EU AI Act in Germany

Germany's Gesetz zur Durchführung der Verordnung (EU) 2024/1689 über künstliche Intelligenz, the KI-VO Durchführungsgesetz, was adopted on 11 February 2026 and constitutes Germany's national implementation of the EU AI Act. The law designates competent authorities, allocates enforcement roles, and sets the administrative foundations for Annex III enforcement from 2 December 2027.

The central design decision is a multi-authority allocation with the Bundesnetzagentur (BNetzA) as the lead market surveillance authority. The BSI (Federal Office for Information Security) handles AI cybersecurity. The BfDI (Federal Commissioner for Data Protection and Freedom of Information) and the 17 state-level data protection authorities retain jurisdiction over personal data aspects. Financial-services AI falls to BaFin. This is a distributed model, but less distributed than Ireland's 15-authority approach.

Which Authority Does What

The German allocation (subject to minor technical adjustments in the final transposition):

• BNetzA (Bundesnetzagentur), lead market surveillance authority under Article 70. Handles provider and deployer investigations for most Annex III domains.
• BSI (Bundesamt für Sicherheit in der Informationstechnik), cybersecurity of high-risk AI systems; NIS2 coordination.
• BfDI + Länder DPAs, personal data aspects under GDPR; AI Act enforcement for law-enforcement domain (Annex III Point 6).
• BaFin, AI in financial services (credit, insurance, capital markets) under Point 5(b), 5(c) and overlap with existing prudential and conduct supervision.
• KBA + sector regulators, sector-specific AI for automotive, medical devices, railway etc., in their respective domains.

The single-window principle: where a system falls across authorities, BNetzA is the designated coordination point.

What the Durchführungsgesetz Adds Beyond the Regulation

The national law does not create new substantive obligations, the AI Act is a regulation, directly applicable. What the Durchführungsgesetz adds is procedural: authority designation, penalty administration, complaint channels, and language/form requirements for documentation submitted to German authorities.

Key procedural points with practical consequences:

• Language: formal documentation submitted to German authorities must be in German. English may be accepted informally but is not a legal substitute.
• Works councils: the Durchführungsgesetz reinforces existing BetrVG §87(1) Nr. 6 co-determination rights on technical surveillance, works councils can invoke them in respect of Annex III Point 4 systems.
• Sandboxes: Germany is establishing regulatory sandboxes under Article 57, early announcements suggest BNetzA-hosted sandboxes for SMEs with priority access for MedTech and FinServ.
• Notifications: serious incident notifications under Article 73 are submitted to BNetzA via an online portal (portal URL to be published before August 2026).

The Phased-Compliance Playbook for German Companies

A German provider or deployer preparing for 2 December 2027 has a roughly consistent playbook across sectors:

1. Inventory and classify. Every AI system against Article 6 and Annex III. Distinguish Annex I (embedded in regulated products, 2027 deadline) from Annex III (2026).
2. Map to German authorities. Primary authority for each system. Where uncertainty exists, BNetzA is the coordination point.
3. Works-council engagement. BetrVG §87 co-determination must be built into deployment timelines. 30–90 day consultation windows are typical.
4. German-language documentation. Technical documentation, FRIAs, and instructions-for-use materials for German deployments must be in German. Translation cycles add weeks.
5. Sandbox consideration. SMEs and innovators in priority sectors (MedTech, FinServ) may benefit from the BNetzA sandbox, reducing regulatory friction during development.