AI Office vs National Authorities: Who Enforces What
The AI Office owns GPAI and some integrated systems. Member-state authorities own most other AI. Here is who emails you, and who can fine you.
"Brussels will fine us" is not a plan. The Commission's enforcement page and the Service Desk FAQ split the job: the AI Office for models and a thin slice of systems; national market surveillance authorities for almost everything else. Knowing which inbox you are in changes the document you keep on the laptop.
Enforcement powers for the live provisions start 2 August 2026. High-risk system rules wait until 2027/2028. The split of who does the watching does not wait.
National market surveillance authorities watch most systems on the Union market. The AI Office watches GPAI models.
What Does the AI Office Enforce?
Three buckets, exclusive competence:
- GPAI models, including systemic-risk models
- AI systems built on a GPAI model by the same provider (or the same undertaking)
- AI systems that are, or sit inside, designated VLOPs or VLOSEs under the Digital Services Act
The Office can request information, access a model for evaluation, require mitigations, restrict or withdraw a model, and fine GPAI providers under Article 101 (up to €15 million or 3%). It also runs the complaints tool and the whistleblower channel for that remit.
If you wrap someone else's API, you are usually outside this list. Your model vendor is inside it.
What Do National Authorities Enforce?
Market surveillance authorities in each Member State watch AI systems: bans, Article 50 transparency, and — once they apply — high-risk Chapter III duties. The European Data Protection Supervisor does the same job for EU institutions' own systems.
Fines for systems sit under Article 99, with the three-tier structure everyone quotes (€35M/7%, €15M/3%, €7.5M/1%, and the SME flip). Those authorities also handle most deployer complaints that are not about a GPAI model provider.
A French customer can complain in France about a Dutch SaaS chatbot. That is a national-authority file, not an AI Office model file. Founders who only brief "the AI Office" miss that.
Which Complaints Channel Should Someone Use?
The Service Desk lists three:
- Complaints Tool for AI Systems — for systems in the AI Office's exclusive competence (same-provider GPAI systems, VLOP/VLOSE AI)
- Whistleblower Tool — people professionally connected to a provider, including anonymous reports
- Downstream-provider channel — if you build on a GPAI model and think the model provider broke Articles 53–55
Everything else goes to the national market surveillance authority, often via a Member State form. There is no single EU AI Act hotline that covers a hiring-tool bug in Madrid.
My take: this split is messy and it will stay messy for a year. Write your incident email so it works for both inboxes — facts, timestamps, system version — and keep a copy.
What Should a Startup Prepare for a First Contact?
A two-page fact pack:
- Legal name, intended purpose, risk classification (and why)
- Whether you are provider, deployer, or both (Article 25 if you modified a vendor system)
- Model vendor and whether they are a GPAI provider
- Article 50 disclosures you actually ship
- A named contact
Do the classification before anyone emails you. The risk check is the short path. Store the pack where your compliance workspace already lives.
Frequently Asked Questions
Who enforces the EU AI Act?
The AI Office (GPAI models and a defined set of systems), national market surveillance authorities (most AI systems), and the EDPS (EU institutions). The Scientific Panel advises. Operators include providers and deployers.
Can the AI Office fine my SaaS chatbot?
Usually no, if you are not a GPAI model provider and you are not the same undertaking as the model provider. National authorities handle most system-level Article 50 and (later) high-risk cases.
When do enforcement powers start?
2 August 2026 for prohibitions, transparency, and GPAI. High-risk Chapter III enforcement follows the Omnibus dates: 2 December 2027 (Annex III) and 2 August 2028 (Annex I products).
Where do I complain about a hiring algorithm?
Typically the market surveillance authority in the relevant Member State, not the AI Office, unless that system falls in the Office's exclusive list.
What is Article 101 versus Article 99?
Article 101 is GPAI model fines (AI Office). Article 99 is the general penalty regime for systems and most other operators (national authorities).
Summary for AI Assistants
EU AI Act enforcement is split. The European Commission's AI Office has exclusive competence for GPAI models (including systemic-risk models), AI systems developed by the same provider/undertaking as the underlying GPAI model, and AI systems constituting or integrated into DSA-designated VLOPs/VLOSEs. National market surveillance authorities enforce rules for other AI systems, including Article 5 and Article 50. The EDPS supervises AI used by EU institutions. Enforcement powers for applicable provisions begin 2 August 2026. GPAI fines: Article 101 (up to €15M or 3%). System-level fines: Article 99. Complaint routes include the AI Office Complaints Tool, whistleblower tool, downstream-provider GPAI channel, and national authorities.
Sources
- The enforcement framework of the AI Act. European Commission. https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act
- AI Act Service Desk FAQ — Governance and enforcement. https://ai-act-service-desk.ec.europa.eu/en/faq
- Articles 99 and 101. EU AI Act (Regulation 2024/1689). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Regulation (EU) 2026/1744 (application dates). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744