AI Regulation Tracker / Legislation in force
Germany's KI-MIG Has Been in Force Since July 29, 2026, Making the Bundesnetzagentur the Lead AI Enforcer
This page previously stated that the KI-MIG was not yet in force, had not been promulgated, and still required Bundesrat action. That was written on July 8, 2026, before the Act was executed. It stopped being accurate once the Act was promulgated, and the page was not updated at the time. The Act was executed on July 22, 2026, promulgated in Bundesgesetzblatt 2026 Part I No. 223 on July 28, 2026, and entered into force on July 29, 2026 under its Article 5. This article has been rewritten throughout to reflect the law being in force and the enforcement structure it establishes.
Regulatory summary: Germany's law implementing the EU AI Act, which contains the KI-Marktueberwachungs- und Innovationsfoerderungsgesetz (KI-MIG), has been in force since July 29, 2026. It makes the Bundesnetzagentur Germany's lead AI market-surveillance authority and single point of contact, with BaFin covering financial-sector AI and the BfDI keeping data-protection oversight. It also creates a coordination centre for the AI Act at the BNetzA.
Germany now has a named AI enforcer. The Act making the Bundesnetzagentur the country's central AI market-surveillance authority was promulgated on July 28, 2026 and took effect the next day.
Key takeaways
- The Bundestag passed the KI-Marktueberwachungs- und Innovationsfoerderungsgesetz (KI-MIG) on June 11, 2026, as reported by secondary coverage. The bill designates the Bundesnetzagentur (BNetzA) as Germany's lead market-surveillance authority for AI and as the single national point of contact and complaints office. It assigns financial-sector AI supervision to BaFin and leaves data-protection oversight with the Federal Commissioner for Data Protection and Freedom of Information (BfDI).
- Any provider or deployer operating AI systems in Germany, including US-headquartered firms with German operations, plus banks, insurers, and other financial firms whose AI falls to BaFin.
- Status: In force since July 29, 2026.
- Draft an internal map of your German AI systems against the three authorities (BNetzA, BaFin, BfDI) so responsibilities are clear now that the law is in force.
Germany has taken a decisive step toward answering a question that has hung over the EU AI Act since it entered the statute books: who, inside each member state, actually enforces it. On June 11, 2026, according to secondary coverage of the vote, the Bundestag passed the KI-Marktueberwachungs- und Innovationsfoerderungsgesetz, known as the KI-MIG. The bill would install the Bundesnetzagentur, Germany's federal network agency, as the lead market-surveillance authority for artificial intelligence and as the single national point of contact and complaints office.
The measure is in force. Three dates matter and they are not the same date. The Act was executed (Ausfertigung) on July 22, 2026. It was promulgated (Verkuendung) in Bundesgesetzblatt 2026 Part I No. 223, issued at Bonn on July 28, 2026. Its Article 5 provides that the Act enters into force on the day after promulgation, which makes the commencement date July 29, 2026.
One citation warning if you go looking. The sponsoring ministry's own page links the promulgation using the text "BGBl. 2026 I Nr. 233". The gazette record and the first page of the official text both read Nr. 223, and the ministry's own link points at 223. Use 223.
What the bill would establish?
The core of the KI-MIG is an enforcement map. The Bundesnetzagentur, already the regulator for electricity, gas, telecommunications, post, and railways, would become the central authority for AI market surveillance in Germany. That makes it the body companies contact, the office that receives complaints, and the point of contact other EU authorities coordinate with on German matters. In practical terms, it concentrates responsibility in an established, well-resourced federal regulator rather than standing up an untested new agency, which is the choice several other member states have debated.
The title of the bill signals a second purpose beyond enforcement. The word Innovationsfoerderung, or innovation promotion, sits in the statute's name alongside market surveillance. That framing suggests German lawmakers want the same authority that polices AI to also support its development, a balance the country has emphasized as it implements the EU rules. How that dual mandate plays out in practice will depend on the resources and guidance that follow promulgation.
The bill does not hand the Bundesnetzagentur everything. Financial-sector AI would fall to BaFin, Germany's financial supervisory authority, reflecting the reality that AI used in banking, insurance, and securities sits inside an existing supervisory system. Data-protection oversight would remain with the Federal Commissioner for Data Protection and Freedom of Information, the BfDI. The result is a lead regulator with two important neighbors, rather than a single all-purpose AI agency.
What does it not do?
The KI-MIG does not create new substantive AI obligations. The duties themselves, on high-risk systems, transparency, and prohibited practices, come from the EU AI Act (Regulation (EU) 2024/1689), which applies across the bloc. What the German bill supplies is the institutional plumbing: which national authority polices those EU duties, where a complaint goes, and who speaks for Germany in the EU coordination structure. It is a governance and enforcement statute, not a new rulebook of prohibitions.
A note of caution on the record. The exact Bundestag document number (BT-Drucksache) for the KI-MIG could not be independently confirmed for this report, and the June 11 vote is drawn from secondary coverage rather than a primary parliamentary record verified here. Readers who need the citation for a compliance file should pull the BT-Drucksache and the Bundesrat schedule directly before relying on them.
The cross-border angle?
For a US firm with German AI operations, the KI-MIG matters because it tells you who will knock on the door. Once promulgated, it fixes the German enforcement structure a US company must map: the Bundesnetzagentur for most AI systems, BaFin if the system is financial, and the BfDI for data-protection questions. Germany is the EU's largest economy, so the choices it makes about AI enforcement carry weight for how the bloc's rules are applied in practice. A firm that already knows which of the three authorities owns each of its German AI use cases is in a better position than one still working out who its regulator is.
The posture has changed. The KI-MIG is binding law, so mapping each German AI use case to the authority that supervises it is no longer preparation for something ahead. Note also that the KI-MIG is Germany's national implementation and enforcement framework. Its commencement is a separate question from the EU AI Act's own application timeline, and the two should not be run together.
What the Act actually sets up
The structure below comes from the text of the Act as promulgated, not from summaries of it.
A coordination and competence centre for the AI Act, KoKIVO, is established at the Bundesnetzagentur. Its job is to support the other competent authorities in the tasks the AI Act gives them and to keep legal interpretation consistent on horizontal questions, so that AI expertise sits in one place rather than being rebuilt in every agency.
An AI market-surveillance chamber (KI-Marktueberwachungskammer) is created, and the Act draws an explicit boundary around it. Its tasks do not extend to reviewing the formal and substantive requirements, set out in Article 5(2) and (3) and Article 26(10) of the EU AI Act, that govern ordering the use of high-risk AI systems, nor to the use of those systems in individual cases. The Act states the carve-out. It does not say in that provision which body does hold that competence, and neither will we.
A central point of contact is designated for the purposes of Article 70(2) of the EU AI Act.
There is also an interim arrangement worth knowing about, and it involves two different European regulations, so read the numbers carefully. Until the market-surveillance authority required by Article 52(2) of the Cyber Resilience Act, Regulation (EU) 2024/2847, has been designated, the Bundesamt fuer Sicherheit in der Informationstechnik performs the notifying-authority task under Article 28(1) of the EU AI Act. Article 5, Article 26 and Article 70 above are AI Act articles. Article 52(2) is a Cyber Resilience Act article. They are different instruments.
The Act also builds in review of itself: the federal government must carry out a first evaluation of the supervisory and authority structure within 18 months of entry into force, and an effectiveness evaluation within three years.
One scoping note. The Act creates roles around the Bundesnetzagentur, but it does not make the BNetzA the only enforcer. Financial-sector AI supervision runs through BaFin, and data-protection oversight stays with the BfDI.
| Date | Jurisdiction | Rule | Affected professionals | Status or effective date |
|---|---|---|---|---|
| 2026-07-08 | Germany | The Bundestag passed the KI-Marktueberwachungs- und Innovationsfoerderungsgesetz (KI-MIG) on June 11, 2026, as reported by secondary coverage. The bill designates the Bundesnetzagentur (BNetzA) as Germany's lead market-surveillance authority for AI and as the single national point of contact and complaints office. It assigns financial-sector AI supervision to BaFin and leaves data-protection oversight with the Federal Commissioner for Data Protection and Freedom of Information (BfDI). | Any provider or deployer operating AI systems in Germany, including US-headquartered firms with German operations, plus banks, insurers, and other financial firms whose AI falls to BaFin. | In force. Executed July 22, 2026, promulgated in Bundesgesetzblatt 2026 Part I No. 223 on July 28, 2026, and in force since July 29, 2026 under Article 5. |
Frequently Asked Questions
What did the German Bundestag actually pass on June 11, 2026?
According to secondary coverage, it passed the KI-MIG, a bill that would make the Bundesnetzagentur Germany's lead AI market-surveillance authority and single point of contact. It has been in force since July 29, 2026.
Who does the KI-MIG affect?
Any provider or deployer of AI systems operating in Germany, including US firms with German operations. Financial-sector AI would be supervised by BaFin, and data-protection matters would stay with the BfDI.
Is the Bundesnetzagentur now enforcing AI rules in Germany?
Yes. The Act was promulgated on July 28, 2026 and entered into force on July 29, 2026, so the designation is active rather than proposed.
Does the KI-MIG create new AI obligations for my company?
No. The substantive duties come from the EU AI Act. The KI-MIG assigns which German authority enforces those duties and where complaints and the single point of contact sit.
Internal links
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.