The governance stack: from AI Office to your national regulator
Lesson 1 of 6 in Governance, Enforcement, Penalties, and Sandboxes.
The AI Act splits supervision into two lanes, and knowing which lane you are in decides who can knock on your door. General-purpose AI models answer to one supervisor for the whole Union: the AI Office, established inside the European Commission, with exclusive powers over GPAI providers (Art 64 and Chapter IX Section 5). Everything else — the high-risk systems, the transparency duties, the prohibitions — is enforced nationally, by market surveillance authorities in each Member State.
The AI Office is more than a GPAI police force. It drafts the guidelines, codes of practice, and templates the whole regime runs on — the GPAI Code of Practice, the training-data summary template, the FRIA template — making it the Act’s de facto interpretive engine. Around it sits a constellation of bodies designed to keep 27 national enforcers rowing in the same direction.
| Body | Basis | Composition | Role |
|---|---|---|---|
AI Office | Art 64 | Commission service (DG CNECT) | Exclusive supervisor of GPAI model providers; drafts guidelines, codes of practice, templates; coordinates Union-level AI expertise |
European AI Board | Arts 65–66 | One representative per Member State; EDPS as observer; AI Office attends | Coordinates national authorities, issues opinions and recommendations, advises the Commission — the consistency engine across 27 regimes |
Advisory Forum | Art 67 | Balanced stakeholders: industry, SMEs, startups, civil society, academia | Technical expertise and stakeholder input to the Board and Commission |
Scientific Panel | Art 68 | Independent scientific experts selected by the Commission | Supports the AI Office on GPAI — including qualified alerts that a model may pose a systemic risk at Union level |
Notifying authority | Art 70 (with Arts 28–39) | Designated per Member State | Vets, notifies, and polices the notified bodies that certify high-risk systems |
Market surveillance authority | Art 70 (with Art 74) | Designated per Member State; a single point of contact named | Front-line enforcer for AI systems: investigations, corrective orders, restrictions, penalties |
Article 70 obliges every Member State to establish or designate at least one notifying authority and at least one market surveillance authority, give them adequate resources — including personnel with AI, data, and fundamental-rights competence — and name a single point of contact. Two wrinkles matter in practice. For high-risk systems used in law enforcement, migration, border control, and justice, Member States must route surveillance either to their data protection authorities or to another authority under equivalent independence safeguards. And for AI embedded in regulated products or financial services, the existing sectoral supervisor typically takes the role — your banking regulator becomes your AI regulator.
One more channel deserves attention: Article 77 gives national fundamental-rights authorities — equality bodies, ombudspersons — the power to request and obtain access to documentation created under the Act when they need it to fulfil their mandates. Your Annex IV file can be read by more regulators than the one that enforces conformity.
Key terms: AI Office, European AI Board, market surveillance authority, notified body, scientific panel
Tool: Global Governance Atlas — Explore the governance map: pick a Member State and a system type, and see which bodies supervise, certify, and hear complaints.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.