by Dario Negretti & Joe McNamee
Two of the EU’s landmark laws in the field of digital policy, the Digital Services Act (DSA) and the AI Act, share the same problem: a significant number of Member States lack national institutions for overseeing their enforcement. Without these bodies, implementation of the regulations risks existing only on paper. As a result, individuals in those Member States have no national authority empowered to receive and communicate their complaints about failure to respect their rights. And then, because no authority is appointed, those Member States lose their voice in EU-level policy development and enforcement coordination…the list goes on. It is a cost with no obvious benefit.
What is a national competent authority?
Both pieces of legislation rely on a degree of decentralised enforcement. While the European Commission proposed the rules and agreed them with the Member States and the European Parliament, national authorities are fully or partly responsible for conducting the regulations’ oversight. While the DSA uses the term “Digital Services Coordinators” (DSCs), the AI Act refers to “Market Surveillance Authorities” (MSAs). These Member State-appointed entities are responsible for monitoring compliance, conducting investigations into violations, handling complaints and, where appropriate, imposing penalties.
The role of these authorities is deeply connected with the theme of disinformation, since the DSA is the key legislative framework for requiring Very Large Online Platforms such as X, Facebook, TikTok and YouTube to mitigate the systemic risks caused by their platforms, including the spread of disinformation, supporting the Commission in certain aspects of this work. At the same time, the AI Act regulates the use of AI technology in ways relevant to disinformation, such as the creation of synthetic media / deepfakes.
We all agree to enforce, but who’s in charge?
The same failure is present across both laws: the EU Member States were given (with their approval and support) a specific legal deadline to create and/or empower independent national regulators, but many failed to comply with these obligations.
For instance, 13 countries failed to nominate Digital Services Coordinators under the DSA on or before the deadline set for 17 February 2024[1] [2], while only 8 countries nominated a “Market Surveillance Authority” under the AI act within the deadline set for 2 August 2025[3].
The factors causing this non-compliance are broadly similar: budget constraints, disagreements among ministries regarding which one should manage the oversight, and the complexity of creating independent authorities within fragmented national regulatory structures. It is possible that these conditions led the same countries not to comply both under the DSA and the AI act.
It has to be pointed out also, that the European Commission’s sudden rhetorical war against its own legislation, implicitly casting itself as the instigator of unnecessarily complicated, anti-innovation and implausibly costly legislation has hardly helped national governments to justify the set-up and running costs of these new or expanded entities.
Nonetheless, in the case of the Digital Services Act, the Commission opened 13 infringement proceedings against some Member States[4] [5] (which led some to comply), but, at time of writing, it hasn’t opened any so far for non-compliance with the AI Act.
Undermining the regulation undermines the enforcement
The consequences of these failures are significant. In 2021, when launching the AI Act, the Commission promised “proportionate and flexible rules” that would “address the specific risks posed by AI systems and set the highest standard worldwide” – four years later it felt the need to “simplify” the Regulation. The Commission was unable to support its own legislation, and so it was hardly surprising that Member States were not motivated to do their share. On the other hand, it told big tech lobbyists that even democratically adopted EU law was fair game: every law can be challenged, even after it has been approved.
For the DSA, things aren’t much better, although it hasn’t suffered the humiliation of “simplification” – not yet anyway. In 2020, The European Commission,launched the DSA proposal with a press release saying it was founded on “European values”. Yet, it has been soporific in its implementation of the elements it is responsible for. If in doubt, have a look for the Facebook option to have a feed that is not based on profiling, as required by Article 38.
Meanwhile, some Member States have not fully empowered their national Digital Services Coordinator, robbing their own inhabitants of having their problems raised in the EU’s Digital Services Board, or the right to submit complaints through their own language in their own country. While Brussels lurks on new regulation, we first need the motivation, determination, and courage to pass and implement the current legislation that is as good as the promises made in the Commission’s initial press releases. Nothing more, and certainly nothing less.
[1] European Commission (2024) Commission calls on Cyprus, Czechia, Estonia, Poland, Portugal and Slovakia to designate and fully empower their Digital Services Coordinators under the Digital Services Act, 24 April 2024. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-calls-cyprus-czechia-estonia-poland-portugal-and-slovakia-designate-and-fully-empower (Accessed: 17 June 2026).
[2] European Commission (2024) The Commission calls on 6 member states to comply with the EU Digital Services Act, 25 July 2024. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-calls-6-member-states-comply-eu-digital-services-act (Accessed: 17 June 2026).
[3] European Parliament, Joint IMCO-LIBE Working Group on the Implementation and Enforcement of the Artificial Intelligence Act (2026) Session of 15 April 2026. European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE). Available at: https://www.europarl.europa.eu/committees/en/libe/working-groups/ai-act (Accessed: 17 June 2026). Minutes pending official publication at time of writing.
[4] European Commission (2024) Commission calls on Cyprus, Czechia, Estonia, Poland, Portugal and Slovakia to designate and fully empower their Digital Services Coordinators under the Digital Services Act, 24 April 2024. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-calls-cyprus-czechia-estonia-poland-portugal-and-slovakia-designate-and-fully-empower (Accessed: 17 June 2026).
[5] European Commission (2024) The Commission calls on 6 member states to comply with the EU Digital Services Act, 25 July 2024. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-calls-6-member-states-comply-eu-digital-services-act (Accessed: 17 June 2026).