AI Regulation Tracker  /  Regulatory gap

Austria Named Its AI Act Rights Bodies but Has Notified No Regulator

The AI Act became generally applicable on August 2, 2026. Austria has published the fundamental-rights bodies Article 77 calls for, but a year past the deadline it has notified no market surveillance authority and no notifying authority.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Regulatory gap

Key facts

Regulatory briefing

Instrument

Regulation (EU) 2024/1689 (Verordnung ueber kuenstliche Intelligenz), the AI Act

Authority

No Article 70 market surveillance authority notified for Austria. Austria has designated its Article 77 fundamental-rights bodies. RTR (Rundfunk und Telekom Regulierungs-GmbH) runs an AI Service Desk (KI-Servicestelle) in a support and information role only

Jurisdiction

Austria, within the EU single market

Status

In force. The Act applies from August 2, 2026

Bindingness

Binding law. The designation gap is a gap in national supervisory machinery, not a suspension of duties

Effective date

August 2, 2026 for general application (Article 113). The Digital Omnibus on AI moved the high-risk dates to December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for high-risk AI embedded in Annex I products

Primary source

European Commission, Market Surveillance Authorities under the AI Act

What actually happened on August 2

The AI Act did not arrive all at once. Article 113 staggered it. The prohibitions and the AI literacy duty came first in February 2025. Governance and the rules for general-purpose AI models followed in August 2025. The date that just passed, August 2, 2026, is the one where the Regulation becomes generally applicable and the enforcement apparatus is supposed to be standing.

The Commission puts it plainly on its own governance page:

From 2 August 2026, the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act.European Commission, AI Act policy page, last updated August 3, 2026

That sentence contains an assumption. It assumes the Member State authorities exist. For Austria, the market surveillance authority is not there to be found. The Commission's consolidated list of notified authorities carries no Austrian entry, and Austria's own government AI Act pages, which do publish the authorities it has designated, name none. I want to be precise about what that proves. It proves Austria has not notified one and does not advertise one. Absence of evidence is not quite proof of absence, and if an Austrian designation instrument exists that neither Brussels nor Vienna has published, I would want to see it.

The deadline for doing this was not last week. Article 70 is what imposes the duty to designate national competent authorities; Article 113(b) is what made that chapter applicable on August 2, 2025. The Commission records the requirement in the same terms: Member States are required to designate the responsible market surveillance authorities by August 2, 2025 and notify them to the Commission. Austria is a year past it.

What Austria did designate

This is the part that makes the gap specific rather than a story about a country that ignored the Act. Austria has done AI Act designation work, published it, and kept it current. Just not this piece of it.

Article 77 asks Member States to identify the public authorities that already supervise or enforce fundamental rights, so those bodies can request documentation on high-risk AI systems and, where documentation is not enough, ask the market surveillance authority to test the system. Austria published that list, with a deadline of November 2, 2024. It runs long: the Volksanwaltschaft, the Datenschutzbehoerde, equal-treatment bodies, KommAustria for media supervision, electoral authorities, the Arbeiterkammer and the regional Arbeitsinspektorate, patient ombuds bodies, the Finanzmarktaufsicht, the Bundeswettbewerbsbehoerde and the BASG.

Read Article 77 carefully and you see why the missing piece matters. The mechanism it creates routes through the market surveillance authority. A rights body that cannot resolve a question from documentation alone is supposed to ask the market surveillance authority to test the system. On the public record as it stands, there is no notified Austrian authority to receive that request. Vienna has published the referring half of the mechanism and not the half that would act on a referral.

Is the RTR AI Service Desk the regulator?

No, and this is where I expect people to get it wrong, because Austria does have a visible AI Act body and it is easy to assume that body is the supervisor.

RTR, the Austrian broadcasting and telecoms regulator, operates the KI-Servicestelle, the AI Service Desk. It describes itself as a point of contact and information hub for the general public on the topic of AI, and says it supports the implementation of the European AI Act. Supporting implementation and enforcing a regulation are different jobs. The desk claims no supervisory mandate, no power to demand technical documentation, and no power to impose a penalty.

If you are building a compliance register and you need a line for the Austrian competent authority, the honest entry today is that none has been notified. Writing RTR into that field because it is the most visible Austrian name attached to the Act would be wrong, and it is the sort of error that survives in a document for years.

What binds you anyway

The gap is in supervision, not in duty. The AI Act is a Regulation, which means it applies directly in every Member State without national transposition. Whether Vienna has named an office or not, a provider putting a general-purpose AI model on the market has the obligations the Regulation gives it, and a deployer has the obligations the Regulation gives it.

Nobody should read the designation gap as a safe harbor. There is no provision that says duties sleep until a national authority is appointed. What the gap changes is procedural: who you talk to, who receives a serious-incident report, who a complainant goes to, and who eventually opens a file on you. Those questions currently have no notified or publicly identified Austrian answer in the sources reviewed.

There is also a live risk for Austria itself. Under general EU law, a Member State that fails to meet an obligation like this can face infringement proceedings under Article 258 TFEU. I would not predict one and I would not tell you it is imminent. But the pressure runs toward Austria closing this, and probably closing it faster than it would like.

What this means for a US firm with Austrian exposure

Most American firms encounter this through a subsidiary, a distributor, or a product sold into the EU that happens to reach Austrian users. The practical effect is narrower than it sounds, and more annoying than it sounds.

Your obligations do not change. Your paperwork does. If your compliance documentation names a national competent authority per market, Austria is currently a blank you cannot fill, and the correct move is to record it as undesignated with the date you checked rather than to invent an answer. If a contract commits you to notify a competent authority within a fixed window, look at that clause now. A promise to notify a body that does not exist is a clause you will be arguing about later.

For anything urgent, the fallback is the EU level. The AI Office sits inside the Commission and has direct supervisory responsibility for general-purpose AI models across the Union, which is not contingent on any national designation.

Austria is not alone, and the list is easy to misread

Four other Member States are comparable on the Commission notification list only: Belgium, Bulgaria, Croatia and Estonia. Roughly a dozen more have designated some authorities but not the full set.

One caution, because it is the trap in this story. A blank on the Commission's notified list does not by itself mean no authority exists. Several Member States, Denmark and Finland among them, have national designations in place and still show blank because notification and publication lag. So treat the four countries above as a list of open questions rather than a list of findings. For Austria I went and checked the national sources, which is why this piece is about Austria. I have not run that check country by country for the others, and until someone does, the honest description is not notified rather than not designated. If you are building your own jurisdiction table, check the national instrument, not only the Commission page, before you write down that a country has nobody.

Last verified: August 3, 2026 against the primary sources listed above.