Article 70 — EU Database for High-Risk AI Systems

Article 70

Designation of national competent authorities and single points of contact

1. Each Member State shall establish or designate as national competent authorities at least one notifying authority and
at least one market surveillance authority for the purposes of this Regulation. Those national competent authorities shall
exercise their powers independently, impartially and without bias so as to safeguard the objectivity of their activities and
tasks, and to ensure the application and implementation of this Regulation. The members of those authorities shall refrain
from any action incompatible with their duties. Provided that those principles are observed, such activities and tasks may be
performed by one or more designated authorities, in accordance with the organisational needs of the Member State.

2. Member States shall communicate to the Commission the identity of the notifying authorities and the market
surveillance authorities and the tasks of those authorities, as well as any subsequent changes thereto. Member States shall
make publicly available information on how competent authorities and single points of contact can be contacted, through
electronic communication means by 2 August 2025. Member States shall designate a market surveillance authority to act as
the single point of contact for this Regulation, and shall notify the Commission of the identity of the single point of contact.
The Commission shall make a list of the single points of contact publicly available.

ELI: http://data.europa.eu/eli/reg/2024/1689/oj 99/144
EN OJ L, 12.7.2024

3. Member States shall ensure that their national competent authorities are provided with adequate technical, financial
and human resources, and with infrastructure to fulfil their tasks effectively under this Regulation. In particular, the national
competent authorities shall have a sufficient number of personnel permanently available whose competences and expertise
shall include an in-depth understanding of AI technologies, data and data computing, personal data protection,
cybersecurity, fundamental rights, health and safety risks and knowledge of existing standards and legal requirements.
Member States shall assess and, if necessary, update competence and resource requirements referred to in this paragraph on
an annual basis.

4. National competent authorities shall take appropriate measures to ensure an adequate level of cybersecurity.

5. When performing their tasks, the national competent authorities shall act in accordance with the confidentiality
obligations set out in Article 78.

6. By 2 August 2025, and once every two years thereafter, Member States shall report to the Commission on the status
of the financial and human resources of the national competent authorities, with an assessment of their adequacy. The
Commission shall transmit that information to the Board for discussion and possible recommendations.

7. The Commission shall facilitate the exchange of experience between national competent authorities.

8. National competent authorities may provide guidance and advice on the implementation of this Regulation, in
particular to SMEs including start-ups, taking into account the guidance and advice of the Board and the Commission, as
appropriate. Whenever national competent authorities intend to provide guidance and advice with regard to an AI system
in areas covered by other Union law, the national competent authorities under that Union law shall be consulted, as
appropriate.

9. Where Union institutions, bodies, offices or agencies fall within the scope of this Regulation, the European Data
Protection Supervisor shall act as the competent authority for their supervision.

CHAPTER VIII
EU DATABASE FOR HIGH-RISK AI SYSTEMS