February 4, 2026 IE confirmed
Ireland publishes its AI Act implementation law
On 4 February 2026, Ireland published the Regulation of Artificial Intelligence Act 2026, the national law that will implement the AI Act's provisions. The Irish approach establishes the AI Office of Ireland (Oifig Náisiúnta na hIntleachta Saorga), to act as central coordinator and single point of contact (Art. 70), aiming to be operational by 2 August 2026. Ireland adopts a distributed regulatory model with 15 competent authorities across financial, regulatory, consumer, health, utility, and telecom sectors. It is one of the few Member States with a clearly defined enforcement architecture ahead of the high-risk deadline.
August 2, 2026 EU confirmed
2 August 2026: the bulk of the penalty regime becomes enforceable (barring Omnibus)
On 2 August 2026 — unless the Digital Omnibus is formally adopted beforehand — the AI Act's high-risk obligations become fully applicable and the associated penalties become enforceable, as do penalties for GPAI providers (Art. 101, the Commission's exclusive competence). From that date, national market surveillance authorities can investigate non-compliance, request information from providers and deployers, and order corrective measures. The Art. 99 regime closely mirrors GDPR Art. 83(2) fine-calculation framework, so data protection authorities already have experience applying this type of analysis. This is a prospective event: it is logged as an announced milestone and will be updated when it materializes or when the Omnibus modifies it.
January 14, 2026 EU confirmed
By early 2026, only 3 of 27 MS had designated both competent authorities
According to Future of Life Institute tracking and the IAPP directory, by early 2026 — five months past the deadline — only three Member States had designated both their notifying and market surveillance authorities. Ten had pending legislative proposals or a single designated authority ('partial clarity'), and fourteen had designated none. Ireland is among the most advanced, with 15 competent authorities designated in a sector-distributed model and nine fundamental-rights authorities. Germany designated the Bundesnetzagentur as its main market surveillance authority. The Commission published an initial list of around 2,000 notified market surveillance authorities EU-wide, reflecting the highly decentralized and fragmented nature of enforcement.
August 2, 2025 EU confirmed
Authority designation deadline and penalty regime application date
2 August 2025 was the deadline for Member States to designate their national competent authorities (at least one notifying and one market surveillance authority, Art. 70) and notify the Commission of their national penalty rules (Art. 99.2). From that date, prohibited practices became enforceable by the designated authorities. But the regime has a structural gap: as DLA Piper notes, absent enforcement measures implemented at national level, it is unclear that regulators have the powers to apply the Art. 99 fines. GPAI provider penalties were postponed to 2 August 2026, aligning with the Commission's powers over those models.
February 2, 2025 EU confirmed
Prohibited practices (Art. 5) become applicable across all 27 MS
On 2 February 2025 the Art. 5 AI Act prohibitions became applicable across all 27 Member States: subliminal manipulation, exploitation of vulnerabilities, social scoring, real-time remote biometric identification for law enforcement (with limited exceptions), among other practices deemed incompatible with fundamental rights. Two days later, on 4 February, the Commission published guidelines breaking down each prohibition into cumulative conditions with practical examples. Breaching these prohibitions is the most serious AI Act infringement: up to €35M or 7% of worldwide annual turnover.
