National Implementation of the EU AI Act across Member States
The EU AI Act sets a harmonized framework with direct legal effect, yet several articles call for national transposition. Member states are moving at different speeds, using different legislative tools, and standing up different supervisory models. This article distills where implementation stands and what legal teams should prepare for.
Where implementation stands
Across the EU, we see three broad tracks: early movers with framework laws, states advancing draft bills under consultation, and jurisdictions relying on existing agencies while building capacity. Transitional guidance is emerging in some countries, with enforcement dates staggered by risk tier and role in the value chain.
- Framework or "AI omnibus" laws adopted or tabled to empower authorities and set procedures.
- Draft bills consolidating sector amendments (product safety, consumer law, public procurement).
- Interim use of market surveillance authorities, DPAs, and sector regulators through cooperation agreements.
- Phased application calendars tied to prohibited practices, general-purpose AI duties, and high-risk systems.
- Early regulatory sandboxes to test documentation, data governance, and oversight controls.
Reference texts and institutional updates are available via the Official Journal and the Commission's AI Office.
Differing approaches and timelines
Variation stems from constitutional structures, legislative backlogs, election calendars, and budget cycles. Legal teams should track how each country chooses to legislate, who will supervise, and when specific obligations apply.
- Centralized AI authorities vs. networks of sector regulators with a coordinating body.
- Single omnibus acts vs. incremental amendments to existing laws and decrees.
- Sanction regimes and aggravating factors, including national choices on penalty ceilings.
- Alignment windows with GDPR, product safety, consumer protection, and NIS2 obligations.
Institutional and supervisory models
Expect one of four patterns: a new AI authority; a DPA with extended powers; market surveillance bodies coordinating with sector regulators; or a hybrid with a national coordinator. Memoranda of understanding and case-allocation rules will be key for businesses that operate cross-sector or offer general-purpose AI.
- Single point of contact for high-risk providers and deployers.
- Accreditation of notified bodies for conformity assessments.
- Cooperation procedures for cross-border cases and systemic risks.
Why delays occur-and what they mean for you
- Competing legislative priorities (e.g., NIS2, DSA/DMA transposition) and limited drafting capacity.
- Budget and staffing constraints for new authorities and notified bodies.
- Pending harmonized standards and guidance that influence technical implementation choices.
Implications: prolonged uncertainty on supervisory expectations, uneven enforcement starts, and supply-chain friction. Mitigation: adopt baseline controls now, document decisions, and prepare to adjust once national rules and standards settle.
National discretions that create variations
- Higher administrative fines or aggravating criteria.
- Extra registration or notification for high-risk uses in sensitive sectors.
- Expanded transparency for AI interacting with individuals or used by public authorities.
- Local language requirements for documentation and user instructions.
- Sandbox entry criteria and data-sharing rules.
Key implementation challenges for organizations
- Reliable inventory and classification of AI systems by use case and risk.
- Vendor and model management: technical documentation, license terms, and updates.
- Fundamental Rights Impact Assessments and risk controls for high-risk systems.
- Data governance: provenance, consent basis where needed, quality metrics, and bias testing.
- Human oversight, logging, and traceability that stand up to audit.
- Incident reporting, corrective actions, and withdrawal procedures.
- Marketing and claims reviews to avoid misleading communications.
Practical recommendations for legal teams
- Create an AI Act playbook with a country-by-country tracker of authorities, deadlines, and penalties.
- Assign a single accountable owner; define RACI across legal, risk, product, and engineering.
- Stand up an AI system inventory and classification workflow tied to procurement and change management.
- Publish policy and control standards: data governance, model risk testing, human oversight, logging, and decommissioning.
- Prepare FRIA, transparency notices, and technical documentation templates; test them in a pilot.
- Update contracts: supplier warranties, audit rights, incident notice, GP-AI disclosures, and flow-downs.
- Set an evidence vault for audit-readiness; rehearse a supervisory request simulation.
- Horizon-scan for national measures, standards, and guidance; brief the board on resourcing and exposure.
Download and next steps
For a deeper breakdown of member-state status, supervisory set-ups, and practical checklists, request the full publication. If you need a jurisdiction-specific view or support on your toolset, contact our team below.
Contacts
- Gregor Strojin, Deloitte Legal CE AI Regulatory Center of Excellence - leader - gstrojin@deloittelegal.si
- Simina Mut, Partner, Deloitte Legal Central Europe Leader - smut@deloittece.com
- Jan Michalski, GenAI Leader, Deloitte Central Europe - jmichalski@deloittece.com
Recommendations
- Cybersecurity: We help build security programs that meet regulatory expectations and withstand scrutiny, from governance and risk assessment to incident readiness.
- Artificial Intelligence (AI): We support use case reviews, compliance by design, and enterprise governance for responsible AI, working closely with technical specialists.
- Data & Data Security: End-to-end advice on data protection, processing, and lawful use of data, with practical steps to reduce legal risk.
- Digital Law: Intangibles, Data & Technology: Legal guidance that enables growth and competitiveness across IP, data, and technology transactions.
Helpful learning
If you are standing up AI compliance training for legal and product teams, see curated options by role: AI courses by job.
Your membership also unlocks:
