EU AI Act Implementation Tracker 2026: Authorities & Readiness

The EU AI Act's general application date is 2 August 2026 — 12 days from today. EU-level governance is operational (AI Office, AI Board, GPAI Code of Practice, Service Desk), but national supervisory readiness is uneven: 10 of 27 member states show advanced public implementation evidence (Ireland, Spain, Lithuania, Finland, France, Germany, Netherlands, Poland, Cyprus, Italy), while 17 remain blank in the Commission's market-surveillance compilation.

The EU AI Act Implementation Tracker 2026 (published 2026-04-20) maps how Regulation (EU) 2024/1689 is being operationalised across EU institutions and 27 member states. It is built on 80 curated public sources (EUR-Lex, European Commission, national governments, regulators, CEN-CENELEC, EDPB/EDPS) and 36 reproducible desk-research questions.

Three implementation layers: (1) EU-level activation — mature: the AI Office, AI Board, prohibited-practices guidance (2025-02-04), AI system definition guidance (2025-02-06), GPAI Code of Practice (2025-07-10), Service Desk (2025-10-08), and Digital Omnibus proposal (2025-11-19) are all publicly active. (2) Member-state supervisory architecture — uneven: Ireland (15 competent authorities), Spain (AESIA + 16 practical guides), Germany (sandbox pilot completed 2026-03-17), and Finland (powers in force 2026-01-01) lead. (3) Implementation infrastructure — standards still being finalised; CEN-CENELEC targets Q4 2026 for key harmonised standards, after the 2026-08-02 application date.

Limitations: the Commission's market-surveillance page has not been refreshed since 2025-09-26 — blank entries do not prove non-designation. Tracker measures public implementation evidence, not hidden administrative readiness. Standards-timing assumptions may shift. AI-assisted desk research, reviewed by humans, not peer-reviewed.

Q2 2026 Update — Latest insights (June 2026)

Where the implementation stands in late Q2 2026

With roughly five weeks remaining until the 2 August 2026 general application date, the picture has not structurally changed since the v1.1 refresh in April. EU-level governance (AI Office, AI Board, GPAI Code of Practice, Service Desk) is operational, ten member states retain advanced public implementation evidence, and seventeen remain blank in the Commission's market-surveillance compilation. The most consequential Q2 movement is at the standardisation and demand-side layers, not the institutional one.

Reader-question pickup: the EU AI Act compliance consulting market

The most frequent inbound query on this report is some version of "how big is the EU AI Act compliance consulting market in 2026?". The honest answer: there is no single authoritative figure. Compliance consulting attached to the AI Act is bundled inside broader AI advisory and risk-and-compliance lines at most firms, and most published market sizes are vendor extrapolations rather than government statistics. Two anchor data points worth citing:

• Stanford HAI AI Index 2025 reports global private AI investment of USD 252.3 billion in 2024 (a 26% year-on-year rise, with generative AI alone at USD 33.9 billion). Compliance, governance and assurance spend is a derivative of this base — not an independent category. (hai.stanford.edu)
• OECD.AI tracks national AI policy initiatives across more than 70 countries and the EU; its policy observatory is the most reliable public registry of regulatory activity, but it does not estimate consulting market size. (oecd.ai)
• McKinsey "State of AI" survey (2024) finds that 67% of organisations report adopting AI in at least one business function, and that risk-management and compliance are among the fastest-growing AI-related functional spend lines. (mckinsey.com)

Practical translation: any vendor quoting a precise "EU AI Act compliance consulting TAM" for 2026 is almost certainly extrapolating. Buyers should benchmark on scope of work (Article 4 literacy programme, Article 6/Annex III scoping, conformity-file build, FRIA design, incident workflow) rather than headline market size.

Q2 2026 signals worth noting

• Article 50 transparency code remains in second-draft form as of the March 2026 Commission publication; no public confirmation of a third draft has appeared in the EC library since. Treat the second draft as the working reference for AI-generated-content labelling workflows.
• CEN-CENELEC harmonised standards remain on the Q4 2026 target. Buyers should plan on the assumption that the published OJ list will lag the 2 August application date by at least one quarter.
• Member-state SPoC compilation on the Commission's market-surveillance page has still not been refreshed since 2025-09-26 at the time of this Q2 review — the underlying limitation in the v1.0 report stands.

EU AI Act Tracker Scoreboard

The scoreboard compiles 25 indicators across EU-level milestones, member-state public-evidence signals, sandbox evidence, and standardisation timing. Confidence: High for legal texts and EC-published guidance, Medium for composite assessments and inference from announced timing.

Expanded Analysis — June 2026 (citation-ready)

Quotable single-sentence facts (citation-ready)

Member-state authority cross-reference (public-evidence-only)

The table below names the publicly visible market-surveillance, sectoral, or coordinating authority signalled in each member state's own materials as of June 2026. It is a public-evidence snapshot, not a complete legal designation — verify against the Commission's market-surveillance compilation and national legal acts before placing reliance.

Notes: For member states where no formal MSA/SPoC has been publicly published, the table names the lead ministry or regulator signalled in national AI strategies and Commission communications. Status is a public-evidence snapshot; verify against the Commission's market-surveillance compilation at digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act and applicable national legal acts.

Annex III high-risk categories at a glance

Source: Regulation (EU) 2024/1689, Annex III; Commission AI Act portal at digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. Article 6(1) Annex I product-embedded high-risk AI (medical devices, machinery, automotive, toys etc.) applies from 2027-08-02.

EU AI Act vs ISO/IEC 42001 vs NIST AI RMF — quick reference

EU AI Act glossary (extended)

One-sentence definitions tied to a primary source. Linked to schema.org DefinedTermSet on this page.

AI Act (Regulation (EU) 2024/1689)

The world's first comprehensive horizontal AI regulation, in force from 2024-08-01 and applied in phases through 2027-08-02. [source]

AI Office

European Commission body within DG CONNECT enforcing GPAI rules; established by Commission Decision 2024-01-24. [source]

AI Board

Coordination body of EU member-state representatives plus the AI Office; supports consistent application of the AI Act across the Union. [source]

AI Act Service Desk

One-stop information point for AI Act questions launched 2025-10-08 alongside the Single Information Platform. [source]

GPAI Code of Practice

Voluntary code published 2025-07-10 providing a presumption of compliance with EU AI Act Chapter V for general-purpose AI providers. [source]

Digital Omnibus on AI

Commission proposal COM(2025) 836 published 2025-11-19 simplifying digital-acquis obligations including targeted AI Act adjustments. [source]

Article 4 AI literacy

Obligation in force since 2025-02-02 requiring AI providers and deployers to ensure sufficient AI literacy among staff. [source]

Article 5 prohibited practices

Set of AI uses banned in the EU since 2025-02-02, including social scoring by public authorities and untargeted facial-image scraping. [source]

Article 27 FRIA

Fundamental Rights Impact Assessment required of certain high-risk deployers before first use of an Annex III high-risk system from 2026-08-02. [source]

Article 50 transparency

EU AI Act obligation requiring labelling of AI-generated synthetic content and disclosure of deepfakes and emotion-recognition use; applies from 2026-08-02. [source]

Article 99 penalties

Penalty ceilings up to EUR 35m or 7% of worldwide annual turnover for Article 5 breaches; up to EUR 15m or 3% for high-risk breaches. [source]

High-risk AI system

AI system classified under Article 6 + Annex III (or Article 6(1) Annex I product law), subject to conformity assessment and full provider/deployer obligations. [source]

General-Purpose AI (GPAI) model

An AI model with significant generality and ability to perform a wide range of distinct tasks, regulated under Chapter V; in scope since 2025-08-02. [source]

AI Regulatory Sandbox

Controlled testing environment required by Article 57 — every EU member state must establish at least one by 2026-08-02. [source]

National Competent Authority (NCA)

Member-state authority designated to supervise AI Act implementation — including market-surveillance authorities, notifying authorities, and fundamental-rights authorities. [source]

Notified Body

Independent third party designated under Article 31 to perform conformity assessment of high-risk AI systems where required. [source]

ISO/IEC 42001:2023

International standard for AI management systems, published 18 December 2023 — the only certifiable AI governance standard. [source]

NIST AI RMF 1.0

US voluntary AI Risk Management Framework, published 26 January 2023; core functions Govern, Map, Measure, Manage. [source]

CEN-CENELEC JTC 21

European standardisation joint committee responsible for AI Act harmonised standards; accelerated key-standards target Q4 2026. [source]

How to cite this report

@misc{alicelabs2026euaiacttracker,
  author = {{Alice Labs}},
  title  = {EU AI Act Implementation Tracker 2026: Authorities and Readiness},
  year   = {2026},
  month  = {June},
  note   = {Version 1.3},
  url    = {https://alicelabs.ai/reports/eu-ai-act-implementation-tracker-2026}
}

Version history

1. v1.3 — 26 June 2026

   Deep expansion. Added quotable stat callouts, member-state authority cross-reference (27 countries), Annex III high-risk category quick reference, EU AI Act vs ISO/IEC 42001 vs NIST AI RMF table, extended glossary (19 terms), how-to-cite block, methodology note, 13 new FAQ entries targeting EU AI Act timeline, Article 99 penalties, Article 2 extraterritoriality, Article 27 FRIA, GPAI Code, NIST AI RMF mapping, ISO/IEC 42001 cost, governance platform pricing, Sweden SOU 2025:101, and sectoral application (HR, healthcare, finance, public sector).

2. v1.2 — 26 June 2026

   Q2 2026 maintenance refresh. Added Q2 2026 Update chapter (Article 50 second-draft code status, CEN-CENELEC Q4 2026 standards target, SPoC compilation lag). FAQ entries on consulting market sizing and changelog.

3. v1.0.1 — 23 April 2026

   Research presentation pass. Added summary box, structured metadata, DefinedTermSet glossary (8 terms), internal cross-references.

4. v1.0 — 20 April 2026

   Initial public release. 80 sources, 27 member states tracked, 9 visualisations, 12 key findings, quarterly refresh cadence established.

Methodology note (Q2 2026 expansion)

The v1.3 expansion above is strictly additive. No v1.0 scoreboard values, key findings, or claims were modified. The expansion process was: (1) inventory the questions readers actually arrive on this URL with, including queries observed in our search-console data and queries that frontier-model search systems issue when researching the EU AI Act; (2) for each recurring question, write a single-sentence answer tied to a primary public source (EUR-Lex, European Commission, AESIA, Bundesnetzagentur, ISO, NIST, Stanford HAI, McKinsey, OECD.AI); (3) collate authority cross-references from each member state's own published materials; (4) version-stamp the page and update the schema.

Sources are dated where dating exists (publication or last update). Where a member state has not published an explicit MSA designation, we name the publicly signalled lead ministry or regulator — a public-evidence snapshot, not a legal designation. Verify against the Commission's market-surveillance compilation and the relevant national legal act before placing reliance.

Three Implementation Layers (Definitions)

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive horizontal AI regulation. As of 2026-04-20, "implementation" is no longer about the legislative text alone — it is about an expanding operational bundle: EU governance institutions, Commission guidance, voluntary codes, harmonised standards, national supervisory authorities, and regulatory sandboxes.

Three implementation layers

For enterprises preparing for EU AI Act compliance: Alice Labs operates as an AI implementation consultant with deep regulatory experience, provides AI strategy consulting aligned with the Act's risk-tier framework, and supports Swedish enterprises directly via our AI-konsult Stockholm team.

EU AI Act Compliance Timeline

EU Institutional & Operational Stack

Commission Guidance Pipeline

The European Commission has issued or is preparing the following operational guidance for the EU AI Act:

Member-State Implementation Heatmap (27 countries)

Public-evidence assessment is conservative: blank EU Commission listings do not prove a member state has not designated authorities — the Commission's market-surveillance page was last updated 2025-09-26. Many newer national designations exist that have not yet propagated to the EU compilation.

Architecture-first vs tooling-first split

Architecture-first countries (Ireland, Lithuania, Finland, Cyprus) make institutional roles legible early. Their public materials make it easier for companies to identify who supervises what.

Tooling-first countries (Spain, Germany) publish practical compliance aids even where final supervisory settlement is less crisp publicly. Spain's AESIA guide package and Germany's service desk + sandbox pilot are the clearest examples.

France sits between the two — combining DGCCRF coordination, CNIL privacy guidance, and INESIA AI-evaluation capacity. Poland remains in active legislative construction. Italy shows policy-law layering; operational AI Act detail is less public than ES or IE.

Supervisory Architecture Maturity

AI Regulatory Sandboxes Tracker

Stakeholder Obligation Matrix

Standards & Conformity Assessment

Harmonised standards are voluntary compliance tools that create a presumption of conformity when published in the EU Official Journal. CEN-CENELEC's accelerated timetable targets Q4 2026 for key AI standards — after the 2026-08-02 application date.

Implication: Most high-risk providers will need to evidence compliance without a complete harmonised-standards package at the application date. Build interim conformity files now using:

• Annex IV technical documentation structure (directly from the Regulation)
• Commission guidance on AI system definition + prohibited practices
• ISO/IEC 42001 (AI management system) as a voluntary management baseline
• Industry-sector standards (MDR, IVDR, automotive functional safety) where applicable
• Internal risk-classification + human-oversight design documentation

How to Be EU AI Act Ready Before 2 August 2026

A reproducible workflow for legal, compliance, and policy teams operating across EU jurisdictions. Each step is tied to an official source.

Structured Claims (12, Citation-Grade)

Citation-grade structured claims with confidence scores, designed for LLM extraction and direct verification against primary sources.

Recommendations by Audience

For legal teams

• Maintain a central AI Act applicability register by use case, not by product label alone.
• Track GPAI obligations separately from high-risk-system obligations — they have different enforcement pathways and timing.
• Map the national supervisory interface for every EU jurisdiction where you place systems.

For compliance leaders

• Implement a documented Article 4 AI literacy programme now; regulators signal flexibility on form, not on the duty.
• Build an interim conformity file for high-risk systems rather than waiting for harmonised standards.
• Prepare incident workflows before 2026-08-02 using the Commission's draft guidance and templates.
• Run supplier-contract review for high-risk and GPAI exposures.

For policymakers

• Publish national supervisory charts in machine-readable format.
• Pair every authority designation with a public scope note explaining sectoral competence boundaries.
• Publish sandbox entry criteria and outputs — sandboxes are systemically valuable only if their learning diffuses.

Frequently Asked Questions

Version History