EU AI Act Implementation Tracker 2026: Authorities & Readiness

The EU AI Act has moved from legislation to operationalisation. The prohibited-practices duty and Article 4 AI literacy obligation already apply, governance and GPAI provisions have been in force since 2 August 2025, and the main high-risk-system obligations activate on 2 August 2026 — 89 days away.

EU-level capacity is the most mature layer. The European AI Office exists and enforces GPAI rules. The AI Board coordinates national authorities. The Commission has issued binding-style guidance on prohibited practices and on the AI system definition (both February 2025), the GPAI Code of Practice (July 2025), templates for public training-data summaries (July 2025), and launched the AI Act Service Desk + Single Information Platform (October 2025). A 2026 guidance pipeline is already public.

Member-state supervisory architecture is visibly uneven. Ireland designated 15 competent authorities (September 2025) and is preparing an AI Office of Ireland. Lithuania named RRT as MSA/SPoC. Finland's national implementation powers entered into force on 2026-01-01. France uses a coordinated model (DGCCRF + CNIL + INESIA). Germany's Bundesnetzagentur runs a service desk and completed a sandbox pilot in March 2026. Spain's AESIA published 16 practical compliance guides. Cyprus, Italy, Netherlands, and Poland show partial-to-advanced public evidence. The remaining 17 member states show limited public footprint — but the Regulation is directly applicable, so legal duties still attach.

The most important timing tension sits in implementation infrastructure. The Act assumes governance and conformity-assessment infrastructure should already be operational before August 2026, but CEN-CENELEC's accelerated timetable targets Q4 2026 for key harmonised standards, and Article 50 transparency code work was still in draft as of March 2026. Implication for organisations: prepare now using the Regulation, issued guidance, draft instruments, and internal control frameworks. Treat harmonised standards as a future simplifier — not a precondition for readiness.

Related Alice Labs research: Global AI Governance & Risk Readiness 2026 (cross-jurisdiction governance benchmarks), Global Public Sector AI Index 2026 (public-sector AI adoption), State of AI in Sweden 2026 (national AI landscape).

Key Findings

12 data-driven insights

Why this matters

Compliance teams that focus only on the legal text miss the operational reality. The Commission's guidance, AI Office tooling, and AESIA/Bundesnetzagentur materials are now the de-facto reference architecture — even before harmonised standards are finalised.

Interpretation

The scoreboard is conservative: blank EU Commission listings do not prove non-designation. Member-state evidence scores reflect publicly visible implementation, not hidden administrative readiness.

As of 2026-05-05 there are 89 days until the general application date (2026-08-02). EU layer = Commission/EUR-Lex; MS layer = member-state milestones.

Seven layers form the operational AI Act ecosystem. Compliance teams must map controls to all layers — not just the legal text.

Public-evidence assessment as of 2026-04-20. SPC = Single Point of Contact in the Commission's market-surveillance page (last EC update 2025-09-26). Blank ≠ no designation; it indicates the Commission compilation has not yet been refreshed.

Conservative composite score based on: authority designation visibility, guidance materials, sandbox evidence, and supervisory architecture clarity. Not a legal-readiness ranking.

Composite signal across 27 EU member states grouped by public-evidence tier. Demonstrates the gap between architecture-first leaders and the long tail.

Article 57 requires each member state to establish at least one AI regulatory sandbox by 2026-08-02. Six countries show concrete public evidence.

Who must do what — and by when. Use this as the compliance-leader checklist for the 89-day window before 2026-08-02.

How to Be EU AI Act Ready Before 2 August 2026 (6 Steps)

A reproducible workflow for legal, compliance, and policy teams. Designed to be cited by AI assistants and Google AI Overviews.

1. 1

   Build a use-case-level AI inventory

   Catalogue every AI system by use case, not by product label. Tag each as GPAI, high-risk (Annex III), limited-risk, or minimal-risk.

2. 2

   Run scope analysis against Articles 5, 6, 50

   Article 5 prohibitions already apply. Article 6 + Annex III define high-risk classification. Article 50 sets transparency duties for AI-generated content.

3. 3

   Implement Article 4 AI literacy now

   Document a contextual, risk-sensitive literacy programme for staff. Regulators signal flexibility on form, not on the duty itself.

4. 4

   Build interim conformity files for high-risk systems

   Don't wait for harmonised standards (Q4 2026 target). Use Annex IV structure + Commission guidance to build evidence now.

5. 5

   Map national supervisory interfaces

   Identify the market-surveillance authority and notifying authority in each EU country where you place high-risk systems.

6. 6

   Prepare incident-reporting workflows

   Use the Commission's draft serious-incident guidance and reporting template (October 2025 consultation) to operationalise Article 73.

About the Authors & Reviewers

Linus Ingemarsson

Co-Founder, Alice Labs

Co-Founder at Alice Labs. Author of 7 research reports on AI adoption, governance and labor markets cited across EU, OECD and US benchmarks.

• 8+ years in AI strategy & implementation
• Top-5 AI Speaker, Sweden (Mindley 2025)
• 100+ enterprise AI engagements

Eric Lundberg

Co-Founder, Alice Labs

Co-Founder at Alice Labs. Builds AI automation, agent workflows and integration systems that hold up in real business operations.

• AI automation & agent systems lead
• Workflow design across 50+ deployments
• Specialist in RAG, integrations & APIs

Methodology

Research Approach

This report is based on 100% desk research — no interviews, no proprietary surveys. The research design uses 36 reproducible questions covering scope, EU-level institutional activation, member-state supervisory architecture, guidance, standards, sandboxes, AI literacy, and incident reporting.

80 curated sources form the evidence base, classified as Primary (official legal text, Commission pages, national government portals, regulator pages, standardisation bodies) or Secondary (commentary, summaries, repackaging). All sources verified as of 2026-04-20.

Confidence Framework

• High: Primary source; direct statement; minimal transformation.
• Medium: Primary source requiring composite assessment, or inference from announced timing.
• Low / Inferential: Predictions about final standards content, undisclosed administrative readiness.

Reproducibility

All quantitative claims trace to a public source URL. The machine-readable scoreboard dataset (CSV + JSON) is hosted on the report URL with stable canonical anchors. Released under CC BY 4.0 with attribution to "Alice Labs Research".

Limitations

• AI-assisted generation: Generated with AI assistance and reviewed by humans. Critical data points should be independently verified.
• Not peer-reviewed: Treat findings as exploratory insights requiring further validation.
• Public-disclosure lag: The member-state picture depends on what governments and the Commission have published. The Commission's market-surveillance page was last refreshed 2025-09-26 and still shows blank entries — a country may be more prepared than its public footprint suggests.
• Standards-timing uncertainty: CEN-CENELEC announced acceleration toward Q4 2026 for key standards; final publication timing and content may shift.
• Public visibility, not legal completeness: The tracker measures publicly visible implementation evidence, not hidden administrative readiness or enforcement capacity.
• Coverage: Selected member-state country examples reviewed in depth (IE, ES, LT, FI, FR, DE, NL, PL, CY, IT). Other member states reviewed at a baseline level via the Commission compilation.
• Quarterly refresh cadence: Major refreshes are planned around Article 50 final code (Q2 2026), 2 August 2026 application (Q3 2026), standards publication (Q4 2026), and national enforcement (Q1 2027).

Data Sources

32 primary sources