Six Staff, One Complaints Form: Who Enforces the AI Act First

From 28 October anyone in Poland who believes an AI system breaks EU rules can complain to the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI), the new Commission for the Development and Security of Artificial Intelligence. Its team so far numbers six people, Wprost reported on 9 October, citing Justyna Duszyńska-Cichy, who directs the Ministry of Digital Affairs’ AI department. Italy’s enforcement decree takes effect five days earlier. Both arrive more than a year after 2 August 2025, the date by which member states were to name market surveillance authorities under Regulation (EU) 2024/1689, the AI Act, according to the European Commission. For ministries and suppliers, the question is no longer whether national enforcement exists but how much of it there is.

Poland opens for complaints before its regulator is staffed

Poland’s Act of 3 July 2026 on artificial intelligence systems (Dz.U. 2026 poz. 1003) took effect on 11 August, but its chapters on inspections, proceedings, settlements and penalties apply only from 28 October. KRiBSI is the market surveillance authority and single point of contact. The board is a chair, two deputies and four members nominated by the competition, financial, broadcasting and telecoms regulators. Complaints are filed electronically, on paper where that is impossible. One tool is unusual: a party that has stopped an infringement and disclosed everything material, including accomplices, can seek a settlement granting extraordinary mitigation of its penalty.

KRiBSI, chaired by Pamela Krzypkowska, is recruiting complaints and inspection staff, a sandbox unit (sandboxes are due by 2 August 2027) and technology lawyers, according to Wprost; Krzypkowska calls it an official start-up (“urzędowego startupu”, in her words). Article 70 of the AI Act requires “a sufficient number of personnel permanently available”. Six people will pass that test only if early complaints are few or simple.

Italy hands market surveillance to its cyber agency

Decreto legislativo 7 ottobre 2026, n. 179, published in the Gazzetta Ufficiale on 8 October, is in force from 23 October. Its first article names the Agenzia per la cybersicurezza nazionale (ACN) first among the market surveillance authorities, alongside the financial and data protection supervisors, and makes the Agenzia per l’Italia Digitale (AgID) the notifying authority. According to an analysis in Agenda Digitale, Article 16 lets cases open on serious-incident reports, complaints that are not manifestly unfounded, referrals or ACN’s own initiative; Article 23 caps fines for prohibited practices at €35m or 7 per cent of worldwide turnover; Article 24 requires sanction decisions to be published. A cyber agency in the lead frames AI compliance as technical conformity and security.

The Netherlands builds a directorate it cannot yet use

The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), announced on 9 October a directorate for AI and algorithm supervision. One department covers algorithmic risk, including discrimination testing of risk-selection tools; the other prepares AI Act market surveillance. The AP is the intended regulator, alongside the Rijksinspectie Digitale Infrastructuur (RDI), but gains powers only when the national implementing act, the Uitvoeringswet AI-verordening, takes effect; its funding is still under discussion. The Commission’s list marks the Dutch designation as pending. Board member Katja Mur: “Wij kunnen daarom niet wachten tot het laatste verkeersbord is geplaatst” (we therefore cannot wait until the last road sign is in place).

Denmark’s deepfake bill relies on platforms, not a regulator

Denmark’s bill, which Culture Minister Zenia Stampe tabled on 8 October, is not AI Act enforcement. It amends the copyright act to make sharing realistic digital imitations of a person’s appearance or voice without consent unlawful, exempts satire and parody, and she hopes it takes effect at the turn of the year. A main goal, she said, is to get the tech giants to remove manipulated content quickly. The cross-party agreement of 26 June 2025 it implements foresaw no fines or prison for sharers, relying on Digital Services Act takedown duties (see ChatGPT Now Answers to Brussels Twice Over).

From the national texts:

What decision-makers should watch

Prohibited practices have applied since 2 February 2025; Wprost notes that workplace emotion recognition is among them. Polish public bodies should expect early complaints to test those bans rather than high-risk duties, whose timetable Brussels is reworking (see Europe Resets the Clock on the AI Act). Watch KRiBSI’s first complaint figures, ACN’s first published decision and a start date for the Dutch act.

Sources

1. Organ stojący na straży polskiego AI ma 6 osób. „Nie boimy się zalewu spraw” — Wprost, 9 October 2026 (in Polish; translation by AI & GPP)
2. Market Surveillance Authorities under the AI Act — European Commission, last updated 7 September 2026
3. Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003) — Dziennik Ustaw / ELI, published 27 July 2026 (in Polish; translation by AI & GPP; PDF text linked from the page)
4. Article 70: Designation of national competent authorities and single points of contact — European Commission AI Act Service Desk
5. Decreto legislativo 7 ottobre 2026, n. 179 — Gazzetta Ufficiale, 8 October 2026 (in Italian)
6. Decreto legislativo 7 ottobre 2026, n. 179, original text — Normattiva, 8 October 2026 (in Italian; translation by AI & GPP)
7. AI Act in vigore in Italia, ecco i controlli: cosa rischiano le imprese — Agenda Digitale, 15 October 2026 (in Italian; translation by AI & GPP)
8. AP zet volgende stap in toezicht op AI — Autoriteit Persoonsgegevens, 9 October 2026 (in Dutch; translation by AI & GPP)
9. Kulturminister vil dæmme op for delinger af digitale efterligninger fra årsskiftet — Danish Ministry of Culture, 8 October 2026 (in Danish; translation by AI & GPP)
10. Værn mod deling af digitale efterligninger af personlige kendetegn (political agreement) — Danish Ministry of Culture, 26 June 2025 (PDF; in Danish; translation by AI & GPP)