Germany AI Regulation & Governance

KI-MIG, in force since 29 July 2026, designates the Bundesnetzagentur as the central AI Act market-surveillance authority, notifying authority and single point of contact in Germany, unless the Act provides otherwise.

Derived: Probable An AI Act Omnibus amendment, Regulation (EU) 2026/1744, postpones the Annex III high-risk AI system obligations from the original 2 August 2026 date to 2 December 2027, with the separate Annex I product-safety route applying from 2 August 2028.

Derived: Probable KI-MIG's §15 fine catalogue does not list Article 4 AI Act, so BNetzA cannot issue an administrative fine for breach of the AI-literacy obligation, although civil liability remains possible.

The Federal Network Agency (Bundesnetzagentur) is the market surveillance authority responsible for compliance with Regulation (EU) 2024/1689, unless the KI-MIG provides otherwise.

Derived: Probable The eight prohibited AI practices under Article 5(1) AI Act have applied since 2 February 2025, with BNetzA supervising compliance within its areas of competence.

Derived: Probable The prohibitions on unacceptable-risk AI practices under Article 5 of the AI Act have applied since 2 February 2025, per Article 113(3)(a).

Derived: Probable An AI Act Omnibus amendment, Regulation (EU) 2026/1744, postpones the Annex III high-risk AI system obligations from the original 2 August 2026 date to 2 December 2027, with the separate Annex I product-safety route applying from 2 August 2028.

Derived: Probable The high-risk obligations attached to Annex III use cases have been postponed under Regulation (EU) 2026/1744 and now apply from 2 December 2027.

Derived: Probable Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's whole lifecycle, under Article 9(1)-(2) of the AI Act.

Providers of high-risk AI systems under the EU AI Act must establish, implement, document and maintain a continuous, iterative risk-management system throughout the system's lifecycle.

Under KI-MIG §20(2), providers or their authorised representatives must register themselves and an Annex III No. 2 high-risk AI system in the national register before placing it on the market or putting it into service.

Obligations on providers of general-purpose AI models under Article 53, and additional obligations for GPAI models with systemic risk under Article 55, have applied since 2 August 2025.

As at 3 October 2026 no published enforcement case applying the Article 50 AI Act labelling duty, or a parallel German unfair-competition (UWG) claim, had been identified in Germany.

Article 50 of the AI Act applies from 2 August 2026; providers and deployers of AI systems must comply with the transparency obligations laid down in that provision from that date.

Section 90(1) no.3 of the Works Constitution Act requires an employer planning to use AI in the business to inform the works council in good time, submitting the necessary documents.

Derived: Probable Deployers of high-risk AI systems that are public authorities, or Union institutions, bodies, offices or agencies, must comply with the registration obligations in Article 49 of the AI Act.

Under KI-MIG §2(3), BaFin is the competent market surveillance authority for AI systems directly connected to a regulated financial activity carried out by BaFin-supervised institutions, displacing the Bundesnetzagentur's default competence for those systems.

Providers of high-risk AI systems under the EU AI Act must establish, implement, document and maintain a continuous, iterative risk-management system throughout the system's lifecycle.

Under KI-MIG §20(2), providers or their authorised representatives must register themselves and an Annex III No. 2 high-risk AI system in the national register before placing it on the market or putting it into service.

Under KI-MIG §7(1), Germany's competent market surveillance authority must, without delay, notify the European Commission and other EU Member States, via BAuA, of a non-conformity of an AI system that is not limited to Germany.

Derived: Probable Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's whole lifecycle, under Article 9(1)-(2) of the AI Act.

Providers of high-risk AI systems under the EU AI Act must establish, implement, document and maintain a continuous, iterative risk-management system throughout the system's lifecycle.

Under KI-MIG §20(2), providers or their authorised representatives must register themselves and an Annex III No. 2 high-risk AI system in the national register before placing it on the market or putting it into service.

KI-MIG, in force since 29 July 2026, designates the Bundesnetzagentur as the central AI Act market-surveillance authority, notifying authority and single point of contact in Germany, unless the Act provides otherwise.

Derived: Probable KI-MIG §15 creates a national administrative-offence regime, supplementary to Article 99 AI Act, with fines up to EUR 50,000 per breach for specified failures (e.g. under Articles 21, 27, 45 and 86 AI Act), and exempts public authorities from fines under both §15 and Article 99(3)-(5).

Derived: Probable KI-MIG's §15 fine catalogue does not list Article 4 AI Act, so BNetzA cannot issue an administrative fine for breach of the AI-literacy obligation, although civil liability remains possible.

As at 3 October 2026 no published enforcement case applying the Article 50 AI Act labelling duty, or a parallel German unfair-competition (UWG) claim, had been identified in Germany.

The Federal Network Agency (Bundesnetzagentur) is the market surveillance authority responsible for compliance with Regulation (EU) 2024/1689, unless the KI-MIG provides otherwise.

Derived: Probable For SMEs, including start-ups, each fine under Article 99 is capped at whichever of the fixed amount or percentage of turnover is lower, rather than the higher figure applying to larger undertakings.

Under Article 99(4) of the EU AI Act, operators found non-compliant with listed duties face fines up to EUR 15,000,000 or, for undertakings, up to 3% of total worldwide annual turnover, whichever is higher.

Under KI-MIG §7(1), Germany's competent market surveillance authority must, without delay, notify the European Commission and other EU Member States, via BAuA, of a non-conformity of an AI system that is not limited to Germany.

Under KI-MIG §2(1), the Bundesnetzagentur is Germany's default national market surveillance authority responsible for compliance with the EU AI Act, unless KI-MIG designates another authority.

Under KI-MIG §2(3), BaFin is the competent market surveillance authority for AI systems directly connected to a regulated financial activity carried out by BaFin-supervised institutions, displacing the Bundesnetzagentur's default competence for those systems.

Beyond Article 62(1)(a) of the AI Act, BNetzA also grants priority access to the AI sandbox (KI-Reallabor) to research institutions, universities and their spin-offs with a seat or branch in the EU.