AI Regulation8 October 2026

The AI Act's rule is centralized. Its enforcement isn't.

The AI Act's transparency obligations (Article 50) have applied EU-wide since August 2, 2026 — but in Ireland, the national bill giving authorities the power to enforce them had only reached Committee Stage in the Seanad as of July 1, 2026. A textbook case of regulatory federalism.

The AI Act was built as a single rule for the whole EU internal market: one text, one set of risk thresholds, one set of transparency obligations, applicable from Lisbon to Helsinki. But an EU regulation isn't self-executing — its practical enforcement (inspections, sanctions, interpretation of gray areas) falls to the market surveillance authorities of each of the 27 member states. And that is exactly where the structure is showing its first cracks: in Ireland, the national legislation meant to give those authorities their enforcement powers had, as of July 1, 2026, only reached Committee Stage in the Seanad — a month before Article 50's transparency obligations took effect on August 2, 2026.

To an economist, this tension has a name: Wallace Oates' decentralization theorem (1972). Oates shows that a public policy should be centralized when economies of scale and cross-border externalities dominate — exactly the case for a product-safety rule in a single market, where a non-compliant AI system deployed in one country affects trust and competition everywhere else. It should instead be decentralized when local information matters most. The AI Act chose centralization for the rule itself — a choice consistent with single-market logic. But it delegated implementation to the budgets, legislative calendars, and political priorities of 27 separate national administrations, which are not all moving at the same pace.

The observable result today: a uniform legal obligation on paper, but uneven enforcement intensity in practice, depending on the member state where a company is established or deploys its systems. This is exactly the flaw already leveled at, for instance, the GDPR's one-stop-shop mechanism — a centralized rule, variable enforcement capacity. For an industrial or aerospace company operating across several European countries, this creates a risk asymmetry that is hard to price: there is no way to know, before a case sets precedent, whether real-world compliance expectations will track the EU text or the potentially more lenient — or stricter — reading of the least, or most, advanced national regulator.

The full analysis is reserved for Business members

Sector impact, operational recommendations and key figures.

Become a Business member

Analysis by

Cardan-AI Intelligence

Our research and analysis unit, dedicated to applied AI for business, industry and regulatory compliance.

Sources

Let's talk about your next competitive edge

Thirty minutes to identify the two or three use cases in your operations that pay for themselves within the first year.

Book a meeting