Reglog

← Guides & analysis

The EU AI Act in Germany: KI-MIG and the Bundesnetzagentur

· 3 min read

If your company operates in Germany, there are two layers to the EU AI Act: the Regulation itself (the same across the EU) and Germany's own implementing law, which decides who supervises you and how you get fined. Here is how the German picture fits together.

This is an information service to help you orient, not legal advice. For the obligations tied to your own AI use, see which apply to your company.

The Regulation applies directly — the German law fills the gaps

The EU AI Act is a Regulation (Regulation (EU) 2024/1689), which means it applies directly in every Member State without needing to be turned into national law. Your obligations, your risk tier, and your deadlines come straight from the EU text — and they are the same in Munich as in Madrid.

But the Regulation deliberately leaves two things to each Member State: naming the national authorities that supervise and enforce it, and setting the administrative-fine rules within the EU's ceilings. Germany does both through a dedicated implementation law.

The KI-MIG: Germany's implementation law

That law is the KI-MIG — the KI-Marktüberwachungs- und Innovationsförderungs-Gesetz, the AI Market Surveillance and Innovation Promotion Act. It designates the competent authorities, regulates their tasks and cooperation, and provides the framework for penalties.

Its status matters: as of mid-2026 the KI-MIG has been approved by the Federal Cabinet (February 2026) and passed the Bundestag, and it awaits Bundesrat approval, with completion expected during 2026. Until it is finalised, treat the details as a draft — but note the EU AI Act's own obligations apply regardless of when the German law lands.

The Bundesnetzagentur: the authority to know

Germany chose a hybrid supervisory model — no brand-new AI agency, but a strong central authority backed by sector-specific regulators. That central authority is the Bundesnetzagentur (Federal Network Agency), which under the draft is set to serve as:

  • Market Surveillance Authority (MSA) — the body that supervises and enforces;
  • Notifying Authority (NA) — overseeing the conformity-assessment bodies; and
  • Single Point of Contact (SPoC) — Germany's coordination hub with the EU and other Member States.

For a company in Germany, that means the Bundesnetzagentur is the address for AI Act supervision — while your substantive obligations, and the fines' ceilings, still come from the EU Regulation.

What this means for you

  • Your obligations don't change by being in Germany — they follow the EU Regulation, including the phased deadlines and the recent Digital Omnibus deferral of the high-risk dates.
  • Your supervisor is the Bundesnetzagentur, and the KI-MIG sets how fines are applied within the EU penalty ceilings.
  • Track the KI-MIG's final passage — the authority architecture and fine details firm up once the Bundesrat approves it.

The fastest way to see your own obligations: answer three questions about your AI use and we'll show the verified EU AI Act obligations that apply. To be told when the German law is finalised or an EU deadline moves, join the waitlist.

The EU text is Regulation (EU) 2024/1689; Germany's implementing law is the KI-MIG (in the legislative process as of mid-2026). This article is an information service to help you orient — it is not legal advice, and you should confirm the German law's current status against the official source before acting.

Frequently asked questions

Which authority enforces the EU AI Act in Germany?

The Bundesnetzagentur (Federal Network Agency). Under Germany's draft implementation law it is designated as the central market surveillance authority, the notifying authority, and the single point of contact — supplemented by sector-specific regulators in a hybrid model. A dedicated coordination and advisory structure sits alongside it.

What is the KI-MIG?

The KI-MIG (KI-Marktüberwachungs- und Innovationsförderungs-Gesetz — the AI Market Surveillance and Innovation Promotion Act) is Germany's national law implementing the EU AI Act. It designates the competent authorities, sets out their tasks and cooperation, and provides the framework for administrative fines. As of mid-2026 it has been approved by the Federal Cabinet and passed the Bundestag, and awaits Bundesrat approval; confirm its final status before relying on it.

Does the EU AI Act apply directly in Germany, or does Germany need its own law?

Both are true. The AI Act is an EU Regulation, so its obligations, risk tiers, and deadlines apply directly in Germany without transposition. But the Regulation leaves each Member State to designate its national authorities and set its penalty rules — and that is what the KI-MIG does for Germany.

Is the German AI implementation law in force yet?

Not fully, as of mid-2026. The KI-MIG passed the Bundestag and is awaiting Bundesrat approval, with completion expected during 2026. The EU AI Act's own obligations already apply regardless — the KI-MIG determines who supervises and enforces them in Germany.

See which obligations apply to your company → or join the waitlist

This is an information service, not legal advice.