The EU AI Act Has One Rulebook and 27 Referees. Nine Haven't Shown Up.

The EU AI Act is one regulation. It is the same text in Lisbon and in Helsinki. But a regulation does not enforce itself. Every member state had until 2 August 2025 to name the authorities that would police it, set national penalties and get ready to run a sandbox.

Fourteen months later, I went country by country through all 27 to see who actually did it. The full results, with sources, are in the EU AI Act 2026 implementation tracker. This post is about what those results mean if you build, sell or deploy AI in Europe.

#The short version

• 11 of 27 member states have a national framework legally in force: authorities designated and an implementing law with penalties.
• 7 are partway there: authorities named or a bill drafted, but no complete framework in force.
• 9 are lagging, several with no designated market surveillance authority at all.
• The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) pushed the main high-risk obligations from August 2026 to 2 December 2027.
• What did not move: the bans on prohibited practices, the general-purpose AI model rules, and the Article 50 transparency duties. Those apply now.

The map is lopsided. Italy, Finland, Ireland, Denmark, Germany and Slovenia lead. France, Belgium, Austria, Portugal, Romania, Croatia and Bulgaria trail. You can see the whole ranking, and the methodology behind the readiness score, on the EU readiness map.

#One law, uneven teeth

Here is the part most compliance decks skip. The AI Act's rules are European, but most of its enforcement is national. The prohibitions in Article 5, which have applied since February 2025, are policed by each country's market surveillance authority. So are the transparency duties and, from December 2027, the high-risk obligations.

If a country has not designated that authority, and has not adopted the national penalty rules Article 99 requires, then in practice nobody in that country can fine you yet. Romania's telecoms regulator ANCOM said exactly this in July 2026: until a national law exists, it cannot apply sanctions.

That is not a loophole you should plan around. The obligations still bind you, national laws can land quickly, and the gap closes country by country. But it does change the risk picture. Your exposure today depends less on what the Act says and more on where your users are and which regulator is awake there.

#What is on the explore page

The EU AI Act 2026 tracker is the reference; this post is the argument. Here is what you will find there:

• Key findings for Q3 2026, in plain language.
• The readiness map, colouring every member state as full, partial or lagging, with a readiness score out of 100.
• The timeline as the Digital Omnibus rewrote it, from the 2025 prohibitions to the 2030 public-sector deadline.
• The GPAI Code of Practice: who signed, who signed in part and who refused.
• All 27 countries, ranked, each linking to its own page.

Every country page answers the same questions in the same order: who the market surveillance authorities are, who the notifying authority and single point of contact are, what the implementing law is and where it stands, whether national penalties exist, whether a sandbox is running, and what changed recently. Every fact links to its source, most of them official gazettes, parliaments, regulators or the Commission.

#The countries worth watching

Three stories from the tracker say more than the averages do.

Germany went from late to strong in one summer. The KI-MIG came into force on 29 July 2026 and made the Bundesnetzagentur the central AI supervisor, contact point and sandbox operator. Germany is now one of the better-prepared enforcers in the EU. Details on the Germany page.

Spain built the institutions and then lost the law. Spain has had a dedicated AI supervision agency, AESIA, since 2023. It ran the EU's first completed AI sandbox cohort and published 16 compliance guides. Then the snap election lapsed its implementing bill on 6 October 2026. Spain is the clearest case of capability without a legal mandate. See the Spain page.

France, the loudest voice on AI, has no enacted regulator. Its designation scheme rides on an omnibus bill that passed the Senate in February 2026 and has sat in an Assemblée nationale committee since. The Commission still lists France's contact point as pending. See the France page.

#The Omnibus bought time, not an exit

The Digital Omnibus is being read in some boardrooms as "the AI Act got delayed." That is only half right.

What moved: Annex III high-risk systems (hiring, credit, education, biometrics and the rest) now apply from 2 December 2027. Annex I systems embedded in regulated products move to 2 August 2028. High-risk systems used by public authorities move to 2030. National sandboxes are now due by 2 August 2027.

What did not move, and in some cases tightened:

• Prohibited practices still apply, and the Omnibus adds new bans on AI-generated non-consensual intimate imagery and child sexual abuse material from 2 December 2026.
• Article 50 transparency applies since 2 August 2026: tell people when they are talking to an AI system and label deepfakes. The only grace period, to 2 December 2026, is for machine-readable marking on systems already on the market.
• GPAI model rules have applied since August 2025, and the AI Office's enforcement powers went live in August 2026.

So the honest framing is a 16-month extension for high-risk compliance, about 14 months of runway from today, not a reprieve. Most high-risk programs take longer than that once you count data governance, technical documentation, conformity assessment and post-market monitoring.

#The real front line is in Brussels

The national patchwork matters for deployers. For model providers, the story is different, because the AI Office supervises general-purpose AI models directly. There is no national gap to sit in.

That supervision is no longer theoretical. On 1 September 2026 the Commission confirmed the AI Office had sent its first requests for information to more than 30 AI companies. In October, Executive Vice-President Henna Virkkunen said the AI Office had sent targeted requests to OpenAI and Anthropic over agent incidents earlier in the summer. No AI Act fine has been issued yet, but the procedural rules for fines are out for consultation until 9 November 2026.

The voluntary GPAI Code of Practice is now the main signal of intent. It has 22 signatories plus xAI on the safety chapter only. Meta, Alibaba, Baidu and DeepSeek have not signed. The tracker's GPAI section has the full list.

#What to do before December 2027

If you build or deploy AI in the EU, this is the practical read of the tracker:

1. Map your exposure by country, not by "the EU." List where your systems are placed on the market and used. Then check each country on the implementation tracker for who your regulator is and whether penalties exist yet.
2. Treat today's obligations as live everywhere. Prohibitions, AI literacy, transparency notices and deepfake labelling apply now, even where no regulator can fine you yet. Enforcement gaps close without warning.
3. Use the strong regulators as your template. Italy, Ireland, Finland and Germany now have the most detailed national rules. If you comply with the strictest market you operate in, you rarely get surprised by the others.
4. Start high-risk work now, not in 2027. The new date gives you time to do it properly, not time to start late. Classification guidance is still in draft, so document your reasoning as you go.
5. Talk to a sandbox. Only Denmark, Lithuania and Spain have one operating. Most others are due by August 2027. Early cohorts are where regulators form their views.

#Get the full report as a PDF

If you need this offline, in a board pack or in front of your legal team, the EU AI Act 2026 Q3 Report puts the whole tracker in one 39-page, print-ready PDF:

• A one-page executive summary and the full readiness ranking.
• The Omnibus timeline, the headline numbers, the readiness map and the GPAI Code of Practice.
• One page per member state: authorities, implementing law, penalties, sandbox, readiness score and key findings.
• The methodology and every source, so you can check each claim yourself.

Get the EU AI Act 2026 Q3 Report. Enter your email on the explore page and the PDF lands in your inbox. You will also be added to my newsletter, which is where the Q4 update will go first. You can unsubscribe at any time.

#The bigger picture

The AI Act was sold as one rulebook for 450 million people. In October 2026 it is closer to one rulebook with uneven enforcement, where your experience depends on your postcode. That will narrow, and fast, as the laws stuck in parliaments in France, the Netherlands, Czechia, Slovakia and elsewhere get through.

I will update the tracker each quarter. For every country's authorities, laws, penalties, sandbox status and sources, start at the EU AI Act 2026 explore page, or get the Q3 PDF to keep a copy.

If you are doing the same exercise for the US, the companion US AI legislation 2026 tracker covers all 50 states.