KI-MIG: who supervises artificial intelligence in Germany?

For a long time, Germany lacked a clear answer to a simple question: who actually enforces the EU AI Act here? Since 29 July 2026 there is a binding one: the national implementing act is in force and designates the Bundesnetzagentur as the central AI supervisor. Its core piece carries the abbreviation KI-MIG.

That ends a long standstill. We explain what the KI-MIG governs, who supervises what, which deadlines and fines apply, and what it means for regulated companies in construction, healthcare, law and finance.

What is the KI-MIG?

The KI-MIG is the "AI Market-Surveillance and Innovation-Promotion Act" — Article 1 of the "Act implementing Regulation (EU) 2024/1689". It transposes the EU AI Act into German law and mainly governs which authorities supervise AI in Germany. The Bundestag passed it on 11 June 2026 and the Bundesrat approved it on 10 July 2026; it was signed on 22 July 2026 and promulgated on 28 July 2026 in the Federal Law Gazette (BGBl. 2026 I No. 223) and has been in force since 29 July 2026 (statute text, in German).

An important framing: the KI-MIG is not a standalone law but the central article of an omnibus act. The EU AI Act, as a regulation, applies directly; but member states must organise national enforcement — designate authorities, set procedures, shape sanctions. That is exactly what the KI-MIG does. It does not create the substantive obligations anew; it creates the infrastructure through which those obligations are enforced in Germany.

This deliberately distinguishes the article from our deployer checklist on the Article 50 transparency duties: that one is about the EU level — which obligations apply from 2 August 2026. This one is about the national level — who supervises and enforces them.

Who supervises artificial intelligence in Germany?

The central body becomes the Bundesnetzagentur — as a market-surveillance and notifying authority and as a coordination and competence centre (KoKIVO). But "central" does not mean "exclusive": actual market surveillance partly stays with sectoral authorities, insofar as tasks are not assigned to other specialist authorities. For certain fundamental-rights-sensitive high-risk systems, an independent AI market-surveillance chamber is added on top.

The Bundestag's text archive puts it soberly: the Bundesnetzagentur will be designated "as the market-surveillance authority for compliance with the AI Regulation, insofar as this task is not assigned to other specialist authorities". The sharpened reading "central market-surveillance authority" that ran through many headlines — for example at heise online — captures the thrust, but obscures the hybrid model: product- and sector-specific supervision stays where the expertise already sits.

Enlarge image

The coordination and competence centre (KoKIVO)

Within the BNetzA, the KI-MIG establishes the Coordination and Competence Centre for the AI Regulation (KoKIVO). It bundles cross-authority expertise and coordinates the cooperation of the competent national market-surveillance and notifying authorities — so that horizontal legal questions are answered uniformly rather than each authority taking its own line.

The independent AI market-surveillance chamber

For certain — especially fundamental-rights-sensitive — high-risk AI systems, the KI-MIG provides for an independent, non-directable AI market-surveillance chamber at the BNetzA. It has three members chaired by the BNetzA president and oversees, among others, biometrics in law enforcement, border and migration control, and justice and democracy. This concerns only certain high-risk systems; the bulk stays with the specialist authorities. The obvious rationale — the fundamental-rights sensitivity of these applications — follows the logic of the EU regulation; as a verbatim statement of the Bundestag it is not documented.

AI service desk for companies

In addition, the Bundesnetzagentur runs an AI service desk as a contact point for companies — designed above all for small and medium-sized enterprises and start-ups that have questions about the classification, documentation and conformity of their AI systems. The service desk is a function of the BNetzA as a whole, not of the KoKIVO.

When does what apply? Deadlines and transition periods

The KI-MIG has been in force since 29 July 2026; the AI Act's governance layer — authority designation, Article 50 transparency duties, sanctions — has applied since 2 August 2026. The competent authorities are therefore in place. The substantive high-risk obligations they will police, by contrast, only apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) — as set by the Digital Omnibus explained below. The EU deadline for designating authorities — 2 August 2025 under Art. 70 of the AI Act — had long passed by then. Germany was thus around a year late; the government draft was only adopted by the cabinet on 11 February 2026.

Concretely, Art. 70(2) of the AI Act requires member states to make public by 2 August 2025 how their competent authorities and single points of contact can be reached electronically. This designation — what the KI-MIG now delivers — is part of the regulation's governance layer.

The Digital Omnibus postpones the high-risk obligations — not the supervision date

A common confusion is worth clearing up: the EU "Digital Omnibus on AI" — politically agreed on 7 May 2026, in force as Regulation (EU) 2026/1744 since 27 July 2026 (dated 8 July 2026, published 24 July 2026) — postpones the substantive high-risk obligations — for standalone systems (Annex III) to 2 December 2027, and for systems embedded in regulated products (Annex I) to 2 August 2028. The governance date of 2 August 2026 — authority designation, Article 50 transparency duties, sanction powers for general-purpose AI — remains unaffected. It is precisely this authority designation that the KI-MIG must deliver; it is not relieved by the Omnibus.

On procedure: the EU Parliament adopted the text on 16 June 2026 (423 in favour, 57 against, 174 abstentions); after the Council's adoption it was published in the Official Journal on 24 July 2026. The Omnibus mainly postpones deadlines and removes no obligation without replacement; it also adds new prohibitions (AI-generated intimate imagery without consent, child sexual abuse material) and recasts some detail rules, such as AI literacy under Art. 4.

Which fines apply — and who imposes them?

The KI-MIG itself sets only one national fine: up to 50,000 euros for certain breaches governed by the KI-MIG (§ 15) — including cooperation and information duties as well as a high-risk operator's duty to enable the affected person's explanation under Art. 86 of the AI Act. The well-known ceilings — up to 35 million euros or 7% of worldwide annual turnover, 15 million / 3%, 7.5 million / 1% — come directly from the EU AI Act (Art. 99), not from the German law. The confusion is widespread but costly in argument: "Germany imposes fines of up to 35 million euros" would simply be wrong.

Only the first row is set by the German KI-MIG itself; rows two to four are set directly by the EU AI Act (Art. 99). In practice this means: the nationally adjustable lever is small; the real risk sits in the directly applicable EU regulation.

Is the KI-MIG already in force?

Yes — since 29 July 2026. The Bundestag passed the law on 11 June 2026 — in the version amended by the Committee on Digital Affairs, with the votes of CDU/CSU and SPD, against the votes of AfD, Bündnis 90/Die Grünen and Die Linke. The Bundesrat approved it on 10 July 2026. The law was promulgated in the Federal Law Gazette on 28 July 2026 (BGBl. 2026 I No. 223) and, under Art. 5, entered into force on the day after promulgation, 29 July 2026; with that, the Bundesnetzagentur took on its role as market-surveillance authority, single point of contact and complaints body.

So Germany now has an AI supervision law — almost a year after the EU deadline, but in time for the transparency obligations that have applied since 2 August 2026. We keep this article's dateModified honest and recommend checking the current status before making binding decisions.

What does the KI-MIG mean for regulated companies?

For data-sensitive industries — construction, healthcare, law, finance — the KI-MIG mainly means two things: there are clearly addressable supervisory and contact bodies (Bundesnetzagentur, KoKIVO, AI service desk), and high-risk obligations demand documentation, traceability and auditability. Anyone running AI locally and traceably can produce exactly this evidence more easily.

That is not a coincidence but architecture. A grounded AI platform on your own hardware logs which data fed into an answer, keeps access permission-aware, and makes every use traceable in the audit trail — the technical evidentiary basis a market-surveillance authority will want to see in case of doubt. Anyone who also keeps data flows in-house (see Security & data sovereignty) reduces the attack surface and the number of places where documentation has to be created in the first place. This holds across industries — from construction to the clinic, where the same logic applies: sensitive data that must not leave the building.

To be clear: Lokalaise is an enabler, not legal or compliance advice. Whether and how your AI systems classify as high-risk and which obligations follow is something to clarify with your legal department and, where applicable, the competent authority.

Your next steps

Three questions help you situate your own position on the KI-MIG:

1. Classification: Do you know which of your AI systems might qualify as high-risk (Annex III) under the EU regulation — and thus fall under market surveillance in future?
2. Evidence: Can you demonstrate today which data fed into an AI answer, who had access, and how the system is configured?
3. Data sovereignty: Does sensitive data leave your premises for AI use — and if so, is that compatible with your documentation and confidentiality duties?

Where you hesitate, a closer look pays off. In a short demo we show you how a local, permission-aware AI delivers traceable answers — and records the evidence a future supervisor will want to see from the outset.