NCA Maturity Levels
National competent authorities are at varying stages of operational readiness as of early 2026. Frontrunner member states (Spain with AESIA, Ireland, the Netherlands) have designated authorities, published procedures, and in some cases launched regulatory sandboxes. Progressing member states (Germany, France) have draft legislation or designated partial authority structures. Lagging member states (fourteen as of late 2025) have not yet designated any competent authority.
This fragmentation creates practical challenges: organisations cannot complete certain compliance steps (identifying the correct authority for incident reports, for example) until the relevant member state has designated its authorities. The Legal and Regulatory Advisor monitors the IAPP EU AI Act Regulatory Directory and the Future of Life Institute’s national implementation tracker, establishing contact with designated authorities as early as possible.
Ireland’s distributed model (15 sector-specific authorities and 9 fundamental rights authorities) illustrates the complexity: organisations must identify the correct sector-specific authority for their system type. Germany’s Bundesnetzagentur designation and France’s multi-authority approach present different coordination challenges.
Key outputs
- NCA maturity classification (frontrunner, progressing, lagging) per jurisdiction
- Monitoring through IAPP and FLI trackers
- Early authority contact establishment
- Module 10 AISDP documentation
Engagement Strategies by Maturity
The organisation calibrates its engagement strategy to each authority’s maturity level. With mature authorities (frontrunners), proactive engagement and early dialogue build a constructive relationship; these authorities have the capacity to provide substantive feedback. With developing authorities (progressing), monitoring and preparation are appropriate; the organisation prepares its compliance documentation in formats that can be adapted as the authority’s procedures are published. With silent authorities (lagging), a conservative compliance posture is prudent, following the most demanding interpretation available from other jurisdictions.
Where an authority has published guidance, the Legal and Regulatory Advisor assesses it for consistency with other authorities’ positions and with AI Office publications. Where no guidance has been published, the organisation defaults to the AI Office’s guidance supplemented by the most conservative position from designated authorities.
The engagement strategy is documented in the jurisdiction register and reviewed quarterly as the NCA landscape evolves.
Key outputs
- Maturity-calibrated engagement strategy per jurisdiction
- Conservative default where no guidance is published
- Quarterly review as NCA landscape evolves
- Module 10 AISDP documentation