Czech draft AI Act law splits oversight among three regulators
Prague. By Anthony Guerriero, Editor, AI Regulation Tracker. Last verified: 2026-07-25.
Most member states filling in the EU AI Act have faced the same first question: who enforces it. The Czech Republic has answered it in draft, and the answer is unusual enough to be worth reading closely. Rather than build a single new AI agency, the Ministry of Industry and Trade (Ministerstvo prumyslu a obchodu, MPO) has proposed spreading market surveillance across three regulators that already exist. The instrument is a draft bill, not a law, and that framing matters for anyone trying to plan around it.
The proposal is the navrh zakona o umele inteligenci a o zmene zakona c. 87/2023 Sb., o dozoru nad trhem s vyrobky a o zmene nekterych souvisejicich zakonu (draft act on artificial intelligence and amending Act No. 87/2023 Coll. on market surveillance of products). It is the national adaptation of Regulation (EU) 2024/1689, the AI Act, which is directly applicable but leaves each member state to name its own authorities and penalties.
What the draft adaptation law does
The MPO calls its text a minimalist implementation. The regulation itself sets the substantive rules for developers and operators of AI systems, especially in areas where the technology can materially affect people, such as healthcare, transport and public administration. The Czech bill does not rewrite those rules. It supplies the plumbing the AI Act leaves to national law: which bodies supervise, how they cooperate, and what happens when someone breaks the rules.
In the MPO's own words, the adaptation law "pouze upravuje nezbytne institucionalni, procesni a sankcni mechanismy, ktere AI akt sveruje clenskym statum k samostatnemu rozhodnuti" (only sets the necessary institutional, procedural and sanction mechanisms that the AI Act entrusts to member states to decide for themselves).
The draft leans pro-innovation in tone. The MPO highlights a national regulatory sandbox for firms and startups to test AI applications before they reach the market, the option of lower fine ceilings, and, for less serious breaches, the possibility of issuing a warning instead of immediately opening administrative-offence proceedings. Whether any of that survives comment and parliament is a separate question.
The proposed authority split: ChTU as contact point, CNB and UOOU alongside
The heart of the draft, and the reason it stands out, is the enforcement architecture. The MPO sets it out plainly:
"Dozor nad dodrzovanim pravidel bude rozdelen mezi nekolik organu: Cesky telekomunikacni urad, ktery se stane jednotnym kontaktnim mistem, Ceskou narodni banku a Urad pro ochranu osobnich udaju."
English gloss: "Supervision of compliance with the rules will be divided among several bodies: the Czech Telecommunication Office, which will become the single point of contact, the Czech National Bank, and the Office for Personal Data Protection."
Read against the AI Act, the logic is a division of labour among regulators who already know their sectors:
- Cesky telekomunikacni urad (ChTU), the Czech Telecommunication Office would become the jednotne kontaktni misto, the single point of contact the AI Act requires, and the coordinating market surveillance authority.
- Ceska narodni banka (CNB), the Czech National Bank would supervise AI in the entities it already regulates, principally the financial sector.
- Urad pro ochranu osobnich udaju (UOOU), the Office for Personal Data Protection would supervise where the questions touch personal data protection and privacy inside its existing competence.
Two more bodies fill supporting roles. The Office for Technical Standardisation (Urad pro technickou normalizaci, metrologii a statni zkusebnictvi) is designated as the notifying authority that will accredit conformity-assessment bodies. The MPO also flags a role for the Public Defender of Rights (Verejny ochrance prav, the ombudsman) on fundamental-rights protection. The ChTU has confirmed the framing on its own site, stating that its published guidance rests on the AI Act and on this draft bill.
Status: still a draft, no bill number yet
This is the part to hold onto. The MPO is explicit that "navrh je nyni v meziresortnim pripominkovem rizeni" (the draft is now in interministerial comment). That is an early government stage, before the cabinet approves a text and long before parliament sees one. A check of the Chamber of Deputies (Poslanecka snemovna) bill register shows no snemovni tisk assigned to this proposal at the reference date, which is consistent with a text that has not yet cleared the government's own process.
So the authority split, the sandbox and the softer penalty options are all proposals. They can change in comment, in the cabinet, and again in the legislature. Treat the ChTU-as-contact-point design as the government's current intention, not as Czech law.
How Czechia's designation compares across the EU
The AI Act gives every member state the same assignment and lets each answer differently. The table below sets the Czech draft's choices against the baseline the regulation imposes and against the contrasting model Spain chose.
| Jurisdiction | Supervision model | Lead body / point of contact |
|---|---|---|
| Czech Republic (draft) | Distributed across existing regulators | ChTU as single point of contact, with CNB and UOOU by sector |
| Spain | Dedicated new agency | AESIA, the Spanish Agency for the Supervision of Artificial Intelligence |
| EU baseline (Reg. 2024/1689) | Each state must name its own authorities | At least one market surveillance authority plus a notifying authority |
The contrast is the story. Spain built a single dedicated regulator. The Czech draft does the opposite and hands AI Act duties to bodies that already supervise telecoms, banking and data protection. Both satisfy the same EU requirement to designate a market surveillance authority and a notifying authority. The Czech rows above come from the MPO draft and press release; the Spanish row reflects that country's separate designation.
What the draft does NOT do
- It does not create a single Czech AI regulator. Oversight stays split among the ChTU, CNB and UOOU, with the standardisation office and ombudsman in support.
- It does not rewrite the AI Act's substantive rules. Obligations on prohibited and high-risk systems come from Regulation (EU) 2024/1689 directly; the bill supplies institutions, process and penalties only.
- It is not in force and sets no confirmed compliance deadline of its own. As a draft in interministerial comment, it binds no one yet.
- It does not settle fine levels. The MPO describes lower ceilings and warnings as options in the draft, not fixed figures.
- It does not give the UOOU a general AI mandate. The UOOU's role is scoped to its existing data-protection and privacy competence, not to AI at large.
Key Facts
- Instrument
- Navrh zakona o umele inteligenci a o zmene zakona c. 87/2023 Sb. (draft act on artificial intelligence), the national adaptation of Regulation (EU) 2024/1689.
- Issuer
- Ministry of Industry and Trade (Ministerstvo prumyslu a obchodu, MPO), Czech Republic.
- Status
- Draft in interministerial comment (meziresortni pripominkove rizeni); no Chamber of Deputies bill number assigned at the reference date.
- Who is covered
- Providers and deployers of AI systems under the AI Act operating in or into the Czech market.
- Supervisory bodies proposed
- ChTU (single point of contact), CNB (financial sector), UOOU (data protection); Office for Technical Standardisation as notifying authority.
- Consequence
- National institutional, procedural and sanction mechanisms, including a possible lower fine ceiling and warnings for minor breaches.
FAQ
Has the Czech Republic passed an AI Act law?
No. This is a draft. The MPO proposal was in interministerial comment and had not been assigned a Chamber of Deputies bill number. Nothing here is in force.
Which authority supervises AI in the Czech draft?
Supervision is split. The ChTU would be the single point of contact, the CNB would cover entities it already supervises, and the UOOU would cover its data-protection remit.
Does the draft create a single new AI regulator?
No. Unlike Spain and its dedicated AESIA, the Czech draft distributes AI Act duties across existing regulators, adds the standardisation office as notifying authority, and plans a national regulatory sandbox separately.
Primary sources
- Ministry of Industry and Trade press release: MPO pripravilo navrh zakona o umele inteligenci (mpo.gov.cz).
- Czech Telecommunication Office: Umela inteligence (ctu.gov.cz), confirming the draft bill's full title and the AI Act basis.
- EU baseline: Regulation (EU) 2024/1689 (AI Act).