Is a national competent authority one office?

Not necessarily. The AI Act uses the term for either a notifying authority or a market surveillance authority. A Member State must designate at least one of each. They have different jobs, so a company should identify the issue before choosing whom to contact. The designated market surveillance authority serving as the single point of contact is a useful starting route.

Which authority enforces the AI Act for a company?

The market surveillance authority supervises and enforces compliance with the rules for AI systems. A notifying authority instead designates and supervises notified bodies involved in pre-market conformity assessment. The precise national office depends on the Member State's designation. Check its published contact information rather than assuming that one EU-wide office handles every company enquiry.

When was the AI Act single point of contact due?

Member States had to make electronic contact information for their competent authorities and single points of contact publicly available by 2 August 2025. Each State designates a market surveillance authority as its single point of contact, and the Commission publishes a list. This date concerns the contact route; it does not itself tell a company whether its particular system complies.

Can a small business ask for AI Act advice?

Yes, a national competent authority may provide guidance and advice on implementing the AI Act, particularly to SMEs and start-ups. The provision says may, so it is not a promise of a binding answer or a specific response time. Send a focused account of the system, intended use and decision needed, then keep the authority's actual reply with the project record.

Who supervises AI used by EU institutions?

For AI systems put into service or used by Union institutions, agencies, offices and bodies, the AI Act treats references to national competent or market surveillance authorities as references to the European Data Protection Supervisor. That special rule concerns those Union bodies. It does not make the EDPS the routine national contact for an ordinary private company operating in a Member State.

What Is a National Competent Authority Under the AI Act?

Quick Answer: A national competent authority under the EU AI Act is either a notifying authority or a market surveillance authority. For compliance questions, identify the market surveillance authority designated in its Member State and its single point of contact. The notifying authority deals with notified bodies; EU institutions have a separate supervisor.¹^,3

Summary in a mind map

What Is a National Competent Authority Under the AI Act?
│
├─ Start with the issue
│   ├─ AI system question — market surveillance
│   └─ Assessment body question — notifying authority
│
├─ Find the national route
│   ├─ Each State designates both authority types
│   ├─ A market authority is the single contact point
│   └─ Public electronic contacts were due 2 August 2025
│
├─ Ask with a defined case
│   ├─ SMEs may seek guidance, without guaranteed approval
│   └─ A national sandbox must operate by 2 August 2027
│
└─ Check the special case
    ├─ Union institutions use the EDPS route
    └─ A private firm uses the relevant national route

A 50-person metal workshop considering an AI system first identifies its Member State. It also records the specific question it wants answered. The relevant office depends on that question. The definition below explains the two authority functions. The contact route comes afterwards.

What does the term mean in the AI Act?

Article 3(48) defines a national competent authority as a notifying authority or a market surveillance authority. Article 70(1) requires each Member State to establish or designate at least one of each. The authorities must exercise their powers independently, impartially and without bias. This is a defined category of public body. It does not include every government office with an interest in AI.¹

The definition does not name the office in a particular Member State. National designation supplies that detail. The umbrella term does not make the two functions interchangeable.¹^,3

Two distinct authority roles

Role	Core function	Why a business might encounter it
Market surveillance authority	Supervises and enforces AI-system rules	A question about a system or its compliance
Notifying authority	Designates and supervises notified bodies	A question about a body that performs pre-market assessment
Single point of contact	Designated market surveillance contact route	Finding the right national entry point

The single point of contact is a route into the national system. It is not a third type in the Article 3(48) definition.¹^,3

Which office should a company contact?

Consider the workshop buying an AI-assisted inspection system. A compliance question about that system points to market surveillance. A question about the status of a conformity assessment body points to the notifying authority. This example identifies a route. It does not classify the system or establish whether a notified body's assessment is needed.³

For a reusable enquiry, the workshop can record:

the Member State and the published contact page;
what the system does and where it will be used;
whether the company supplies or uses it;
the provision or decision causing uncertainty;
the precise question, date sent and response received.

These fields help an authority direct the enquiry. They do not turn informal advice into approval. A company operating in several Member States checks the designation relevant to each issue. One reply may not settle every location.

EU institutions have a distinct supervisor

Article 3(48) makes a specific substitution for AI systems used by Union institutions, agencies, offices and bodies. This also covers systems they put into service. References to national competent or market surveillance authorities then mean the European Data Protection Supervisor. The rule identifies the supervisor for Union bodies. It does not redirect a private workshop's ordinary enquiry to the EDPS.¹

This article cannot name a private company's particular authority without the Member State and the issue. An EU institution, by contrast, follows the supervisor named in the substitution rather than treating a Member State contact point as the default for its own system.¹

Finding the single point of contact

Article 70(2) requires each Member State to designate a market surveillance authority as its single point of contact. Electronic contact information for these bodies had to be public by 2 August 2025. The Commission publishes the national list. A business can start there when a national webpage does not clarify the division of responsibilities.¹

That date concerns public contact arrangements, not certification of an AI system. The national point can route a question to a more suitable unit. Article 70(3) separately requires Member States to provide adequate resources and expertise. It names AI, data protection, cybersecurity, fundamental rights, safety, standards and law. This duty does not guarantee bespoke advice on every individual project.²

Advice and sandboxes for SMEs

Article 70(8) permits national competent authorities to provide guidance on implementing the Act, particularly to SMEs and start-ups. They take account of Board and Commission guidance. An SME may ask a defined question. The provision does not promise clearance for a planned system. The checklist above ties the enquiry to the company's actual role and use.¹

Under Article 57(1) of the consolidated Act, Member States must ensure that their competent authorities establish at least one national AI regulatory sandbox. It must operate by 2 August 2027. Under Article 57(6), competent authorities provide guidance, supervision and support within the sandbox, as appropriate. Its existence does not mean every business or proposed use will be admitted. An SME should check the relevant national arrangements and eligibility before planning around it.²

What to do next

List each AI system or planned use and the Member State relevant to it. For each open question, note whether it concerns the system itself, a notified body, or a Union institution. Use the Commission's public list and national contact details to locate the designated market surveillance single point of contact. Keep the enquiry, its factual description and the reply together with the project record.¹^,3

For wider context, read how to answer an EU AI Act vendor questionnaire and build an AI governance view. The AI literacy duty and Article 50 transparency rules address separate questions. None of these pages can name the national office until the Member State and question are known.