What happened
Germany's AI Market Surveillance and Innovation Promotion Act (KI-Marktüberwachungs- und Innovationsförderungsgesetz, 'KI-MIG') entered into force on 29 July 2026, as announced by the Bundesnetzagentur (Federal Network Agency). The law designates the Bundesnetzagentur as Germany's central AI market surveillance authority and single national point of contact for the EU AI Act and the EU AI Office. BaFin retains authority over financial-sector AI (credit scoring, bank chatbot disclosure), and BfDI covers data protection oversight. The Bundesnetzagentur can now monitor compliance, investigate violations, and issue fines up to €35 million or 7% of global annual turnover for the most serious prohibited-practice violations.
Why it matters
This is Germany's national implementing framework for the EU AI Act's enforcement architecture — one of the largest EU economies now has an operational, funded regulator with real investigative and fining powers over AI systems placed on the German market. It fills a critical gap: as of June 2026 only 9 of 27 EU member states had designated competent national AI Act authorities, so Germany's activation of a fully resourced regulator is a template other member states will be measured against, and materially raises enforcement risk for any AI deployer operating in or targeting the German market.
Action needed
Companies with AI systems available on the German market should map their systems against KI-MIG's supervisory structure, identify whether Bundesnetzagentur, BaFin, or BfDI has jurisdiction over their use case, update internal compliance and complaint-response procedures, and prepare for the EU AI Act's general application deadline of 2 August 2026 alongside this new German enforcement layer.