Research opportunity · Regulation-in-Practice: Rights, Compliance & Developmental Steering
How many staff and how much money do national AI Act enforcers actually have?
Question
For each EU and EEA country, what staff numbers and budgets have been planned and actually provided for the authorities that enforce the AI Act, how do these compare with the tasks each authority has been given, and how do they compare with the resourcing of the same country's data protection authority?
Institutional practice unknownMaster's thesisLow costPartly addressed
Why it matters
An authority that exists on paper is not an enforcer. The debate can count which countries have named an authority, but not whether those authorities can act. A comparable resource map would show where enforcement of the AI Act is plausible in the coming years and where its rules are likely to stay largely unenforced, and gives later studies of enforcement outcomes a baseline.
The debate lists this among what we still do not know: adequate staffing of national authorities
Evidence that motivates it
- On the Commission's September 2026 list, 9 EU Member States had a final AI Act market-surveillance single point of contact, 12 were pending final adoption and 6 had none listed.
The September 2026 Commission list counts designated contact points (9 final, 12 pending, 6 none) but explicitly does not show that final authorities have adequate resources. - The EU AI Act is in force, but Annex III high-risk obligations apply from 2 December 2027 and Annex I product-embedded high-risk obligations from 2 August 2028.
High-risk obligations apply only from December 2027 and August 2028, so a resource baseline measured now precedes the period when national authorities carry most of the load.
A possible design
Build a country-by-authority dataset (27 EU plus 3 EEA countries). For each designated market-surveillance authority, record planned staff and budget from draft laws, regulatory impact assessments and budget laws, and actual figures from annual reports and freedom-of-information requests. Code assigned tasks (number of sectors, sandbox duties, notifying role) to build a simple tasks-per-staff measure. Use the EDPB's overview of data protection authority resources as a comparison: the same countries' records of under-resourcing their data protection authorities under the GDPR are a test of whether AI Act enforcers repeat the pattern. Add 10–15 interviews with authority staff in three contrasting cases (one centralised new authority, one federated model, one country with no final designation) on hiring, skills and expected caseload. Repeat the data collection a year later to record change.
Data needed
National draft laws and impact assessments; budget documents; authority annual reports; FOI requests in national languages; the ADAPT mapping of designated authorities as a starting frame; EDPB resource overviews for comparison.
Feasibility
Master's thesis. Low: researcher time and translation; no data purchase. Many authorities share staff across AI and other remits, so figures need a stated rule for counting partial staff; non-response to FOI requests should be recorded rather than filled in.
Has this been done?
Partly done already: related work covers some of this question (first-pass screen of 12 October 2026, checked again on 13 October 2026).
A mapping of which bodies were designated exists (ADAPT, September 2026) but records no staffing or budgets; institutional-design typologies (Parisini and Dervishaj 2025) and commercial benchmarks likewise report no resource figures; single-country work gives figures for Poland's planned authority; the EDPB collects resource figures for data protection authorities, not AI Act enforcers. Member States must report authority resources to the Commission under Article 70(6) of the AI Act (first reports due 2 August 2025), but no published compilation or analysis of these reports was found. No comparable cross-country dataset of planned versus actual AI Act enforcement resources, related to assigned tasks, was found.
How strong this evidence is
- Who searched and checked: Claude (SocioLens Project Lead) with AI research agents, by web search; not a person and not a domain expert; an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Every check so far was done by AI; no person or domain expert has checked it yet.
- What was read: 2 of the 7 nearest works below were judged from an abstract, summary or search listing only; each is marked. Not every entry says how much of the work was read.
- Where the search could not reach: Screened by web search on the date shown, in English only; national-language reports, parliamentary documents and paywalled law-firm or consultancy trackers were not searched systematically. Several commercial tracker pages found were not treated as research. Absence of a hit is not proof that the work does not exist. Literature check of 2026-10-13: National-language parliamentary documents were searched only in German (the KI-MIG draft and Bundesrat papers surfaced as primary sources, not research). The Commission's handling of Article 70(6) reports could not be confirmed. Paywalled consultancy trackers were not read in full. Absence of a hit is not proof that the work does not exist.
- Before building a project on it, run your own search in a scholarly database such as Scopus, Web of Science, Google Scholar or SSRN.
Nearest work found
- Cabas Arráiz, "Who Will Enforce the EU AI Act? Mapping National Regulatory Authorities Across Europe," ADAPT Research Centre (1 Sep 2026), dataset on Zenodo
Maps 72 bodies across 30 jurisdictions by role (market surveillance, competent and notifying authorities) and governance model, with primary legal sources for most records. Reports no staffing or budget figures; it is the natural sampling frame for this study. - Króliński, "Building a Centralised National AI Authority: Poland's AI Act Implementation Model in a European Context," Interface policy brief (12 Mar 2026)
Reports Poland's planned ten-year budget (cut by about 38% between the September 2025 and February 2026 drafts) and planned staff (100 by 2027 in the first draft, 70 in the second), with a staffing comparison to Spain's AI agency and the EU AI Office. Planned figures for one country, not actual resources across countries. - European Data Protection Board, "Overview on resources made available by Member States to the Data Protection Supervisory Authorities" (5 Sep 2022)
Authority-supplied budgets and approved posts for data protection authorities, with most saying they lack sufficient resources. A model and comparison point for the proposed dataset; does not cover AI Act authorities. - Parisini & Dervishaj, "Emerging models of national competent authorities under the EU AI Act," Proceedings of the 26th Annual International Conference on Digital Government Research (DG.O 2025), published 22 May 2025 Judged from an abstract, summary or search listing only
Document analysis of how early-implementing Member States set up national competent authorities, classifying them on centralisation, new versus existing regulators, and horizontal versus vertical oversight. The authors state that it relies on formal documents rather than operational evidence. The abstract reports no staffing or budget figures (full text not read). A typology that could stratify the proposed cases, not a resource dataset. - Novelli, Hacker, Morley, Trondal & Floridi, "A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities," European Journal of Risk Regulation (2024); arXiv:2407.10369 Judged from an abstract, summary or search listing only
Normative and legal analysis of the AI Act governance architecture, including national authorities. Seen only as search results (title, authors, venue, identifier); not opened this round, so whether it discusses resourcing in detail was not checked. Not an empirical resource study. - Bashir, "National implementation of the EU AI Act: a snapshot of AI laws, regulatory bodies and penalties," Cullen International (30 Apr 2026)
Commercial benchmark of 19 European countries on implementing laws, designated authorities, sandboxes and penalties. The public page mentions no staffing or budgets; the full benchmark is subscriber-only. Not research, but a cross-check for the designation frame. - Regulation (EU) 2024/1689 (AI Act), Article 70(6)
Primary law, not research: requires Member States to report to the Commission by 2 August 2025 and every two years thereafter on the status of the financial and human resources of national competent authorities, with an assessment of their adequacy. These reports would be a direct source for the proposed dataset; whether the Commission publishes them, or they can be obtained through access-to-documents requests, was not established this round.
Literature check
Stands as first published. No cross-country dataset of planned versus actual staff and budgets for AI Act enforcement authorities was found. New related work is institutional-design mapping without resource figures (Parisini and Dervishaj, DG.O 2025; Cullen International April 2026 snapshot) and the earlier governance proposal of Novelli et al. (2024). One addition matters for the design: Article 70(6) of the AI Act requires Member States to report to the Commission on the financial and human resources of their national competent authorities by 2 August 2025 and every two years thereafter, so these reports are a primary data source (whether they are public was not established).
Searched: web (extended); web (standard); arxiv.org; ssrn.com; osf.io; zenodo.org; proceedings.open.tudelft.nl; cambridge.org; German-language web. Checked by Claude (SocioLens Project Lead) with AI research agents, by web search; not a person and not a domain expert.
The screen before this check
Partly done already: related work covers some of this question (first-pass screen of 12 October 2026).
A mapping of which bodies were designated exists (ADAPT, September 2026) but records no staffing or budgets; single-country work gives figures for Poland's planned authority; the EDPB collects resource figures for data protection authorities, not AI Act enforcers. No comparable cross-country dataset of planned versus actual AI Act enforcement resources, related to assigned tasks, was found.
Search queries used
AI Act national competent authorities staffing resources budget comparison Member States study 2026data protection authorities budget staff comparison EDPB resources survey GDPR enforcement capacity researchAI Act market surveillance authority designation tracker Member States implementation national laws analysis
Literature check, 13 October 2026:
AI Act market surveillance authorities capacity staff full-time equivalents Member States report enforcement readiness 2026AI Act national implementation enforcement resources authorities budget [arxiv.org, ssrn.com, papers.ssrn.com, osf.io, zenodo.org]"AI Act" national competent authorities institutional design governance comparative analysis Member States journal article 2026Novelli Hacker "A Robust Governance for the AI Act" national authorities resources understaffing later work 2025 2026 enforcement capacityKI-Verordnung Bundesnetzagentur Planstellen Haushalt Marktüberwachung KI-Marktüberwachungsgesetz Stellen Erfüllungsaufwandcivil society report AI Act national enforcement under-resourced authorities staffing survey EDRi OR AlgorithmWatch OR ECNL OR CEPS 2026"Who Will Enforce the EU AI Act" ADAPT mapping national regulatory authoritiesArticle 70(6) AI Act Member States report financial and human resources national competent authorities Commission 2025 report published
Provenance
RO-LD12-02 v2. Drafted by Claude (SocioLens Project Lead), AI-drafted from the LD-12 debate on 2026-10-12. Checked by an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Not yet reviewed by a domain expert. This is a research hypothesis, not a finding.
Changes
- v2, 13 October 2026: Literature check added: a second, deeper search for existing work, with its queries, new nearest work and limits. The question and verdict stand. See v1 as published.