Mostly national authorities. Each EU member state designates market surveillance authorities to enforce the EU AI Act, and for high-risk AI systems used by regulated financial institutions, that role generally falls to the national financial supervisor. The European Commission supervises general-purpose AI models, and data protection authorities keep enforcing GDPR for the same agents.
What does the EU AI Act set up for enforcement?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, with obligations phasing in over several years. Its enforcement structure, in substance:
- National competent authorities. Each member state designates at least one notifying authority, which oversees the bodies that carry out conformity assessments, and at least one market surveillance authority, which checks that AI systems on the market and in use comply. One of them acts as the single point of contact.
- Financial supervisors. For high-risk AI systems placed on the market, put into service or used by financial institutions regulated under EU financial services law, the market surveillance authority is, as a rule, the national authority responsible for supervising those institutions.
- The European Commission. An office within the Commission supervises providers of general-purpose AI models and supports consistent application across the EU.
- The European AI Board. Representatives of the member states coordinate enforcement and give advice, supported by a scientific panel and an advisory forum.
- Other authorities. Data protection authorities continue to enforce GDPR and have roles for certain uses under the Act. Bodies protecting fundamental rights can request documentation in some cases.
Penalties are set by member states within the Act's limits: fines scaled to worldwide turnover, highest for prohibited practices, with lower caps for small firms. For the Act as a whole, see what the EU AI Act is.
Who does enforcement reach?
Providers, deployers, importers and distributors of AI systems placed on the market or used in the EU, including firms outside the EU whose systems' output is used there. For agents, the most common targets are firms that deploy high-risk agents, firms that build agents for their own use and so become providers, and providers of the models underneath.
What does this mean for a firm running agents?
Your financial supervisor is likely your AI Act supervisor too. A bank or insurer using a high-risk agent, for example one assessing the creditworthiness of individuals or pricing life and health insurance, will usually face its existing national supervisor for AI Act matters. That supervisor already knows your governance, risk and outsourcing arrangements and will read your AI Act evidence alongside them.
Agents that are not high-risk still meet enforcement. Transparency duties, such as telling people they are interacting with an AI system, apply more widely. A customer service agent at a retailer falls to whichever market surveillance authority the member state designated. Our piece on the EU AI Act for agents in customer service covers those duties.
Several authorities may look at one agent. A credit agent at a bank can draw interest from the financial supervisor under the AI Act and sector rules, the data protection authority under GDPR, and consumer authorities. Evidence that serves all of them at once saves effort: one record of what the agent did, why, and who approved it.
Incidents go to market surveillance authorities. Serious incidents involving high-risk systems are reported to the market surveillance authority of the member state where they occurred. Deployers must inform providers and, where required, authorities.
People can complain. Anyone with grounds to believe the Act has been infringed can complain to a market surveillance authority, so a customer unhappy with an agent's treatment has a route beyond the firm's own complaints process.
Take an illustrative case. A lender based in one member state uses a high-risk agent to assess consumer loan applications and also runs a customer service agent. For the credit agent, its national banking supervisor acts as market surveillance authority; it asks for the deployer's monitoring records, human oversight arrangements and fundamental rights impact assessment. For the service agent, the authority the member state designated for general market surveillance checks that customers are told they are dealing with an AI system. The data protection authority, separately, examines the credit agent's automated decisions under GDPR.
How do you prepare for enforcement?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Know your authorities | Map each agent to its market surveillance authority and other regulators | Regulatory map per agent |
| Role clarity | Provider or deployer role recorded per agent | Role decisions |
| High-risk classification | Annex III screening per agent | Classification records |
| Registration where required | High-risk systems registered as required | Registration records; see an AI agent register for the EU AI Act |
| Logs and records | Action records kept and producible | Append-only logs |
| Incident reporting | Serious incident process naming the right authority | Incident procedure and records |
| Transparency | People told when interacting with an agent | Notices and interface records |
| Cooperation | Named contact for authority requests | Contact register; response log |
What will an authority ask?
- Which agents do you run in the EU, and which are high-risk?
- Are you provider or deployer of each?
- Show us the records of what this agent did and who oversaw it.
- How do customers know they are interacting with an AI system?
- Have you had any serious incidents, and whom did you notify?
What does the enforcement structure not settle?
It does not answer every question on which national authority handles which agent; member states make designations, and they differ. It does not replace sector supervision or GDPR enforcement. For agent-specific obligations, see the EU AI Act and agents that act, and for how it compares with a voluntary framework, the EU AI Act vs the NIST AI RMF for agents. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is there a single EU regulator for AI agents?
No. Enforcement is mainly national, through authorities each member state designates. The Commission supervises general-purpose AI models, and the European AI Board coordinates.
Will banks deal with a new AI regulator?
Usually not. For high-risk systems used by regulated financial institutions, the Act generally makes the existing financial supervisor the market surveillance authority.
Can a customer complain directly about an AI agent?
Yes. Anyone with grounds to believe the Act has been infringed can complain to a market surveillance authority, alongside complaints to the firm and to data protection or financial ombudsman bodies.