Member States designate a market surveillance authority as their single point of contact and notify the Commission of it. Publishing the resulting list is then the Commission's own duty. The Regulation separately requires Member States themselves to make contact details for their competent authorities and single points of contact publicly available by 2 August 2025. Article 70(2)
The Commission's page says two things about that list, and they do not sit together. That a list will be published in due time. And that the list on the page is updated continuously. The page's own last-update stamp reads 26 September 2025.
A page that does not agree with itself
In the part of the page explaining designation, the Commission says it is considering the Member States' notifications and will publish a list of single points of contact in due time. The same passage says Member States were required to designate their market surveillance authorities by 2 August 2025, and that it may open infringement proceedings against those that did not. the same page
The paragraph introducing the table says something different: that the list below it is a list of single points of contact, and that it is updated continuously. the list The page's own last-update stamp reads 26 September 2025. That stamp is a page-level field and says nothing about the table specifically. the stamp
Read on 15 August 2026, nineteen of the twenty-seven Member States have no authority named against them. Eight do. Cyprus, Ireland, Italy, Latvia and Lithuania carry an entry without a marker. Luxembourg, Slovenia and Spain carry one marked as pending final adoption of the national designation decision. the table
What a blank cell does not mean
A blank cell is not an absence of enforcement. Reading a dash as meaning nobody supervises AI in that Member State is the mistake to avoid. Every Member State must establish or designate at least one market surveillance authority. The single point of contact is a market surveillance authority doing a second job. A complaint under the Regulation goes to the relevant market surveillance authority, which need not be the single point of contact. Articles 70(1), 70(2) and 85
So a dash on that page does not tell you that the Member State has designated nobody. It tells you that this page does not name who. Of the three countries below, only Denmark is one of the nineteen; Slovenia and Ireland are both named on it. We did not check the other eighteen, and nothing here says anything about them.
Out of date in both directions
The table is behind the law in two opposite ways. It carries a dash for a country that designated more than a year ago, and it carries a name for a country whose designation has since been revoked.
Denmark is blank, and designated in 2025. Section 2(2) of Act no. 467 of 14 May 2025 names the Agency for Digital Government as the central contact point. The Act was published in the Danish gazette on 15 May 2025 and came into force on 2 August 2025. Act no. 467
The agency says so itself, on its own site, and publishes an address to write to. That is a designated authority with a published contact, against a dash on the Commission's page. the agency
Slovenia is named, and marked pending. The list gives the regulator and an asterisk saying the national designation decision is still to be finally adopted. Slovenia's implementing Act already makes that regulator the single point of contact. Its National Assembly adopted the Act on 23 October 2025 and it was published on 6 November. Whether the asterisk refers to something further is not something these sources settle. ZIUDHPUI, article 7 · AKOS
Ireland has an entry, and the designation behind it has been revoked. Ireland's single point of contact is now a statutory office called Oifig IS na hÉireann. The Act designates it for the purposes of Article 70(2), and in the next subsection revokes the designation that came before it. That earlier designation named the Minister, which is the entry the Commission's list still carries. S.I. 366 of 2025, regulation 6 · section 42
The office did not exist in September 2025. The Act was commenced on 31 July 2026, other than two paragraphs of one definition, and the same day was appointed as the office's establishment day. S.I. 403 of 2026 · S.I. 404 of 2026
The Irish department's own page still uses the future tense. Read on 13 August 2026, it says an AI Office of Ireland will be established by August 2026. It cites no Irish Act, so it does not say in terms whether it means the office the 2026 Act created. the department
A reader who takes the Commission's table as the answer gets Denmark and Ireland wrong.
Who supervises you
- Your national market surveillance authority. Article 74(1) applies the Union market surveillance regime to AI systems, and it reaches every operator the Regulation identifies, not only providers of high-risk systems. Neither it nor the right to complain was touched by the amending Regulation this summer. Article 74(1) · Regulation (EU) 2026/1744
- The AI Office, for two defined categories of system. Systems built on a general-purpose model where model and system come from the same provider or undertaking, subject to four express exceptions. And systems that constitute or are built into a very large online platform or search engine designated under the Digital Services Act. Its competence there is exclusive, and it reaches a deployer only where the deployer is also the provider, or part of the same undertaking. Article 75(1)
- The Commission, if you provide a general-purpose AI model. Article 88(1) gives it exclusive powers to supervise and enforce Chapter V, the chapter that carries the obligations on model providers, and requires it to entrust those tasks to the AI Office. That is a different exclusive competence from the one above, which is about AI systems built on such models. Article 88
- The European Data Protection Supervisor, for Union institutions. It is the competent authority for their supervision and it can fine them, and it sits outside the Member State machinery entirely. Articles 70(9) and 100(1)
The AI Office is not a separate institution. It is the Commission's own function, and references to it in the Regulation are read as references to the Commission. Article 3(47)
One route by which a national authority can ask the AI Office to take a matter on runs through the single point of contact designated under Article 70(2). A second route, in Article 75a(2), names no single point of contact. Both begin with an authority, not with a company. One route open to a company is the Article 85 complaint, which the AI Office may act on, and which is expressed to be without prejudice to other administrative or judicial remedies. Articles 75(2a) and 75a(2)
What is at stake
Breaches of the Article 50 transparency duties sit in the tier of up to EUR 15 000 000, or, if the offender is an undertaking, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. Article 99(4)
Smaller companies are capped the other way round. For small and medium-sized enterprises, including start-ups, each fine is capped at whichever of the percentage and the amount is lower, and that runs across the prohibited-practice tier too. The amending Regulation gave small mid-cap enterprises the same lower-of cap, but not on that most severe tier. Article 99(6) and (6a) · the definition
Member States lay down the penalty rules, in accordance with the terms and conditions the Regulation lays down. They must be effective, proportionate and dissuasive, and a smaller company's economic viability has to be taken into account when they are imposed. Member States also have to tell the Commission what those rules are. Article 99(1) · Article 99(2)
Where the AI Office holds competence, a decision finding non-compliance may be accompanied by a fine, and the operator has to be sent preliminary findings first. Before the AI Office, breach of any applicable provision falls into the Article 99(4) tier, including provisions Article 99(4) does not itself list. Separate powers reach misleading information and periodic penalty payments. Article 75c
The Commission's power to fine general-purpose model providers is a different power in the same Regulation. Same headline numbers, but a different addressee, providers of general-purpose AI models, and available only on a finding that the provider acted intentionally or negligently. Article 99(4) sets no such threshold. Article 101(1)
The 2 December date
Output from older generative systems has until 2 December 2026 to be marked. Providers of systems generating synthetic audio, image, video or text content that were placed on the market before 2 August 2026 get that transitional. It covers the Article 50(2) marking obligation and nothing else. Article 111(4)
The transparency duties split by actor, and the split decides what you owe. Providers must design systems intended to interact directly with people so that those people are informed that they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use. That duty does not apply to systems authorised by law for criminal-offence purposes, subject to safeguards, unless the system is available for the public to report an offence. Providers of generative systems must mark the output in a machine-readable format and make it detectable as artificially generated or manipulated. Article 50(1) · Article 50(2)
The marking duty itself is stated flat. What is qualified by technical feasibility is the next sentence, requiring the technical solutions to be effective, interoperable, robust and reliable. The duty is then disapplied to the extent a system only assists standard editing, or does not substantially alter the input data the deployer provided or the semantics of that data, or where the system is authorised by law for criminal-offence purposes. Article 50(2), all three sentences
Deployers carry their own duties, and they are not the same ones. Telling people when emotion recognition or biometric categorisation is being used on them. Disclosing deep fakes. Disclosing AI-generated text published to inform the public on matters of public interest. Each carries exceptions this summary does not repeat. Article 50(3) and (4)
Codes of practice sit alongside this. The Commission encourages and facilitates them, and assesses whether adherence is adequate to ensure compliance with the marking and disclosure duties. If it finds a code inadequate it can specify common rules by implementing act. That paragraph is addressed to the Commission and describes what the Commission does. Article 50(7)
One more date, because application and entry into force are not the same thing. The Regulation is in force and has been since 2024. It applies from 2 August 2026, and Article 113 then sets out a list of departures in both directions. Some are earlier: Chapters I and II from 2 February 2025, Chapter III Section 4, Chapters V, VII and XII and Article 78 from 2 August 2025, and Articles 102 to 110 from 27 July 2026. Some are later: two groups of provisions in Article 5 from 2 December 2026, and Chapter III Sections 1, 2 and 3 from 2 December 2027 and 2 August 2028. Follow the link for the whole list and its own carve-outs. Article 113
And a complaint, if you need to make one, goes to the relevant market surveillance authority. Anyone with grounds to consider there has been an infringement can make one. Article 85
Three things to do now
- 01
If your Member State is blank on that list, do not stop there. The page names an authority for eight Member States and carries a dash for nineteen. A dash on it is not a finding that nobody has been designated: Denmark has been designated since 2 August 2025 and is one of the nineteen. the table · Act no. 467
- 02
Settle whether you are a provider, a deployer, or both. You are a provider if you develop a system, or have one developed, and place it on the market or put it into service under your own name or trademark. You are a deployer if you use a system under your authority, outside a personal non-professional activity. Nothing in either definition rules the other out. Article 3(3) and (4)
- 03
Diarise 2 December 2026 if you are the provider of a generative system placed on the market before 2 August 2026. That is the end of the transitional for the Article 50(2) marking obligation, which binds providers. It covers that obligation and nothing else, so it is not a general extension. Article 111(4)
The Blackletter Brief tracks UK and EU AI governance from official sources only: legislation, regulators and the institutions themselves, every claim traced to the primary record, with the source linked in the section that develops it. No law firm marketing, no trade press. Provisions are summarised and carry exceptions this summary does not repeat, so follow the link before acting on one. The EU text used here is the consolidated version of 27 July 2026, which incorporates Regulation (EU) 2026/1744. Built by Blackletter, a UK AI governance intelligence platform launching soon. Forward this to the person in your company who quietly worries about this stuff.