The EU AI Act sets the rules, but which authority enforces them, what national penalties apply, and whether a regulatory sandbox actually exists are all determined at member state level, not by Brussels. Two days after the 2 August 2026 deadline for high-risk obligations and Article 57 sandbox readiness, national implementation is highly uneven: some countries have an operational authority and a signed law, others have neither. Several countries also missed the earlier 2 August 2025 deadline to formally designate their national competent authorities to the Commission, a gap that persists in some cases. Figures below combine official sources (government gazettes, agency press releases) with secondary reporting where noted, and several data points remain explicitly unclear rather than guessed.
11 countries · as of 2026-08-04
Sorted by how far the national implementing act has got. Where the position is unclear, the table says so rather than guessing.
| Country | Implementing act | Authority | Sandbox | Penalties |
|---|---|---|---|---|
| Germany DE | In force KI-MIG, in force since 29 July 2026 | Bundesnetzagentur (Federal Network Agency) | operational Pilot sandbox concluded March 2026; full Art. 57 readiness unconfirmed | AI Act maxima apply; exact KI-MIG fine procedure not fully verified |
| Italy IT | In force Legge 132/2025, in force since 10 Oct 2025; implementing decrees pending | AgID (notifying) + ACN (market surveillance) | announced Joint AgID/ACN sandbox planned, access details not yet published | Up to EUR 35m/7% turnover planned, aligned with AI Act, via pending decree |
| Denmark DK | In force Law No. 467 (2025); revised version in force since 2 Aug 2026 | Digitaliseringsstyrelsen (Danish Agency for Digital Government) | operational Two sandbox rounds ran 2024-2025; not listed as ongoing April 2026 | Administrative fines and criminal penalties; exact amounts unconfirmed |
| Poland PL | Adopted AI systems law signed 24 July 2026; KRiBSI not yet operational | KRiBSI (Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji) under Ministry of Digitisation | announced Planned once KRiBSI is operational, targeted November 2026 | Administrative sanctions planned; exact fine amounts unclear |
| Ireland IE | Adopted Regulation of Artificial Intelligence Act 2026, signed 21 July 2026 | AI Office of Ireland (Department of Enterprise, Tourism and Employment) | announced Sandbox planned under Head 35; access details unconfirmed | AI Act maxima apply; CCPC gains new administrative sanction powers |
| France FR | In parliament PJL DDADUE 3, passed Senate 19 Feb 2026, not yet enacted | Not yet designated (DGCCRF proposed as coordinator) | unknown CNIL sandbox exists but not confirmed as Art. 57 instrument | No national penalty provisions beyond AI Act framework identified |
| Spain ES | In parliament Organic Law bill in Congress since 28 May 2026, not yet passed | AESIA (Agencia Española de Supervisión de Inteligencia Artificial) | operational First EU sandbox completed 15 June 2026, new rounds announced | Up to EUR 35m/7% turnover proposed; AESIA already sanctioning since Aug 2025 |
| Netherlands NL | Draft Uitvoeringswet AI-verordening draft; consultation closed 1 June 2026 | Autoriteit Persoonsgegevens + RDI, coordinating ~10 sector regulators | announced Single-portal sandbox design proposed March 2025, not yet operational | Not yet set; implementing act to define enforcement powers |
| Sweden SE | Draft SOU 2025:101 inquiry; no bill confirmed passed as of 4 Aug 2026 | PTS (proposed coordinator) + IMY + Finansinspektionen; not yet law | unknown PTS-run sandbox planned from 2 Aug 2026, status unconfirmed | AI Act maxima proposed (EUR 35m/7%); not yet enacted |
| Austria AT | None No dedicated implementing act identified; RTR service centre only | Not yet designated | unknown No concrete Austrian Art. 57 sandbox programme found | Not yet set |
| Belgium BE | None No implementing act; draft bill only, designation deadline missed since Aug 2025 | Not yet designated (BIPT planned as lead regulator) | none No Belgian sandbox programme identified | Not yet set; enforcement possible only through the courts |
Germany passed its comprehensive implementing law only four days before the deadline, combining a new central coordination centre (KoKIVO) at the Bundesnetzagentur with continued sectoral oversight by BaFin, BfArM, BSI and the data protection authorities.
Italy is the only country here with a national AI framework law fully in force since 2025, but the implementing decrees that actually define sanctions, authority powers and sandbox access only received preliminary cabinet approval in June 2026 and were not confirmed published by 4 August 2026, with a legal deadline of 10 October 2026.
Denmark was the first EU member state to enact AI Act implementing legislation and had its authority designated back in April 2024, well ahead of most peers, though a later EU Parliament overview did not list its sandbox as currently running.
Poland signed its AI law just before the deadline, but the new KRiBSI supervisory commission will only get a chair in October 2026 and reach full staffing in November 2026, leaving a real operational gap at the 2 August 2026 EU deadline.
Ireland moved fastest of the distributed-model countries, enacting its law and standing up the AI Office of Ireland with a named CEO within ten days, coordinating roughly 13-15 sectoral regulators including the CCPC.
France's proposed model splits oversight across roughly fifteen sectoral authorities coordinated by DGCCRF, with no single authority yet formally notified to the Commission, a structure French trade press has criticised as illegible for businesses.
Spain is the most operationally advanced country covered here: AESIA has run and sanctioned under a real mandate since 2025 and Spain closed Europe's first completed AI Act regulatory sandbox in June 2026, all while its foundational organic law is still working through Congress.
The Netherlands has chosen a cooperative model spreading oversight across roughly ten existing sector regulators coordinated by AP and RDI, but as of 4 August 2026 the implementing law has not been submitted to parliament and remains only a closed consultation draft.
Sweden's entire AI Act framework still rests on an unpassed government inquiry, SOU 2025:101, with no source found confirming that implementing legislation actually cleared the Riksdag by the 2 August 2026 deadline, leaving the authority landscape unresolved.
As of the last verified check in April 2026, Austria's Chancellery could not give a date for formally designating a market surveillance authority, leaving the RTR AI service centre (a chatbot and advisory desk, not a formal Art. 70 authority) as the only visible national touchpoint; this should be re-verified before publication since sources only cover through April 2026.
Belgium missed the EU-wide 2 August 2025 deadline to formally designate its AI Act authorities and, per Belgian press reporting from 29 July 2026, still had no operational market surveillance authority a year later, leaving enforcement possible only through the courts.
A tracker that treats the EU as one jurisdiction tells you the deadline. It does not tell you who inspects you, under which act, or whether the authority exists yet. We watch the national regulators alongside the EU sources and push changes as they land. Free during the beta.
Get free accessInformational content only, not legal advice. National positions change quickly and some entries are marked unclear on purpose.