Governance

Competent Authority

Independent regulatory body overseeing AI systems.

How the laws define this

National legal frameworks consistently define a competent authority as a designated public body empowered to oversee law implementation, issue regulations or technical standards, monitor compliance, conduct investigations, and impose sanctions while coordinating with sectoral regulators. The principal divergence among these instruments lies in whether this authority is established as a single centralized entity or distributed across existing regulatory bodies. Under the Artificial Intelligence Regulation Bill proposed in Costa Rica, the Draft Act on the Promotion and Support of Artificial Intelligence Innovation, and the Personal Data Protection Law (PDPL) involving the Saudi Data & AI Authority, oversight is assigned to a single designated national body or new independent regulatory body. By contrast, the French Projet de loi adaptation for the EU AI Act divides the competent authority role among multiple existing public bodies based on area of expertise, specifically naming the CNIL, ARCOM, and DGCCRF. Consequently, regulated organizations face either a unified, specialized authority or a network of established sectoral supervisors depending on the legal framework.

Synthesised from the 4 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Saudi Arabia	Personal Data Protection Law (PDPL) (Royal Decree M/19)	In Force (Amended)	Limits the term to the authority supervising PDPL implementation, identified in practice as SDAIA, which coordinates with sectoral regulators on personal data matters.
Costa Rica	Law Regulating Artificial Intelligence in Costa Rica	Under Review	Proposes a new independent body reporting to the Legislative Assembly, focused on auditing AI for bias and human rights compliance.
Thailand	Draft Act on the Promotion and Support of Artificial Intelligence Innovation of Thailand B.E. ....	Draft	Designates an existing national body like ETDA's AI Governance Center to promote innovation through sandboxes, standards, and conformity assessments.
France	Bill containing various provisions for adaptation to European Union law in economic, financial, environmental, energy, information, transport, health, agriculture and fisheries matters	Under Review	Distributes the role among existing sectoral bodies like CNIL, ARCOM, and DGCCRF for enforcing the EU AI Act within their expertise areas.

What it triggers

In Saudi Arabia, under the PDPL, it adjudicates enforcement actions, issues sanctions, oversees registration, monitoring, and breach notification.
Under the Costa Rica AI bill, it would develop regulations, issue guidance, investigate complaints, conduct audits, impose sanctions, and coordinate with regulators.source
Under the Thailand draft act, it would supervise implementation, administer registration, conformity assessment, enforce compliance, and operate sandboxes.source
Under the France DDADUE bill and EU AI Act, they would conduct market surveillance, investigations, and impose penalties for non-compliance.source

Definitions (4)

The new independent regulatory body proposed to oversee AI systems in Costa Rica, empowered to develop implementing regulations, issue guidance, receive and investigate complaints, conduct audits, impose sanctions, and coordinate with other regulators. It reports to the Legislative Assembly through defined reporting and budgetary oversight.

Artificial Intelligence Regulation Bill (Legislative Assembly)Definition 1 of 4

The authority empowered to supervise implementation and enforcement of the PDPL (identified in practice as the Saudi Data & AI Authority, SDAIA), which issues implementing regulations, maintains the national register, adjudicates enforcement actions, and issues guidance and transfer instruments. The Competent Authority coordinates with sectoral regulators and oversees registration, monitoring, breach notification and sanctions.

Personal Data Protection Law (PDPL) (Royal Decree M/19)Definition 2 of 4

The designated national body (in practice the Electronic Transactions Development Agency and its AI Governance Center) empowered by the draft to supervise implementation, publish technical standards and delegated lists, operate sandboxes, administer registration and conformity assessment, coordinate with sectoral regulators, and enforce compliance.

Draft Act on the Promotion and Support of Artificial Intelligence Innovation (AI Innovation Promotion Act)Definition 3 of 4

A competent authority refers to a national public body in an EU Member State, designated by national law, that is responsible for the application and enforcement of the EU AI Act. In France, this role is distributed among existing bodies like the CNIL, ARCOM, and DGCCRF, each overseeing AI systems within their specific areas of expertise. They conduct market surveillance, investigations, and impose penalties for non-compliance.

Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne en matière économique, financière, environnementale, énergétique, d'information, de transport, de santé, d'agriculture et de pêcheDefinition 4 of 4

Not to be confused with

authority competent

Refers more generally to any designated national authority for implementing and enforcing the law, while Competent Authority specifies supervisory and enforcement roles over AI or data systems.

Competent Ministry for AI

Names a ministry responsible for AI authorization and oversight, whereas Competent Authority covers independent or designated bodies with broader regulatory powers.

Questions and answers

What does Saudi Arabia's Competent Authority do under PDPL?

It supervises PDPL implementation as SDAIA, issues regulations, maintains registers, adjudicates actions, and coordinates with sectoral regulators on data matters.

Who is the Competent Authority in France for EU AI Act?

The role is distributed among CNIL, ARCOM, and DGCCRF, each handling AI systems in their expertise areas for market surveillance and penalties.

What powers would Costa Rica's AI regulatory body have?

The proposed body would issue regulations, guidance, investigate complaints, audit for bias and rights compliance, impose sanctions, and report to the Legislative Assembly.