Research opportunity · Regulation-in-Practice: Rights, Compliance & Developmental Steering
How many staff and how much money do national AI Act enforcers actually have?
Earlier version (v1)
This is RO-LD12-02 as it was published at v1, kept unchanged. The current version is v2; its changes are listed there.
Question
For each EU and EEA country, what staff numbers and budgets have been planned and actually provided for the authorities that enforce the AI Act, how do these compare with the tasks each authority has been given, and how do they compare with the resourcing of the same country's data protection authority?
Institutional practice unknownMaster's thesisLow costPartly addressed
Why it matters
An authority that exists on paper is not an enforcer. The debate can count which countries have named an authority, but not whether those authorities can act. A comparable resource map would show where enforcement of the AI Act is plausible in the coming years and where its rules are likely to stay largely unenforced, and gives later studies of enforcement outcomes a baseline.
The debate lists this among what we still do not know: adequate staffing of national authorities
Evidence that motivates it
- On the Commission's September 2026 list, 9 EU Member States had a final AI Act market-surveillance single point of contact, 12 were pending final adoption and 6 had none listed.
The September 2026 Commission list counts designated contact points (9 final, 12 pending, 6 none) but explicitly does not show that final authorities have adequate resources. - The EU AI Act is in force, but Annex III high-risk obligations apply from 2 December 2027 and Annex I product-embedded high-risk obligations from 2 August 2028.
High-risk obligations apply only from December 2027 and August 2028, so a resource baseline measured now precedes the period when national authorities carry most of the load.
A possible design
Build a country-by-authority dataset (27 EU plus 3 EEA countries). For each designated market-surveillance authority, record planned staff and budget from draft laws, regulatory impact assessments and budget laws, and actual figures from annual reports and freedom-of-information requests. Code assigned tasks (number of sectors, sandbox duties, notifying role) to build a simple tasks-per-staff measure. Use the EDPB's overview of data protection authority resources as a comparison: the same countries' records of under-resourcing their data protection authorities under the GDPR are a test of whether AI Act enforcers repeat the pattern. Add 10–15 interviews with authority staff in three contrasting cases (one centralised new authority, one federated model, one country with no final designation) on hiring, skills and expected caseload. Repeat the data collection a year later to record change.
Data needed
National draft laws and impact assessments; budget documents; authority annual reports; FOI requests in national languages; the ADAPT mapping of designated authorities as a starting frame; EDPB resource overviews for comparison.
Feasibility
Master's thesis. Low: researcher time and translation; no data purchase. Many authorities share staff across AI and other remits, so figures need a stated rule for counting partial staff; non-response to FOI requests should be recorded rather than filled in.
Has this been done?
Partly done already: related work covers some of this question (first-pass screen of 12 October 2026; not yet checked in depth).
A mapping of which bodies were designated exists (ADAPT, September 2026) but records no staffing or budgets; single-country work gives figures for Poland's planned authority; the EDPB collects resource figures for data protection authorities, not AI Act enforcers. No comparable cross-country dataset of planned versus actual AI Act enforcement resources, related to assigned tasks, was found.
How strong this evidence is
- Who searched and checked: an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Every check so far was done by AI; no person or domain expert has checked it yet.
- What was read: none of the 3 nearest works below is recorded as judged from an abstract only. Not every entry says how much of the work was read.
- Where the search could not reach: Screened by web search on the date shown, in English only; national-language reports, parliamentary documents and paywalled law-firm or consultancy trackers were not searched systematically. Several commercial tracker pages found were not treated as research. Absence of a hit is not proof that the work does not exist.
- Before building a project on it, run your own search in a scholarly database such as Scopus, Web of Science, Google Scholar or SSRN.
Nearest work found
- Cabas Arráiz, "Who Will Enforce the EU AI Act? Mapping National Regulatory Authorities Across Europe," ADAPT Research Centre (1 Sep 2026), dataset on Zenodo
Maps 72 bodies across 30 jurisdictions by role (market surveillance, competent and notifying authorities) and governance model, with primary legal sources for most records. Reports no staffing or budget figures; it is the natural sampling frame for this study. - Króliński, "Building a Centralised National AI Authority: Poland's AI Act Implementation Model in a European Context," Interface policy brief (12 Mar 2026)
Reports Poland's planned ten-year budget (cut by about 38% between the September 2025 and February 2026 drafts) and planned staff (100 by 2027 in the first draft, 70 in the second), with a staffing comparison to Spain's AI agency and the EU AI Office. Planned figures for one country, not actual resources across countries. - European Data Protection Board, "Overview on resources made available by Member States to the Data Protection Supervisory Authorities" (5 Sep 2022)
Authority-supplied budgets and approved posts for data protection authorities, with most saying they lack sufficient resources. A model and comparison point for the proposed dataset; does not cover AI Act authorities.
Search queries used
AI Act national competent authorities staffing resources budget comparison Member States study 2026data protection authorities budget staff comparison EDPB resources survey GDPR enforcement capacity researchAI Act market surveillance authority designation tracker Member States implementation national laws analysis
Provenance
RO-LD12-02 v1. Drafted by Claude (SocioLens Project Lead), AI-drafted from the LD-12 debate on 2026-10-12. Checked by an independent AI reviewer with fresh context (not a person), 12 October 2026: every nearest-work citation checked against its source page; corrections applied. Not yet reviewed by a domain expert. This is a research hypothesis, not a finding.