AI Act Readiness Index

Comprehensive assessment of EU member states’ AI Act enforcement preparedness

Last updated: May 17, 2026

Methodology

The AI Act Readiness Index evaluates all 27 EU member states on a 100-point scale across seven key dimensions:

    • Authority Status (20 points) – Official designation and notification to the European Commission

    • Institutional Capacity (15 points) – Lead body identified, institutional structure defined, and resourcing signals

    • National Legislation (10 points) – Implementation laws enacted or in consultation

    • Public Signals (15 points) – Visible preparation activity and enforcement readiness

    • Market Activity (15 points) – AI ecosystem development and industry engagement

Countries are classified into four readiness bands:

– Ready (85-90 points) – Fully operational enforcement capacity

– Advanced (65-80 points) – Strong preparation, ramping up operations

– Emerging (35-60 points) – Basic framework in place, building capacity

– Low (15-30 points) – Limited visible preparation

Key Findings (May 2026)

  • Readiness distribution has shifted but remains top‑heavy at the bottom. Five countries are now in the Ready band (Spain, Denmark, Lithuania, Finland, Italy), four in Advanced (Ireland, Germany, Slovenia, Netherlands), thirteen in Emerging, and five in Low. Finland and Italy move up from Advanced to Ready; Netherlands moves from Emerging to Advanced; Latvia moves from Low to Emerging.

  • Only 8 of 27 EU Member States have an officially notified national single point of contact in the Commission’s public list, based on the latest EP analysis (March 2026). The European Parliament’s enforcement brief notes that as of March 2026, the Commission list contained eight SPOCs out of 27 Member States, and there is no newer official count published yet.

  • The August 2, 2026 sandbox deadline is approaching with limited operational capacity. Article 57 requires each Member State to have at least one AI regulatory sandbox operational by 2 August 2026. Only Spain, Denmark, Lithuania, and Finland have clearly documented, operational national sandboxes; several others (Germany, Netherlands, Malta, Luxembourg) have sandbox mandates in draft or pending laws but no confirmed operations.

  • Germany’s KI‑MIG is still only a draft, leaving formal designation incomplete. The Cabinet adopted the draft KI‑MIG on 11 February 2026 and the Bundestag held the first reading on 20 March 2026, with a Bundesrat opinion issued on 2 April 2026. Until the law is passed and published, BNetzA remains only a proposed MSA/SPOC in statute, not yet formally designated or notified.

  • France remains the largest economy without designated national AI Act authorities. More than nine months after the 2 August 2025 deadline, France still has not notified NCAs or a SPOC to the Commission; the DDADUE bill’s designation provisions are stalled or withdrawn in the Assemblée nationale, while CNIL and other bodies continue to act de facto without formal AI Act status.

  • The Emerging band is still the most crowded tier, but momentum is uneven. Thirteen countries sit between 35 and 64 points, with Poland (Council of Ministers adoption of its AI Act bill on 31 March 2026) and Portugal (ANIA 2026–2030 Action Plan adopted January 2026) showing the clearest legislative progress towards higher readiness.

  • Distributed‑authority models remain the highest‑friction environments for SMEs. Ireland (15 sectoral regulators), the Netherlands (multi‑authority model with AP and RDI as coordinators), and Belgium (federal/regional split) create complex supervisory landscapes for cross‑sector SMEs, whereas single‑agency models in Spain (AESIA) and Lithuania (RRT) remain structurally more SME‑friendly.

5 countries achieve “Ready” status with scores of 85-90 points:
Denmark (90), Spain (90), and Lithuania (85) demonstrate fully operational enforcement capacity with comprehensive guidance, enacted legislation, and active regulatory sandboxes.

4 countries rank “Advanced” (65-80 points):
Italy, Ireland, Finland, Slovenia, and Germany have strong institutional frameworks but are still building operational capacity.

13 countries fall in “Emerging” band (35-64 points):
Mid-tier preparation with basic frameworks established but limited operational signals.

5 countries remain in “Low” band (15-30 points):
Minimal visible preparation or enforcement infrastructure.

What Changed

17 May 2026 – Italy upgraded to Ready (80 → 85) on the back of UNI 11621‑8. Italy moves from “Advanced” to “Ready” in this update. The change is driven not by new authorities or legislation – Law 132/2025 and the AgID/ACN model remain as previously assessed – but by the adoption of UNI 11621‑8:2026, the first national standard in Europe that turns the EU AI Act into 12 certified AI professional profiles. This standard gives Italian enterprises and public administrations concrete, role‑level implementation guidance (missions, competences, KPIs) aligned with the AI Act, substantially strengthening the Guidance & Support dimension in the index. Implementing decrees on sanctions and the national sandbox are still pending.

4 May 2026 — Full update pass across all 27 member states. Four score changes. Finland resourcing upgraded to Yes (Act 1377/2025 in force since 1 January 2026, Traficom designated as SPOC with 15 sector MSAs, first EU member state with operational AI Act enforcement); public signals upgraded to Active. Score revised from 75 to 85. Band changed from Advanced to Ready. Netherlands legislation upgraded to Draft/Consultation: draft Implementation Act (Uitvoeringswet AI-verordening) published for public consultation 20 April 2026; AP and RDI confirmed as coordinating authorities. Score revised from 60 to 65. Band changed from Emerging to Advanced. Latvia lead body upgraded to Yes: VARAM formally confirmed as lead coordinating authority per Cabinet decision. Score revised from 30 to 35. Band changed from Low to Emerging. Portugal legislation upgraded to Draft/Consultation: ANIA 2026–2030 Action Plan adopted via Council of Ministers Resolution No. 2/2026 (January 2026) with AI Act implementation as an explicit H1 2026 target. Score revised from 50 to 55. Band remains Emerging. Germany: notes updated to reflect Bundesrat position submitted 2 April 2026; second and third Bundestag readings pending; KI-MIG not yet enacted; score and band unchanged at 75, Advanced. Notes updated for Poland, France, Italy, Ireland, Malta, Hungary, Estonia, Belgium, Czech Republic, Slovakia, Bulgaria, Greece, Croatia, Luxembourg.

14 April 2026 — France updated following comprehensive implementation analysis (April 2026). Resourcing upgraded to Yes (CNIL dedicated AI Service operational, INESIA inaugurated Jan 2025, ACPR 50 AI specialists, France 2030 €2.5B AI budget). Sandbox downgraded to None found: CNIL’s existing sandboxes are GDPR sandboxes, not formal AI Act Article 57-58 sandboxes. Net score unchanged at 55. Band remains Emerging.

11 April 2026 — Germany updated following comprehensive implementation analysis (April 2026). Resourcing upgraded to Yes (KI-Service Desk operational since July 2025, BNetzA Market Surveillance Division active). Guidance upgraded to Extensive official guides (Compliance Kompass, risk classification tool, SME documentation guidance, AI literacy resources). Score revised from 65 to 75. Band remains Advanced.

10 April 2026 — Romania updated: authority status upgraded to Pending Designation following government memorandum of March 12, 2026 designating ANCOM as market surveillance authority and SPOC. Score revised from 10 to 40. Band changed from Low to Emerging. Source URLs updated.

2 April 2026 — All source URLs verified. Germany authority status corrected to Pending Designation (KI-MIG not yet enacted by Bundestag). Last reviewed date updated to April 2, 2026.

28 March 2026 — Initial publication. Full verification pass across all 27 member states.

See Actual Enforcement Actions

Explore documented AI Act enforcement cases, investigations, and regulatory actions in our AI Act Enforcement Tracker →

Data Sources

This index is based on publicly available information from:

    • European Commission AI Act implementation monitoring and market surveillance authority listings
    • IAPP DPA Directory (snapshot January 14, 2026)
    • National government announcements and ministry websites
    • National implementation legislation (published and draft)
    • EU AI Act Service Desk listings
    • Regulatory sandbox announcements and operational confirmations
    • Legal commentary from DLA Piper, Matheson, Arendt, and other law firms
    • artificialintelligenceact.eu implementation tracker
    • clearact.net EU AI Act Member State Implementation Tracker (May 2026)
    • digitalpolicyalert.org legislative event tracker
    • Bird & Bird AI Regulatory Horizon Tracker (per-country pages)
    • National authority websites: Bundesnetzagentur (DE), Traficom (FI), VARAM (LV), ANACOM (PT), RTR (AT), AKOS (SI)
    • Council of Ministers decisions and government memoranda (Romania, Latvia, Poland)

All data was verified against official government sources. Last reviewed May 17, 2026.

This index prioritizes source quality over quantity. Countries are scored conservatively based on verifiable public signals. The index will be updated regularly as enforcement frameworks continue to develop across the EU.

For detailed scoring methodology, source citations, and country-specific analysis, explore the interactive table above.