Germany, the Netherlands, Austria and the United Kingdom: compare functions, not organisational charts

Choosing an authority is not enough. It is also necessary to decide who advises, who supervises, who decides and how expertise circulates between them. Four examples from other countries help clarify these choices, provided each is read in its actual legal context and stage of development.

Germany: enacted legislation. The KI-MIG of 22 July 2026 (BGBl. 2026 I No 223) gives the Bundesnetzagentur competence as the general rule, subject to exceptions for certain products and financial activities. An independent chamber of three members reports annually to the Bundestag. Its scope is specific: certain high-risk biometric systems used for law enforcement, border management, justice and democracy, together with the high-risk systems listed in points 6, 7 and 8 of Annex III. Section 2 nevertheless reserves supervision of systems placed on the market, put into service or used by public bodies of the Länder to the authorities competent under their respective laws. This chamber is therefore not a general authority for all AI systems.[3]

The Netherlands: a proposal. On 20 April 2026, the government presented a model based on existing authorities, coordinated by the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur. This is a proposal, not enacted legislation.[4]

Austria: a support service. Austrian legislation assigns the RTR an AI information and advisory service (“Informations- und Beratungsangebot”) for media, telecommunications and postal services.[5] This is a support function. It does not, by itself, create a general power to impose penalties.

The United Kingdom: sharing expertise. The Digital Regulation Cooperation Forum describes its AI audit group as an “internal, cross-regulatory forum”. Regulators exchange audit methods and compare the powers the law gives each of them.[6] The group creates neither a joint authority nor a new power.

Three functions that must remain distinct

These examples reveal three separate functions. Advice helps a business understand what is expected of it. Sharing audit capabilities helps supervisors work more effectively. Supervision and penalties require a specific legal power. An institution may perform all three, but the person dealing with it needs to know which function is being exercised.

The contribution I prepared for the consultation draws a practical conclusion: a business asking a question in good faith should not fear that the question will trigger an investigation into it. How the advisory and supervisory functions communicate, or do not communicate, determines the quality of the questions the Institute will receive.

Cooperate without blurring the roles

A letter dated 8 July 2026 illustrates the boundary in the Netherlands. The President of the Administrative Jurisdiction Division of the Raad van State comments on two provisions of the draft legislation. On Article 4.1, she considers accompanying a project in a regulatory sandbox incompatible with the judicial function. On Article 5.1, she expressly asks that the provision should not apply to the President of that Division: agreeing on a uniform interpretation with other authorities would be incompatible with the President’s independent judicial role. She nevertheless preserves the possibility of cooperation necessary for effective supervision, provided that it does not compromise that independence.[7] The same letter mentions a proposed joint expert team; it does not say that the team is already operating. This is a consultation response, not a judgment.

For Belgium, the lesson concerns method. Before celebrating cooperation, we need to identify the roles it brings together. Our proposal is to test the arrangements under consideration against two or three hypothetical cases: one combining a technical difficulty with an effect on a person, another exposing disagreement between services. The test would show the route followed, responsibility at each stage and what the user learns.

The proposals in these four articles are the author’s own, drawn from the contribution he prepared for the BIPT consultation. They do not represent the Institute.