Framework in place DE Verified 21 Oct 2026

Germany

EU AI Act implementation, 2026

Germany's KI-MIG (Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz) entered into force on 29 July 2026, making the Bundesnetzagentur the central AI market surveillance authority, single point of contact, complaints body and sandbox operator, with BaFin and other sector regulators keeping their fields.

Implementing law
EnactedJul 2026
Penalty regime (Art. 99)
Adopted
Regulatory sandbox
Planned
Readiness rank
5 of 27score 85 / 100

Key findings

  • The KI-MIG is in force since 29 July 2026, roughly a year after the 2 August 2025 designation deadline but before the 2 August 2026 application date for governance and penalties.
  • The Bundesnetzagentur is the central (residual) market surveillance authority, single point of contact (§ 6), complaints body and coordination centre; BaFin, the Landesmedienanstalten and product-sector authorities keep their domains.
  • National fine provisions exist (Part 5, §§ 15–16 KI-MIG) applying the Ordnungswidrigkeitengesetz, so the Article 99 penalty regime is operational in Germany.
  • A KI-Reallabor is mandated by § 13 and being built by BNetzA, but no operational sandbox was confirmed by October 2026.
  • Germany's model is hybrid rather than fully centralised, so operators in finance, media or harmonised product sectors must still identify their sector authority.

National authorities

Market surveillance

Bundesnetzagentur (BNetzA)

Central market surveillance authority with residual competence (§ 2(1) KI-MIG) for AI systems not covered by a specialist authority, including radio equipment, HR, critical infrastructure and education uses; monitors prohibited practices and transparency obligations within its remit; runs the coordination and competence centre.

bundesnetzagentur.de (opens in new tab)
Market surveillance

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Market surveillance for AI systems used by supervised financial institutions (Art. 74(6) AI Act).

bundesnetzagentur.de (opens in new tab)
Market surveillance

Landesmedienanstalten and other product-sector authorities

Hybrid model: in fully harmonised product areas and media, established federal and Land authorities remain responsible; Länder may use the Bundesnetzagentur via Organleihe.

bundesnetzagentur.de (opens in new tab)
Notifying authority

No single notifying authority: § 3 KI-MIG allocates Article 28 notifying functions to the authorities already acting as notifying authorities under Annex I harmonisation law (Länder for cableway installations); for Annex III point 1 (biometrics) the market surveillance authority to be designated under Art. 52(2) of the Cyber Resilience Act, with the BSI acting in the interim (per the government draft, Drucksache 21/4594)

dserver.bundestag.de (opens in new tab)
Single point of contact (Art. 70(2))

Bundesnetzagentur – Zentrale Anlaufstelle (§ 6 KI-MIG)

Implementing law, penalties and sandbox

Implementing law Enacted

Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG)

Jul 2026

gesetze-im-internet.de (opens in new tab)
Penalty regime Adopted

National rules on penalties under Article 99 have been laid down.

Regulatory sandbox Planned

§ 13 KI-MIG obliges the Bundesnetzagentur to establish and operate at least one KI-Reallabor (with a regulation-making power); BNetzA announced on 29 July 2026 that it is setting one up, aimed especially at SMEs. No operational sandbox cohort was confirmed as of October 2026. The Digital Omnibus moved the EU sandbox deadline to 2 August 2027.

bundesnetzagentur.de (opens in new tab)
National AI strategy

Strategie Künstliche Intelligenz der Bundesregierung (2018, updated 2020; KI-Aktionsplan 2023)

2018

bundesregierung.de (opens in new tab)

Notable developments

  1. Federal Cabinet adopts the KI-MIG government draft

    The Cabinet approved the Regierungsentwurf in February 2026 (published by BMDS; Bundestag printed paper 21/4594 of 9 March 2026), designating the Bundesnetzagentur as central market surveillance authority (§ 2(1)) and allocating notifying functions to existing sectoral notifying authorities (§ 3).

    dserver.bundestag.de (opens in new tab)

  2. Bundestag passes the KI-MIG

    The Bundestag adopted the law on 11 June 2026 in the version amended by the Digital Committee; the Bundesrat declined to call the mediation committee on 10 July 2026.

    lto.de (opens in new tab)

  3. KI-MIG enters into force; Bundesnetzagentur takes over AI supervision

    On 29 July 2026 the BNetzA announced that the KI-MIG was in force and that it now acts as market surveillance authority, central contact point, complaints body and coordination/competence centre, and is building a KI-Reallabor and a KI-Service Desk with a risk-class self-assessment tool.

    bundesnetzagentur.de (opens in new tab)

  4. Digital Omnibus on AI shifts high-risk deadlines

    Regulation (EU) 2026/1744, in force 27 July 2026, defers Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, giving the new German supervisory structure a longer run-in for high-risk enforcement.

    actuia.com (opens in new tab)

  5. Commission list still shows Germany as 'pending'

    The Commission's market surveillance authorities page (updated 7 September 2026) lists the Bundesnetzagentur for Germany but still marks the designation as pending, suggesting the formal notification had not yet been reflected.

    digital-strategy.ec.europa.eu (opens in new tab)

Analysis

Germany arrived late but arrived with a complete statute. After a change of government delayed the original 2024 plans, the Cabinet draft of February 2026 moved quickly through the Bundestag (11 June 2026) and Bundesrat (10 July 2026) and took effect on 29 July 2026, days before the AI Act's governance and penalty provisions began to apply. The law gives the Bundesnetzagentur a residual competence: it supervises wherever no specialist authority is designated, and runs the central contact point, the complaints desk and a coordination and competence centre to support the other authorities with difficult classification questions.

The choice of the Bundesnetzagentur over the data protection authorities was contested but has the merit of a single front door for most operators. The hybrid design nonetheless preserves BaFin for financial services and the Landesmedienanstalten for media, and leaves the Länder the option of lending their competence to the BNetzA. For companies, the practical message is that the BNetzA's KI-Service Desk and self-assessment tool are the first stop, but sector regulators remain the enforcers in harmonised product areas.

Two things remain to be seen. First, the sandbox: § 13 obliges the BNetzA to run at least one KI-Reallabor, but the detailed rules are left to a regulation and no cohort was running by October 2026; the Digital Omnibus has moved the EU deadline to August 2027, so this is not yet a breach. Second, enforcement culture: fines are channelled through the Ordnungswidrigkeitengesetz with first-instance review by the Amtsgerichte, and the agency's capacity to staff AI supervision at scale is untested. With high-risk obligations now deferred to December 2027, Germany has time to build that capacity before the heaviest obligations land.

PDF edition

EU AI Act 2026 Q3 Report

All 27 member-state profiles including Germany, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.

* You will also be subscribed to my newsletter. No spam, unsubscribe any time.

Sources

  1. Bundesnetzagentur (BNetzA) (opens in new tab) bundesnetzagentur.de
  2. Notifying authority: No single notifying authority: § 3 KI-MIG allocates Article 28 notifying functions to the authorities already acting as notifying authorities under Annex I harmonisation law (Länder for cableway installations); for Annex III point 1 (biometrics) the market surveillance authority to be designated under Art. 52(2) of the Cyber Resilience Act, with the BSI acting in the interim (per the government draft, Drucksache 21/4594) (opens in new tab) dserver.bundestag.de
  3. Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG) (opens in new tab) gesetze-im-internet.de
  4. Strategie Künstliche Intelligenz der Bundesregierung (2018, updated 2020; KI-Aktionsplan 2023) (opens in new tab) bundesregierung.de
  5. Bundestag passes the KI-MIG (opens in new tab) lto.de
  6. Digital Omnibus on AI shifts high-risk deadlines (opens in new tab) actuia.com
  7. Commission list still shows Germany as 'pending' (opens in new tab) digital-strategy.ec.europa.eu