a one-page classification statement:

System name: [your product]
Classification: Non-high-risk / Limited-risk / High-risk
Basis: Not listed in Annex III / Listed: [category]
GPAI usage: Yes — provider: [Anthropic/OpenAI/Google/etc.]
Art. 50 disclosure required: Yes/No
Last reviewed: [date]
Reviewer: [name, role]

2. Art. 50 Disclosure Evidence

For every customer-facing AI feature:

Feature: [chat, recommendations, scoring, etc.]
Disclosure method: Banner / In-UI label / System prompt
Disclosure text: [exact text in local language]
Triggered at: [session start / before generation / before output display]
Test log: [screenshot or automated test evidence]

3. GPAI Provider Compliance Package

If you use Claude, GPT-4, or Gemini:

• Provider's technical summary (available from Anthropic/OpenAI/Google)
• Provider's copyright policy
• Your own deployer obligations checklist (Art. 50 + prohibited uses)
• API Terms of Service reference

4. Incident Reporting Procedure

Who to call when something goes wrong:

Incident type → Reporting authority:
Personal data breach → GDPR: local DPA (72h)
AI system serious incident → AI Act: National Market Surveillance Authority
High-risk AI malfunction → Immediately cease use + notify NCA

Cross-Border Enforcement: The "Establishment" Rule

Your primary NCA is generally determined by where your company is established in the EU — not where your users are located.

• German GmbH using AI → BNetzA is your primary NCA
• Spanish SL using AI → AESIA is your primary NCA
• No EU establishment but serving EU users → The NCA of the member state where you have the most users (or have an EU representative) takes precedence

Practical implication: If you're a US or UK SaaS company serving EU users without an EU legal entity, designating an EU representative in a member state with a pragmatic NCA (the Netherlands ACM has English-language procedures; Germany BNetzA has clear process documentation) reduces compliance complexity.

Key Dates for NCA Enforcement

What Happens If You Do Nothing

The EU AI Act creates a two-tier fine structure:

• Prohibited practices (Art. 5): Up to €35M or 7% global annual revenue
• Other obligations (Art. 50 disclosure, high-risk conformity): Up to €15M or 3% global annual revenue
• Incorrect/misleading information to NCAs: Up to €7.5M or 1% global annual revenue

NCAs are coordinating through the European AI Board (Art. 65), meaning a finding in one country can trigger parallel investigations in others. A CNIL finding in France can become input for BNetzA in Germany.

Immediate Developer Actions (Before August 2026)

For most SaaS teams using GPAI APIs, the risk is limited-risk (not high-risk), meaning you primarily need Art. 50 transparency compliance. Here is a concrete 30-day sprint:

Week 1 — Audit
□ List all AI features in your product
□ Classify each: prohibited / high-risk / limited-risk / minimal-risk
□ Identify which member states your users are in → map to NCAs

Week 2 — Documentation
□ Write system classification document
□ Pull GPAI provider compliance package (Anthropic/OpenAI/Google all publish these)
□ Draft Art. 50 disclosure text in each required language

Week 3 — Implementation
□ Add disclosure to all limited-risk AI features
□ Add prohibited-use guardrails to your GPAI system prompt
□ Set up incident reporting contact and internal escalation procedure

Week 4 — Test + Evidence
□ Screenshot/automated-test Art. 50 disclosures
□ Internal sign-off: legal/CTO/DPO
□ File the classification document internally (NCA evidence package)

Up Next in This Series

This post covered the NCA landscape and country-by-country mandates. The remaining four posts in this series go deeper:

• Post #2: EU AI Act Market Surveillance 2026 — What NCAs Are Testing and What SaaS Developers Must Prepare For
• Post #3: EU AI Act Regulatory Sandboxes 2026 — How SaaS Startups Can Use Sandbox Access Before August Enforcement
• Post #4: EU AI Act Post-Market Monitoring — Incident Reporting, Corrective Actions & Serious Incident Definitions for SaaS
• Post #5: EU AI Act Enforcement Finale — Complete Compliance Checklist for SaaS Developers Before the August 2 Deadline

The EU AI Act's enforcement teeth come from 27 different regulators, each with its own priority and approach. Knowing which door enforcement will walk through in your jurisdiction is the first step to being ready when it arrives. The August 2026 deadline is not a suggestion — NCAs are staffed, mandated, and coordinating.

Running EU-compliant AI infrastructure? sota.io is a GDPR-native PaaS with no US parent and no CLOUD Act exposure — the deployment layer that matches your compliance posture.