How many staff and how much money do national AI Act enforcers actually have?

Research question

For each EU and EEA country, what staff numbers and budgets have been planned and actually provided for the authorities that enforce the AI Act, how do these compare with the tasks each authority has been given, and how do they compare with the resourcing of the same country's data protection authority?

Why it matters

An authority that exists on paper is not an enforcer. The debate can count which countries have named an authority, but not whether those authorities can act. A comparable resource map would show where enforcement of the AI Act is plausible in the coming years and where its rules are likely to stay largely unenforced, and gives later studies of enforcement outcomes a baseline.

The debate lists this among what we still do not know: adequate staffing of national authorities

Evidence that motivates it

1. On the Commission's September 2026 list, 9 EU Member States had a final AI Act market-surveillance single point of contact, 12 were pending final adoption and 6 had none listed. (LD12-HQ-C02 v1.0)
   The September 2026 Commission list counts designated contact points (9 final, 12 pending, 6 none) but explicitly does not show that final authorities have adequate resources.
   Cites: European Commission, Market Surveillance Authorities under…
2. The EU AI Act is in force, but Annex III high-risk obligations apply from 2 December 2027 and Annex I product-embedded high-risk obligations from 2 August 2028. (LD12-HQ-C01 v1.0)
   High-risk obligations apply only from December 2027 and August 2028, so a resource baseline measured now precedes the period when national authorities carry most of the load.
   Cites: Regulation (EU) 2026/1744; European Commission AI Omnibus…

Claims are shown as they read on the day this pack was built; claim pages keep every earlier version.

A possible design

Build a country-by-authority dataset (27 EU plus 3 EEA countries). For each designated market-surveillance authority, record planned staff and budget from draft laws, regulatory impact assessments and budget laws, and actual figures from annual reports and freedom-of-information requests. Code assigned tasks (number of sectors, sandbox duties, notifying role) to build a simple tasks-per-staff measure. Use the EDPB's overview of data protection authority resources as a comparison: the same countries' records of under-resourcing their data protection authorities under the GDPR are a test of whether AI Act enforcers repeat the pattern. Add 10–15 interviews with authority staff in three contrasting cases (one centralised new authority, one federated model, one country with no final designation) on hiring, skills and expected caseload. Repeat the data collection a year later to record change.

Data needed

National draft laws and impact assessments; budget documents; authority annual reports; FOI requests in national languages; the ADAPT mapping of designated authorities as a starting frame; EDPB resource overviews for comparison.

Feasibility

Master's thesis. Low: researcher time and translation; no data purchase. Many authorities share staff across AI and other remits, so figures need a stated rule for counting partial staff; non-response to FOI requests should be recorded rather than filled in.

Has this been done?

Partly done already: related work covers some of this question (first-pass screen of 12 October 2026, checked again on 13 October 2026).

A mapping of which bodies were designated exists (ADAPT, September 2026) but records no staffing or budgets; institutional-design typologies (Parisini and Dervishaj 2025) and commercial benchmarks likewise report no resource figures; single-country work gives figures for Poland's planned authority; the EDPB collects resource figures for data protection authorities, not AI Act enforcers. Member States must report authority resources to the Commission under Article 70(6) of the AI Act (first reports due 2 August 2025), but no published compilation or analysis of these reports was found. No comparable cross-country dataset of planned versus actual AI Act enforcement resources, related to assigned tasks, was found.

Literature check. No cross-country dataset of planned versus actual staff and budgets for AI Act enforcement authorities was found. New related work is institutional-design mapping without resource figures (Parisini and Dervishaj, DG.O 2025; Cullen International April 2026 snapshot) and the earlier governance proposal of Novelli et al. (2024). One addition matters for the design: Article 70(6) of the AI Act requires Member States to report to the Commission on the financial and human resources of their national competent authorities by 2 August 2025 and every two years thereafter, so these reports are a primary data source (whether they are public was not established). Checked by Claude (SocioLens Project Lead) with AI research agents, by web search; not a person and not a domain expert.

Where the search could not reach. Screened by web search on the date shown, in English only; national-language reports, parliamentary documents and paywalled law-firm or consultancy trackers were not searched systematically. Several commercial tracker pages found were not treated as research. Absence of a hit is not proof that the work does not exist. Literature check of 2026-10-13: National-language parliamentary documents were searched only in German (the KI-MIG draft and Bundesrat papers surfaced as primary sources, not research). The Commission's handling of Article 70(6) reports could not be confirmed. Paywalled consultancy trackers were not read in full. Absence of a hit is not proof that the work does not exist.

Before building a project on it, run your own search in a scholarly database such as Scopus, Web of Science, Google Scholar or SSRN.

Nearest work found

• Cabas Arráiz, "Who Will Enforce the EU AI Act? Mapping National Regulatory Authorities Across Europe," ADAPT Research Centre (1 Sep 2026), dataset on Zenodo
  Maps 72 bodies across 30 jurisdictions by role (market surveillance, competent and notifying authorities) and governance model, with primary legal sources for most records. Reports no staffing or budget figures; it is the natural sampling frame for this study.
• Króliński, "Building a Centralised National AI Authority: Poland's AI Act Implementation Model in a European Context," Interface policy brief (12 Mar 2026)
  Reports Poland's planned ten-year budget (cut by about 38% between the September 2025 and February 2026 drafts) and planned staff (100 by 2027 in the first draft, 70 in the second), with a staffing comparison to Spain's AI agency and the EU AI Office. Planned figures for one country, not actual resources across countries.
• European Data Protection Board, "Overview on resources made available by Member States to the Data Protection Supervisory Authorities" (5 Sep 2022)
  Authority-supplied budgets and approved posts for data protection authorities, with most saying they lack sufficient resources. A model and comparison point for the proposed dataset; does not cover AI Act authorities.
• Parisini & Dervishaj, "Emerging models of national competent authorities under the EU AI Act," Proceedings of the 26th Annual International Conference on Digital Government Research (DG.O 2025), published 22 May 2025 Judged from an abstract, summary or search listing only
  Document analysis of how early-implementing Member States set up national competent authorities, classifying them on centralisation, new versus existing regulators, and horizontal versus vertical oversight. The authors state that it relies on formal documents rather than operational evidence. The abstract reports no staffing or budget figures (full text not read). A typology that could stratify the proposed cases, not a resource dataset.
• Novelli, Hacker, Morley, Trondal & Floridi, "A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities," European Journal of Risk Regulation (2024); arXiv:2407.10369 Judged from an abstract, summary or search listing only
  Normative and legal analysis of the AI Act governance architecture, including national authorities. Seen only as search results (title, authors, venue, identifier); not opened this round, so whether it discusses resourcing in detail was not checked. Not an empirical resource study.
• Bashir, "National implementation of the EU AI Act: a snapshot of AI laws, regulatory bodies and penalties," Cullen International (30 Apr 2026)
  Commercial benchmark of 19 European countries on implementing laws, designated authorities, sandboxes and penalties. The public page mentions no staffing or budgets; the full benchmark is subscriber-only. Not research, but a cross-check for the designation frame.
• Regulation (EU) 2024/1689 (AI Act), Article 70(6)
  Primary law, not research: requires Member States to report to the Commission by 2 August 2025 and every two years thereafter on the status of the financial and human resources of national competent authorities, with an assessment of their adequacy. These reports would be a direct source for the proposed dataset; whether the Commission publishes them, or they can be obtained through access-to-documents requests, was not established this round.

References

Sources behind the motivating claims:

• European Commission, Market Surveillance Authorities under the AI Act (SRC-LD12-EC-AI-ACT-MSA-LIST, original)
• Regulation (EU) 2026/1744; European Commission AI Omnibus implementation material (SRC-LD12-EU-AI-ACT-2026-1744, one of the original documents; the reference cites several documents and this link opens only one)

BibTeX

The first entry cites this opportunity; then its nearest work; then the sources above. Nearest work and sources are recorded as reference strings, so each goes in whole as the title; add authors and year from the original before you cite it.

@misc{sociolens_ro_ld12_02_v2,
  author = {{SocioLens project}},
  title = {How many staff and how much money do national AI Act enforcers actually have?},
  year = {2026},
  date = {2026-10-13},
  howpublished = {\url{https://sociolens-web.pages.dev/opportunities/ro-ld12-02/v2/}},
  note = {Research opportunity RO-LD12-02, version v2}
}

@misc{ro_ld12_02_nearest_1,
  title = {Cabas Arráiz, "Who Will Enforce the EU AI Act? Mapping National Regulatory Authorities Across Europe," ADAPT Research Centre (1 Sep 2026), dataset on Zenodo},
  url = {https://www.adaptcentre.ie/?p=27646},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_02_nearest_2,
  title = {Króliński, "Building a Centralised National AI Authority: Poland's AI Act Implementation Model in a European Context," Interface policy brief (12 Mar 2026)},
  url = {https://www.interface-eu.org/publications/poland-ai-act-implementation},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_02_nearest_3,
  title = {European Data Protection Board, "Overview on resources made available by Member States to the Data Protection Supervisory Authorities" (5 Sep 2022)},
  url = {https://edpb.europa.eu/system/files/2022-09/edpb_overviewresourcesmade_availablebymemberstatestosas2022_en.pdf},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_02_nearest_4,
  title = {Parisini \& Dervishaj, "Emerging models of national competent authorities under the EU AI Act," Proceedings of the 26th Annual International Conference on Digital Government Research (DG.O 2025), published 22 May 2025},
  url = {https://proceedings.open.tudelft.nl/DGO2025/article/view/1007},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{ro_ld12_02_nearest_5,
  title = {Novelli, Hacker, Morley, Trondal \& Floridi, "A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities," European Journal of Risk Regulation (2024); arXiv:2407.10369},
  url = {https://arxiv.org/abs/2407.10369},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; Judged from an abstract, summary or search listing only}
}

@misc{ro_ld12_02_nearest_6,
  title = {Bashir, "National implementation of the EU AI Act: a snapshot of AI laws, regulatory bodies and penalties," Cullen International (30 Apr 2026)},
  url = {https://www.cullen-international.com/news/2026/04/National-implementation-of-the-EU-AI-Act--a-snapshot-of-AI-laws--regulatory-bodies-and-penalties.html},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{ro_ld12_02_nearest_7,
  title = {Regulation (EU) 2024/1689 (AI Act), Article 70(6)},
  url = {https://ai-act-law.eu/article/70/},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{src_ld12_ec_ai_act_msa_list,
  title = {European Commission, Market Surveillance Authorities under the AI Act},
  url = {https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated}
}

@misc{src_ld12_eu_ai_act_2026_1744,
  title = {Regulation (EU) 2026/1744; European Commission AI Omnibus implementation material},
  url = {https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng},
  note = {Reference as recorded by SocioLens; authors, title and year are not separated; the link opens only one of the several documents this reference cites}
}