Which authorities are responsible for enforcing these penalties?

Responsibility for enforcing the penalties under the EU AI Act is divided among different authorities, depending on the type of AI system and the specific entity involved:

National authorities and courts

For most operators (such as providers, deployers, importers, and distributors of AI systems), enforcement is handled at the national level. Member States are required to establish rules on penalties and designate national competent authorities, such as market surveillance authorities, to supervise the application of the Act. Depending on the specific legal system of each Member State, the administrative fines may be imposed directly by these designated national bodies or by competent national courts.

The European Commission

The Commission has exclusive powers to supervise and enforce the rules concerning general-purpose AI models, with the implementation of these tasks entrusted to the AI Office. Therefore, the Commission is the authority responsible for directly imposing fines on the providers of general-purpose AI models if they infringe on their obligations, fail to provide requested documents, or refuse access for evaluation.

The European Data Protection Supervisor (EDPS)

When the entity deploying or providing an AI system is a Union institution, body, office, or agency, the EDPS acts as their competent market surveillance authority. Accordingly, the EDPS is the specific authority empowered to impose administrative fines on these European entities.