August 2, 2026 marks the general application of the AI Act. Obligations relating to high-risk systems in Annex III will apply from December 2, 2027, while the first substantive provisions have already been in effect since February 2, 2025. France has proposed a sectoral framework based on existing authorities, whose finalization remained subject to Parliament’s acceptance: the DGCCRF ensures operational coordination of market surveillance authorities and the DGE represents France in the European AI Committee. Ireland has planned a central AI Office for coordination and as a point of contact within a supervision model distributed among several competent authorities; its statutory creation remained linked to the entry into force of national legislation.
The Essentials
- France has fragmented AI Act governance among twenty competent authorities without central coordination or a designated interlocutor with the European Commission.
- Ireland has created an operational AI Office as of August 1, 2026, Sweden has delegated to a central agency: two alternative models that enable a unified response to incidents.
- The AI Act provides for sanctions of up to €35 million or 7% of global turnover for serious breaches, which requires an authority capable of identifying the incident and handling the case.
- Fragmentation creates an operational blind spot: in the event of a serious incident involving a high-risk AI system, no French authority is designated to act on the front line.
- The window for correcting the architecture is narrow, the first substantive obligations are already applying, and institutional adjustments take time.
Twenty Regulators, Zero Leader
Sweden has distributed competences among several authorities, with the PTS occupying a central coordination function on certain matters, without concentrating all AI Act attributions in a single agency. The sanctions provided for by the regulation reach 35 million euros or 7% of global turnover for the most serious violations. An authority will need to identify and sanction violators.
The French logic is understandable on paper. AI crosses all sectors: health, finance, recruitment, justice, transport. It is therefore coherent that the CNIL supervises issues of personal data, that the ACPR monitors banking uses, that the HAS handles medical devices with an algorithmic component. Each regulator knows its sector. Sectoral competence is real.
The difficulty emerges as soon as a system escapes this ordered scheme. A high-risk AI system does not always fit into a single regulatory category. An automated recruitment tool simultaneously touches labor law, personal data, and anti-discrimination rules. The competent authority depends on the type of system and the sector; the French allocation and coordination have been published.
The DGCCRF is designated as the single point of contact in the proposed French framework, but this designation did not yet appear finalized in the Commission’s list. Providers, and in some cases deployers, must report serious incidents to national market surveillance authorities; competent national authorities must immediately notify the Commission of any serious incident. A DPO Partage publication from March 2026 mentions the CNIL as the competent authority; the official French source proposes that the DGCCRF be the single point of contact, subject to finalization of the legislative framework.
This fragmentation is not an administrative accident: it is a political choice. France has favored existing regulators while entrusting an operational coordination role to the DGCCRF and a strategic coordination role to the DGE. The result is an architecture functional in calm times, fragile in crisis times.
Ireland as an Operational Counter-Example
Ireland has adopted a supervision model distributed among several competent authorities. With its AI Office, Dublin has planned a single point of contact for companies and an identified interlocutor for the European Commission; coordination and the point of contact are centralized, while investigation and enforcement remain largely sectoral. The country hosts the European headquarters of Google, Meta, Apple and many AI actors: it had a direct interest in clarifying the framework quickly, and it did so.
Sweden relies on several existing agencies, with a possible central coordination role for the PTS, rather than concentrating all AI Act attributions in a single agency. Two models, two different institutional choices, but a common logic: identify who is in command before the incident occurs, not after.
These choices are not without limits. Concentrating competences in a single structure can create sectoral blind spots; a generalist AI regulator rarely knows finance or medicine as well as the specialized regulator. But faced with a European regulation that requires investigation procedures, standardized response times and notification channels, institutional clarity has a value of its own that sectoral depth does not entirely compensate for.
The Concrete Requirements of the AI Act
The regulation requires a traceable chain of responsibility from end to end. When a high-risk system is deployed, the competent authority must be able to verify technical documentation, request corrections, impose market withdrawal or initiate a sanctioning procedure within precisely defined timeframes. This chain assumes that an authority is legally empowered to act at each link; multiple authorities sharing fragments of competence with none able to activate the entire system do not satisfy this requirement. Institutional fragmentation does not produce a total void, but it generates friction at each transition between links, at a cost in time and coherence. A case that crosses the border between one sectoral regulator’s competence and another’s mechanically slows down, due to the lack of a common formalized transmission procedure between authorities that had no reason to work together before the regulation entered into force.
The AI Act is not a text of principles. It defines risk categories, precise obligations and investigation procedures. For high-risk systems, which cover areas as varied as the selection of job candidates, credit decisions, critical infrastructure management, school assessment tools or certain medical devices, obligations include detailed technical documentation, robustness testing, formalized human supervision and a declaration of conformity.
As the JdP analyzed at the entry into force of the first provisions, the AI Act sanctions companies whose compliance criteria are still to be clarified. This normative ambiguity is real. But it is added in France to an institutional ambiguity: not only are precise criteria sometimes lacking, but the French framework identifies authorities for compliance and oversight by sector, subject to its legislative finalization.
The sanctions provided for by the regulation reach up to 35 million euros or 7% of global turnover for the most serious violations, and up to 15 million euros or 3% for other categories. This scale creates real pressure on companies, but also on States.
Each Member State must designate a single point of contact for the application of the regulation and notify it to the Commission. If twenty authorities share competence without clear designation, the response risks being late, contradictory or absent.
The Compliance Timeline is Already Underway
The AI Act calendar is graduated. Some provisions apply from August 2026, others will take effect until 2027 and beyond. The window for institutional adjustment still exists, but it is closing as the first investigation or notification procedures commence.
For French companies, uncertainty about the competent interlocutor generates concrete costs. Building a compliance approach requires knowing who can validate technical documentation, who handles a complaint, who grants or refuses certification. Multiplying these potential interlocutors also multiplies procedures and the risks of divergent interpretations across sectors. Large companies can absorb this complexity. Smaller actors, often in more acute uncertainty about the training needed to develop AI skills, are exposed to disproportionate compliance costs.
There are paths for evolution. Several options are on the table, without any having been decided: designate the CNIL as the lead authority by virtue of its cross-sectional competence on data, create an inter-regulator coordination committee with a permanent secretariat, or entrust the role of European interlocutor to the Ministry of Economy with a coordination mandate. Each has its advantages and disadvantages. None is perfect, but an imperfect architecture with a leader is better than a tidy architecture with no one in charge during a crisis.
Fragmented Governance as a Structural Handicap
Fragmentation between authorities manifests structurally in ordinary procedures. Each clarification requested by a company, each complaint from a claimant, each determination of competence between authorities consumes time and produces uncertainty. This repeated friction weighs on the overall quality of regulation, not from regulator incompetence but because coordination between separate actors requires resources that internal cooperation within a single structure does not.
Fragmentation directs part of regulatory energy toward questions of scope and legitimacy to act, at the expense of substantive examination of the systems themselves. This cost of internal organization remains invisible in texts but real in practices, and it accumulates as the volume of AI-related cases increases in all sectors simultaneously.
The question goes beyond the AI Act alone. AI is part of increasingly fast-moving chains of action: a model deployed today can affect millions of decisions tomorrow. The speed of adoption is asymmetrical with the speed of classical regulatory procedures. Therefore, an authority’s capacity for response counts as much as its expertise.
French fragmentation does not prevent regulation from functioning day-to-day. Multi-actor governance can create coordination challenges, but France has published a framework providing for these mechanisms, subject to its legislative finalization. Brussels is negotiating implementation arrangements with Member States; Member States that speak with a single voice carry more weight in these negotiations than those that must first coordinate many internal positions before responding.
Ireland has made the opposite choice for reasons tied to its particular situation, a small country that concentrates a large share of the European headquarters of tech giants, with a direct interest in clarifying the framework as quickly as possible. France is not Ireland, and its sectoral administrative fabric has real value. But the AI governance architecture deserves an explicit decision, not a default status quo.
What Is at Stake by 2027
The AI Act provides that competent national authorities cooperate within a European network coordinated by the Commission. This network will be all the more effective if each State sends it a representative capable of speaking for its entire national system. France brings together many sectoral authorities, but in the proposed French framework, coordination and representation are assigned to identified interlocutors, subject to finalization of the legal framework.
The next concrete step is to clarify, at the legislative level or by inter-ministerial circular, which authority exercises the role of national point of contact for the Commission. This designation does not solve everything: it does not create technical competence where it is lacking, it does not fund inspection staffing, it does not resolve borderline cases between sectoral regulators. But it makes the rest possible. Governing a transnational technology begins by deciding who governs.
Sources
- DPO Partage, AI Act as of August 2, 2026: what applies, what awaits: https://www.dpo-partage.fr/ai-act-au-2-aout-2026-ce-qui-sapplique-ce-qui-attend/
- Ministry of Economy (France), AI Act Transposition, September 2025 (document without stable URL available)
- European Commission, Regulation (EU) 2024/1689 on Artificial Intelligence (AI Act), July 2024: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
