The EU AI Act in Germany

Per Germany AI Act Implementation Law

• Bundesnetzagentur (Federal Network Agency) — Default national market surveillance authority; central contact point; host of KoKIVO and complaints office; operator of at least one KI‑reallabor (per draft).
• Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) — Market surveillance authority for high‑risk AI systems in direct connection with regulated financial activities.

Per Germany - Protection Against Deepfakes (222/24)

• Federal Ministry of Justice (Bundesministerium der Justiz) — Prepares government legislative positions, coordinates legal implementation and issues prosecutorial guidance.
• Bundesrat — Initiating body for BR-Drucksache 222/24; represents Länder positions in the federal legislative process.
• German Bundestag — Receives draft for legislative deliberation (BT-Drucksache 20/12605); committee review, hearings and final passage.

Per Germany - AI Action Plan 2023

• Federal Ministry of Education and Research (BMBF) — Lead publisher, funding authority and coordinator for measures in the Action Plan.
• Federal Government / National AI Strategy (KI-Strategie Deutschland portal) — Official hosting of national AI strategy documents and coordination hub.

Per Germany - AI Standardisation Roadmap

• DIN — Deutsches Institut für Normung (German Institute for Standardization) — Lead national standards body; co‑author and coordinator of the Roadmap; convenor of working groups and secretariat support.
• DKE — German Commission for Electrical, Electronic & Information Technologies of DIN and VDE — Co‑author and host for technical committees; publishes Roadmap PDFs and coordinates technical electrical engineering aspects.
• BMWK — Federal Ministry for Economic Affairs and Climate Action — Commissioning authority and political sponsor of the Roadmap; steers national priorities for AI standardisation.
• BSI — Federal Office for Information Security — National cybersecurity authority providing guidance and expertise on IT security and resilience aspects of AI systems.
• CEN/CENELEC JTC 21 / ISO/IEC technical committees — European and international standardisation fora responsible for delivering harmonised standards that operationalise legal requirements (relevant to the EU AI Act).

Per Germany - Law against Digital Violence

• Federal Ministry of Justice (Bundesministerium der Justiz, BMJ) — Policy owner, lead drafter and coordinator of the legislative process
• Federal Commissioner for Data Protection and Freedom of Information (BfDI) — Data-protection oversight and coordination for disclosure orders under GDPR
• Federal Network Agency (Bundesnetzagentur) — Technical/telecommunications coordination and possible technical monitoring for ISPs
• Federal Office of Justice (Bundesamt für Justiz) — Judicial administration support and registers where applicable

Per Germany - Participatory AI Labs

• Federal Ministry of Labour and Social Affairs (BMAS) — Funder and programme sponsor; sets objectives, funding envelope and communicates project outcomes
• Fraunhofer Institute for Industrial Engineering (IAO) — Implementing organisation, lead on procurement and operational delivery of KI-Studios
• Institute for Work Science and Technology Management (IAT), University of Stuttgart — Project implementation partner and research collaborator

Per Germany - Data Strategy (2021)

• Federal Chancellery (Bundeskanzleramt) — Coordination / high-level policy coordination and cross-ministerial oversight
• Federal Ministry for Digital and Transport (BMDV) — Policy lead / implementation partner for digital infrastructure, data spaces and public administration modernisation
• Federal Commissioner for Data Protection and Freedom of Information (BfDI) — Data protection oversight and advisor on privacy implications of Strategy measures

Per Germany - AI Observatory for Society

• Federal Ministry of Labour and Social Affairs (Bundesministerium für Arbeit und Soziales - BMAS) — Sponsor, political steering, host ministry
• KI-Observatorium / Denkfabrik Digitale Arbeitsgesellschaft — Project team and operational lead (observatory unit within BMAS)

Per Germany - National AI Strategy Update

• Federal Ministry for Economic Affairs and Climate Action (BMWK) — Lead coordinating ministry for AI funding, industrial policy and implementation of transfer/support measures.
• Federal Ministry of Education and Research (BMBF) — Responsible for research funding, competence centres and education/training measures.
• Federal Chancellery — Cabinet-level coordination and strategic oversight.
• Federal Commissioner for Data Protection and Freedom of Information (BfDI) — National data protection authority providing guidance and enforcement under GDPR for AI projects.
• Relevant sectoral regulators (e.g., BSI for cybersecurity, Federal Institute for Drugs and Medical Devices for health applications) — Sector-specific oversight, certification and enforcement where AI interacts with regulated domains.

Per Germany - National Multi-Stakeholder Platform

• Federal Ministry of Education and Research (BMBF) — Founding and funding authority; strategic oversight and policy addressee for platform recommendations.
• acatech – National Academy of Science and Engineering — Host and coordinator of the platform’s managing office (Geschäftsstelle); operational coordination and publication host.

Per Germany - Protection Against Deepfakes (222/24)

• General offence: imprisonment up to 2 years or monetary fines (as proposed in the draft).
• Aggravated offence (public dissemination or content concerning most intimate/private sphere): imprisonment up to 5 years or monetary fines.
• Confiscation and seizure of storage media and equipment in serious offences to preserve evidence and prevent re-offending.
• Civil-law remedies remain available to victims (injunctions, damages) under parallel legal regimes.

Per Germany - AI Action Plan 2023

• The Action Plan itself does not establish new legal penalties; non-compliance with grant terms is handled through standard public funding recovery and administrative procedures.
• Legal liability for deployed AI systems remains under applicable statutory law and sector-specific regulation (including EU-level instruments).

Per Germany - AI Standardisation Roadmap

• No direct statutory penalties are imposed by the Roadmap itself; it is a non‑binding strategic instrument.
• Non‑adoption of standards may result in market disadvantages (reduced interoperability, slower market access, competitive disadvantage) and potential non‑compliance with future regulatory obligations under the EU AI Act when harmonised standards are referenced.
• Conformity assessment and certification schemes derived from standards may create enforceable obligations and administrative penalties under sectoral or EU law when those standards are referenced in regulatory instruments.

Per Germany - Law against Digital Violence

• Enforcement of court orders via civil enforcement mechanisms (e.g., Ordnungsgelder or other coercive fines available under civil procedure) for non-compliant providers.
• Potential administrative fines or sanctions against providers for wilful or repeated non-compliance (details to be specified in subsequent draft bill).
• Civil liability exposure for providers who fail to secure evidence or obstruct judicial orders, enabling compensatory claims by victims.
• Expedited judicial remedies and reversal of improperly applied account suspensions through appeal and review procedures.

Per Germany - Participatory AI Labs

• Contractual remedies under public procurement and funding agreements, including requirement to repay misused funds or portion of grants.
• Termination or suspension of cooperation agreements for failure to meet deliverables, quality or reporting obligations.
• Exclusion from subsequent funding rounds or calls in case of serious non-compliance with procurement/funding rules.
• Civil liability for damages arising from demonstrator deployment or events (ordinary rules of tort/civil law).
• GDPR-related enforcement actions by competent supervisory authorities in case of data protection breaches.

Per Germany - Data Strategy (2021)

• The Strategy itself does not create new penalties; enforcement of privacy and unlawful data processing remains subject to the GDPR and the German Federal Data Protection Act (BDSG), including administrative fines and corrective measures by supervisory authorities.
• Misuse or unlawful disclosure in public-sector projects can result in administrative remedies, internal sanctions and judicial review under existing statutory frameworks.
• Any future legally binding measures developed to implement the Strategy will set out specific sanctions and administrative penalties at enactment.

Per Germany - AI Observatory for Society

• None — the KI-Observatorium is an advisory and monitoring project without statutory sanctioning power; non-compliance with its recommendations is not subject to direct penalties
• Any legal enforcement or penalties arising from specific AI deployments remain subject to existing German and EU law (e.g., GDPR, labour law, product liability rules)

Per Germany - National AI Strategy Update

• The Update itself does not create new criminal or administrative penalties; non-compliance with funding terms can trigger funding recovery (clawback) and contract penalties.
• Data protection breaches are subject to existing GDPR enforcement mechanisms and fines by supervisory authorities.
• Sector-specific liability and sanctions remain governed by applicable sector laws (health, transport, consumer protection).
• Failure to meet mandatory conditions in procurement or grant contracts may result in disqualification from programmes or future funding.

Per Germany - National Multi-Stakeholder Platform

• No statutory penalties imposed by PLS; non‑compliance results in no formal sanctions beyond reputational consequences.
• Funding or formal support from sponsoring ministries may be adjusted or withdrawn in line with funding agreements and administrative rules.
• Institutions or individuals may be subject to normal legal or contractual remedies under German law for breaches of contractual or statutory obligations (e.g., data protection violations under GDPR).