The EU AI Act is ready. And the regulators? Not so much

The innovative European AI regulations are already in force, but most of the 27 EU countries are not prepared to enforce them.

Nineteen of the 27 EU countries had not yet announced their regulators before the deadline of 2 August 2025 —including Germany, France, Belgium, Italy, and Austria— although some were in the process of appointing them, according to data from Clyde & Co and other sources.

Finding updated information is difficult, as one of the key features of the EU AI Act is its “multi-stakeholder governance.” This means that the law is applicable both by the European AI Office and by the national authorities of the 27 EU countries, with responsibilities for compliance, enforcement, and coordination spread among national agencies. Ireland, for example, plans to have at least eight AI regulators. Latvia could have up to 17 national AI oversight bodies, but not all are yet operational.

Nevertheless, the EU AI Act is being implemented, and major US tech companies are in the eye of the hurricane.

From the beginning of August, companies that offer general-purpose artificial intelligence (GPAI) —large language models like OpenAI's GPT, Google's Gemini, or Meta's Llama— must maintain clear records of how their systems are built and trained, with the aim of contributing to making AI safer and more ethical.

Companies have a one-year deadline, until August 2026, to adapt without risking fines or sanctions, which gives them a certain margin. They will not be the only ones who need it. Although the EU published guidelines in May to help GPAI providers comply with the AI Act, it is still unclear how the compliance rules regarding copyright will be applied in practice.

With many European governments still organizing themselves, doubts arise about who will be made responsible for ensuring that AI systems are accountable in a rapidly changing technological landscape.

France: Regulator? Which regulator?
France is experiencing a regulatory void regarding AI, similar to that of much of the EU.

“It's unfortunate, but it's not the first time that a European regulation has not been implemented or transposed by the expected date,” says Julien Guinot-Deléry, media partner at Gide Loyrette Nouel, based in Paris.

In a recent interview, Guinot-Deléry noted that the French government has provided little information about its plans for a regulator, but that does not mean that the law cannot be applied.

“We can point out that the AI law is directly applicable,” he explained. “Its enforcement can be demanded in court, regardless of whether a competent authority has been designated in France or not.”

He noted that his clients are closely following the matter with a “mix of hope and concern about the ability of this new regulation to address the difficulties associated with AI.”

High-risk systems
The obligations of the Law for providers of AI models and “high-risk systems” regarding transparency, security, and compliance with copyright also came into force on 2 August, explained Marcus Evans, partner at Norton Rose Fulbright in London.

The European Commission has requested contributions for its upcoming guidelines on high-risk AI systems and has asked member states to inform about their readiness to enforce them.

According to Evans, the Commission will not sanction providers acting in good faith and adhering to a voluntary AI code of practice designed to help stakeholders comply with the new obligations during the first year. “However, it expects full compliance by 2 August 2026,” he warned, and penalties for non-compliance could reach up to 15 million euros (17.5 million dollars) or 3% of global annual turnover.

Spain: the exception in AI
Spain, on the other hand, is at the forefront of AI regulation. In 2023, it created the Spanish Agency for AI Supervision (AESIA), the first AI regulator of its kind in Europe.

This authority is not the only one that will apply the AI Act in Spain, according to Cristina Villasante, partner in Intellectual Property and Information Technologies at ECIJA. Other bodies, such as the Spanish Data Protection Agency, the National Securities Market Commission, and the Bank of Spain, will also act as market oversight authorities, depending on the specific use of AI and the affected sector.

Villasante noted that beyond the EU AI Act, other regulations also affect the use of technology, such as data protection laws and cybersecurity regulations. In July, the Spanish Data Protection Agency reminded that it can already act against the processing of personal data through prohibited systems, including AI.

According to Villasante, companies show concern about how to comply with the AI Act, but the biggest difficulty lies in determining who is responsible for ensuring compliance. Being a cross-cutting technology that affects multiple departments, it is difficult to decide who should control and manage AI to ensure its legal, ethical, and responsible use.

Article written by Cristina Villasante for Law.com.