Fog clung to the spires of the Berlaymont building last Tuesday morning, as a harried Estonian delegate clutched a printout of the EU AI Act, underlining deadlines in red.
EU AI Act Member States responsibilities? They’re a beast—88 of them, sliced into governance setups, new laws, enforcement marathons, and long-haul evaluations. Kai Zenner, the policy wonk who tallied them up after two weeks buried in the text, calls it a roadmap for national chaos. And he’s not wrong.
Here’s the raw count from his breakdown:
In total, I have identified 88 responsibilities for the national level: Table A: 18 tasks… Table B: 7 items… Table C: 55 categories… Table D: 8 tasks…
That’s not hyperbole. Member States must designate notifying authorities and market surveillance bodies by August 2026, while prohibitions on rogue AI—like social scoring—hit as soon as February 2025. Six months from the Act’s entry into force on August 1, 2024. Tick-tock.
Deadlines That Bite
But why the frenzy? Picture this: the Act’s architects in Brussels dreamed of a single market for AI, harmonious and enforceable. Reality? National bureaucracies, each with their own civil service inertia—Germany’s meticulous planners versus Italy’s perennial funding woes. Article 70 mandates each state appoint at least one notifying authority (for high-risk certifications) and market surveillance enforcers. By when? smack in the middle of Table A’s 18 governance tasks, due between November 2024 and August 2026.
Tight. Too tight, maybe. Zenner flags transition periods that stagger the pain: prohibitions first (Feb 2025), then notified bodies and GPAI rules (Aug 2025), high-risk annexes later (Aug 2027). Legacy systems get grandfathered—high-risk ones compliant only on major changes, or by 2030 if public sector. Smart carve-out, but it assumes states can gear up fast.
One short breath.
Enforcement? Table C’s 55 activities start February 2025 for bans, ramping to full high-risk scrutiny by 2026. Market surveillance authorities will hunt non-compliant AI, impose fines up to 35 million euros or 7% of turnover (Article 99-100, live by Aug 2025). Deployers—think hospitals using diagnostic AI—face audits. Providers document everything. States coordinate via the European AI Board, but who’s watching the watchers?
Why Are Member States Overloaded Like This?
Dig deeper—it’s architectural. The EU AI Act rejects a centralized hammer, opting for subsidiarity: Member States handle day-to-day cops-and-robbers, while the AI Office in Brussels sets codes of practice and tests GPAI models. Recitals 153-154 spell it out: nationals are the “key role” in application. Why? Scale. 27 countries, thousands of deployments. Central enforcement would drown the Commission.
Yet here’s my unique angle, absent from Zenner’s tallies: this mirrors GDPR’s rollout in 2018, when Ireland (hosting Big Tech) became de facto enforcer, while smaller states like Latvia lagged years behind. Prediction? By 2027, we’ll see AI enforcement patchwork—France aggressive on biometrics, Poland soft on GPAI due to resource squeezes. Fragmentation. Not unity.
States can pitch secondary laws (Table B’s 7 items), like beefing up penalties or GPAI transparency. Discretionary, sure—but the clock pressures uniformity. Ex-post evals (Table D, 2025-2031) demand data sharing; will cash-strapped ministries comply?
Skeptical? Damn right. Corporate PR spins the Act as “world’s first comprehensive AI law,” but glosses national burdens. SMEs and civil society get Zenner’s tables as a lifeline—to monitor, lobby, sue if needed.
Grandpa’s old typewriter jammed less often.
How Will National Governance Actually Shift?
Start with the basics. Each state builds its AI office—coordinating authorities, handling complaints (Article 70). Notified bodies certify high-risk AI (Chapters III, V by Aug 2025). GPAI? Transparency reports, risk assessments—national eyes on models like those from Mistral or Aleph Alpha.
Legacy grace periods buy time: pre-2025 GPAI compliant by 2027; high-risk public AI by 2030. But post-2026 placements? Immediate compliance hell. States enforce via inspections, whistleblower channels (live early 2025), even post-market monitoring.
And penalties—Article 101 tasks states with reasoned requests to the Commission. Inter-state referrals if cross-border. It’s a web, fragile as spider silk.
Look, the ‘how’ is mechanical: designate, certify, surveil, fine. The ‘why’? To embed AI safety in sovereign soil, shifting from Brussels directives to local hammers. But architecture flaw: uneven capacity. Eastern states scramble for funds; Nordics might over-regulate. Result? AI safe havens in lax jurisdictions, chilling innovation.
The SME and Watchdog Lifeline
Zenner’s post—reformatted here—is gold for underdogs. Civil society tracks Table A’s setups; academics grill Table C enforcements. No resources for 1,000-page legalese? These tables pinpoint priorities.
Bold call-out: Commission’s AI Office gets headlines, but Member States shoulder 88-to-fewer tasks. PR spin ignores this—hype the Office, bury national grind.
Europe’s AI Act isn’t just law; it’s a stress test for subsidiarity. Will it forge ironclad governance, or bend into 27 flavors of half-measures?
Why Does Uneven Enforcement Loom Large?
Because markets hate uncertainty. A French deployer faces audits; a Bulgarian one? Maybe not till 2028. Investors flee. Providers forum-shop jurisdictions. GDPR proved it—fines clustered in Big Tech hosts.
Prediction: AI Board meetings turn into shouting matches by 2026. Commission steps in with guidelines, but enforcement stays national. Architectural shift? From top-down to federated fragility.
States, you’re on the clock. Build those authorities. Train enforcers. Or watch AI wild west bloom unevenly.
**
🧬 Related Insights
- Read more:
- Read more: EU’s GPAI Code of Practice: Self-Regulation Theater or Actual AI Leash?
Frequently Asked Questions**
What are the main deadlines for EU AI Act Member States responsibilities?
Prohibitions from Feb 2025; governance and GPAI by Aug 2025; full applicability Aug 2026; high-risk annexes Aug 2027.
How many tasks do EU Member States have under the AI Act?
88 total—18 governance, 7 legislative, 55 enforcement, 8 evaluations.
What happens to existing AI systems under the EU AI Act?
Grandfathered with deadlines: GPAI by 2027, high-risk on changes or 2030 for public sector.
