EU AI Act in Germany
Germany’s implementation runs through the KI-MIG: the KI-Marktüberwachungs- und Innovationsförderungsgesetz. Sources disagree on whether formal designation is complete, and that distinction matters if you need to know who supervises you today.
80 days to 2 December 2026 — two new Article 5 prohibitions, and Article 50(2) marking for generative systems already on the market. Full timeline →
Who enforces the EU AI Act in Germany?
Germany's draft implementing law, the KI-Marktüberwachungs- und Innovationsförderungsgesetz or KI-MIG, designates the Bundesnetzagentur as the primary market surveillance authority, with sector authorities retaining competence in their fields, notably BaFin for high-risk AI linked to regulated financial activities. Sources differ on whether formal designation and notification to the Commission has been completed, which depends on the passage of the KI-MIG.
Reg. (EU) 2024/1689 as amended by Reg. (EU) 2026/1744 · more questions on this page
Does this reach your organisation?
- Yes if you place an AI system on the EU market, or put one into service in the EU, wherever you are established.
- Yes if you are established in the EU and use an AI system under your own authority.
- Yes if you are outside the EU and the output your system produces is used in the Union.
No EU entity and no EU customers of record is not an exemption. Article 2 turns on market placement and on where output is used. Check your position in 12 questions →
High-volatility page, verify before relying on it
National implementation is moving and public sources disagree about the status of several member states. Everything below is dated to our last review. Before relying on any statement about which authority supervises you, check the Commission’s published list of notified national competent authorities and the authority’s own website. We would rather tell you a fact is contested than present it cleanly and be wrong. Our standards →
Status as at our last review
| Implementing law | KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG). Cabinet adopted the draft 11 February 2026; Bundestag first reading 20 March 2026; Bundesrat opinion 2 April 2026. |
| Proposed market surveillance authority | Bundesnetzagentur (BNetzA), with a planned coordination and competence centre (KoKIVO) to support other competent authorities. |
| Sector authorities retain competence | BaFin is intended as competent authority for high-risk AI directly linked to regulated financial activities. BfArM is reported for AI medical devices. |
| Notifying authority | Deutsche Akkreditierungsstelle (DAkkS) reported as notifying authority. |
| Data protection authority | Germany's decision to route AI Act supervision through BNetzA rather than its data protection authorities is a deliberate structural choice and is unusual among member states. |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
A request for information from the AI Office asks which AI systems you run, what each is for, which role you hold, and what is documented. The reply itself is penalty-bearing. Twenty minutes covers the same ground while nothing turns on the answer.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Where the sources disagree
One source reporting in April 2026 lists Germany as having designated BNetzA. A readiness assessment from May 2026 states that until the KI-MIG is passed and published, BNetzA remains a proposed authority in draft statute rather than formally designated and notified. Both can be true at different points in a process. We have not resolved which describes the position today.
How to get a definitive answer
- The European Commission’s published list of national competent authorities notified under Article 70 is the authoritative record of who has been designated.
- The authority’s own website, which will usually say whether it has AI Act competence.
- Your sector regulator, which in several member states retains competence for high-risk AI in its field regardless of who the lead authority is.
What to do in Germany specifically
- Identify your sector authority first, not BNetzA. The KI-MIG design keeps sector authorities competent in their fields. If you are a financial institution your likely counterparty is BaFin; for medical devices, BfArM. BNetzA is the coordinating lead, not the universal answer.
- Watch the KI-MIG passage, not just the designation. National penalty procedures are set by the implementing law. Until it passes, how penalties are administered in Germany is not fully settled.
- Works council co-determination is the practical gate for workplace AI, and it operates independently of the AI Act. In Germany it frequently binds before any AI Act obligation does. HR guide →
- The BNetzA route is structurally unusual. Most member states routed AI Act supervision through or alongside their data protection authority. Germany deliberately did not, which means your existing DPA relationship is not the relationship that matters here.
What does not depend on designation
The AI Act is a regulation. It applies directly and in full without national transposition. Member states designate authorities and set national penalty procedures: they do not create the obligations.
So none of this is waiting on a designation:
Article 50 disclosure, Article 4 literacy, Article 49 registration, classification and the Article 6(4) assessment are all live or actionable and none waits on a designation. Full checklist →
Status labels on this page
Verified fact: The Regulation applies directly without transposition; the Article 70 designation duty applied from 2 August 2025; the obligations listed above are independent of national designation.
Expert analysis: The assessment of what matters practically in an early enforcement conversation.
Unsettled: The current designation status in this member state. Sources conflict; verify against the Commission's published list.
Work on what does not depend on a regulator
Inventory, classification, Article 50 and Article 4 are all actionable today and none of them waits on a national designation. That is the work with no excuse attached to it.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
Who enforces the EU AI Act in Germany?
Germany's draft implementing law, the KI-Marktüberwachungs- und Innovationsförderungsgesetz or KI-MIG, designates the Bundesnetzagentur as the primary market surveillance authority, with sector authorities retaining competence in their fields, notably BaFin for high-risk AI linked to regulated financial activities. Sources differ on whether formal designation and notification to the Commission has been completed, which depends on the passage of the KI-MIG. Verify against the Commission's published list.
What is the KI-MIG?
The KI-Marktüberwachungs- und Innovationsförderungsgesetz is Germany's national framework for implementing the EU AI Act. The AI Act is a regulation and applies directly without transposition, but member states must designate competent authorities, establish market surveillance structures and set national penalty procedures. The KI-MIG does that for Germany. The federal cabinet adopted the draft on 11 February 2026.
What happens if this is not in order
Enforcement powers have applied since 2 August 2026. The AI Office can issue requests for information, evaluate models, interview staff and inspect premises. Three reporting channels are live: a public complaint tool, a whistleblower tool your own staff can use securely, and a complaints channel for downstream customers.
Penalties run to €35M or 7% for Article 5 prohibitions and €15M or 3% for other operator obligations including high-risk and Article 50. Separately, an incorrect or misleading reply to a request for information carries up to €7.5M or 1% — you can be substantively compliant and still penalised for how you answered. What is enforceable today →