The EU AI Act in Germany: KI-MIG and the Bundesnetzagentur

If your company operates in Germany, there are two layers to the EU AI Act: the Regulation itself (the same across the EU) and Germany's own implementing law, which decides who supervises you and how you get fined. Here is how the German picture fits together.

This is an information service to help you orient, not legal advice. For the obligations tied to your own AI use, see which apply to your company.

The Regulation applies directly — the German law fills the gaps

The EU AI Act is a Regulation (Regulation (EU) 2024/1689), which means it applies directly in every Member State without needing to be turned into national law. Your obligations, your risk tier, and your deadlines come straight from the EU text — and they are the same in Munich as in Madrid.

But the Regulation deliberately leaves two things to each Member State: naming the national authorities that supervise and enforce it, and setting the administrative-fine rules within the EU's ceilings. Germany does both through a dedicated implementation law.

The KI-MIG: Germany's implementation law

That law is the KI-MIG — the KI-Marktüberwachungs- und Innovationsförderungs-Gesetz, the AI Market Surveillance and Innovation Promotion Act. It designates the competent authorities, regulates their tasks and cooperation, and provides the framework for penalties.

The KI-MIG is in force. It was signed on 22 July 2026, published in the Federal Law Gazette as BGBl. 2026 I Nr. 223, and entered into force on 29 July 2026 — four days before the EU AI Act's general application date of 2 August 2026. Germany therefore had its supervisory architecture legally in place before enforcement began, which not every Member State managed.

The Bundesnetzagentur: the authority to know

Germany chose a hybrid supervisory model — no brand-new AI agency, but a strong central authority backed by sector-specific regulators. That central authority is the Bundesnetzagentur (Federal Network Agency). Section 2(1) of the KI-MIG names it as the market surveillance authority responsible for compliance with Regulation (EU) 2024/1689, and Section 6(1) makes it the single point of contact under Article 70(2) of the Regulation. It serves as:

• Market Surveillance Authority (MSA) — the body that supervises and enforces;
• Notifying Authority (NA) — overseeing the conformity-assessment bodies; and
• Single Point of Contact (SPoC) — Germany's coordination hub with the EU and other Member States.

For a company in Germany, that means the Bundesnetzagentur is the address for AI Act supervision — while your substantive obligations, and the fines' ceilings, still come from the EU Regulation.

What this means for you

• Your obligations don't change by being in Germany — they follow the EU Regulation, including the phased deadlines and the recent Digital Omnibus deferral of the high-risk dates.
• Your supervisor is the Bundesnetzagentur, and the KI-MIG sets how fines are applied within the EU penalty ceilings.
• Financial-sector AI brings BaFin into the picture alongside the Bundesnetzagentur, consistent with the Act's sectoral model.
• The supervisory architecture is settled — with the KI-MIG in force, the open question for German companies is no longer who supervises, but which obligations reach them and when.

The fastest way to see your own obligations: answer three questions about your AI use and we'll show the verified EU AI Act obligations that apply. To be told when a deadline moves or a new national law lands, join the waitlist.

The EU text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. Germany's implementing law is the KI-MIG, BGBl. 2026 I Nr. 223, in force since 29 July 2026. This article is an information service to help you orient — it is not legal advice.