⚠ Medium compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
Establishing the national enforcement bodies businesses face
Article 70 requires each member state to put in place the national institutional infrastructure needed to implement the AI Act. Every member state must designate one or more competent authorities — which may include the notifying authority and market surveillance authority — and must designate a single point of contact for AI Act coordination. These are the bodies with power to inspect, investigate and fine businesses under the Act.
WHAT IT SAYS
At least one authority per member state, notified to the Commission, fully resourced
- Each member state must designate one or more national competent authorities to supervise the application and implementation of the AI Act
- At least one of the designated authorities must be a market surveillance authority responsible for activities in Chapter III (high-risk AI) and Chapter X (confidentiality and penalties)
- Member states may designate an existing authority — such as a data protection authority, financial regulator or product safety body — to take on AI Act responsibilities
- Each member state must also designate a single point of contact for coordinating with the Commission, the AI Office and other member states
- Member states must notify the Commission of their designated authorities by 2 August 2025
- Competent authorities must have adequate technical, financial and human resources — and sufficient AI expertise — to carry out their functions
- Authorities must be independent and impartial, free from conflicts of interest with the businesses they regulate
- The Commission publishes and updates a list of all designated national competent authorities
WHO IS AFFECTED
All businesses operating AI systems in the EU
- All businesses — national competent authorities are the bodies that will investigate compliance, request documentation and impose fines
- Providers of high-risk AI systems have the most direct exposure — market surveillance authorities may inspect their systems and documentation
- Member state governments — obliged to designate and resource their competent authorities by August 2025
- Existing regulators that may be designated — data protection authorities, financial supervisors, product safety bodies
WHAT IT MEANS FOR SMES
Know your national authority — and engage with them early
- Your most important practical action from this article: identify which authority in your member state is designated as the market surveillance authority for AI Act purposes — this is the body you are accountable to
- In many member states the designation is still being determined or has recently been announced — check your government’s AI Act implementation announcements
- Early voluntary engagement with your national authority — before any complaint or investigation — is the lowest-risk compliance strategy; many authorities welcome proactive contact from businesses trying to comply
- The single point of contact is useful for general compliance questions that do not require going through the full authority structure
- Resource adequacy is a real concern — some smaller member states may designate authorities that lack deep AI expertise; this is where Article 69 expert pool access becomes relevant
Related Articles
- Article 74 — Market surveillance (the enforcement powers national authorities exercise)
- Article 28 — Notifying authorities (may be the same body as the national competent authority)
- Article 69 — Expert pool access (supplements national authority expertise)
- Article 99 — Penalties (the fines national authorities can impose)
