Germany AI Act Implementation Law

Overview

The Act on the Implementation of the Artificial Intelligence Regulation (KI-MIG), officially known as the Gesetz zur Durchführung der Verordnung (EU) 2024/1689 des Europäischen Parlaments und des Rates vom 13. Juni 2024 zur Festlegung harmonisierter Vorschriften für künstliche Intelligenz und zur Änderung der Verordnungen (EG) Nr. 300/2008, (EU) Nr. 167/2013, (EU) Nr. 168/2013, (EU) 2018/858, (EU) 2018/1139 und (EU) 2019/2144 sowie der Richtlinien 2014/90/EU, (EU) 2016/797 und (EU) 2020/1828, represents Germany's national legislative framework for the enforcement and supplementary provisions of the European Union's Artificial Intelligence Act (EU AI Act). Passed by the Bundestag on June 11, 2026, this Act is crucial for establishing a coherent and effective regulatory environment for AI systems within Germany. Its primary objective is to ensure the robust application of the directly applicable EU AI Act, particularly concerning market surveillance, innovation promotion, and the protection of fundamental rights. The KI-MIG aims to create legal certainty for both developers and users of AI, fostering an innovation-friendly yet responsible approach to AI technology.

The KI-MIG addresses the need for national implementing measures, as the EU AI Act, while directly applicable, requires member states to designate competent authorities, establish national enforcement mechanisms, and define penalty regimes. The German government's approach, as embodied in the KI-MIG, focuses on leveraging existing administrative structures where possible to avoid bureaucratic redundancy and ensure efficiency. A central aspect of the Act is the designation of the Bundesnetzagentur (Federal Network Agency) as the primary market surveillance authority for AI systems, alongside the establishment of a dedicated Koordinierungs- und Kompetenzzentrum (Coordination and Competence Centre) and an independent AI Market Surveillance Chamber. This structured approach is designed to provide clear points of contact for businesses and citizens, streamline oversight, and support the development and testing of innovative AI applications through regulatory sandboxes.

Definitions

While the KI-MIG primarily relies on the definitions provided within the overarching EU AI Act, it implicitly adopts and contextualizes these terms for the national German legal framework. Key terms such as 'AI system,' 'high-risk AI system,' 'provider,' and 'deployer' are understood in accordance with their definitions in EU Regulation 2024/1689. The German Act focuses on establishing the procedural and institutional mechanisms necessary for the practical application of these definitions, rather than redefining them. For instance, the classification of an AI system as 'high-risk' under the EU AI Act directly triggers specific obligations and oversight mechanisms detailed within the KI-MIG, particularly concerning conformity assessment, risk management, and human oversight.

The Act also clarifies national specificities related to these definitions, especially concerning the scope of application for different types of entities operating within Germany. It delineates responsibilities for various actors, from those developing and placing AI systems on the market to those deploying them in specific contexts. Furthermore, the KI-MIG addresses how existing German legal concepts, such as those related to administrative offences and liability, interact with the EU AI Act's framework. It ensures that the interpretation and application of AI-related terminology are consistent with broader German legal principles while adhering to the harmonized standards set by the EU. This dual approach aims to prevent regulatory gaps and ensure a comprehensive understanding of AI-related obligations across the national landscape.

Governance and Institutional Framework

A cornerstone of the KI-MIG is the establishment of a robust governance and institutional framework designed to effectively implement and enforce the EU AI Act in Germany. The Federal Network Agency (Bundesnetzagentur – BNetzA) has been designated as the central market surveillance authority for AI systems. This pivotal role grants the BNetzA far-reaching powers to monitor compliance, conduct investigations, and take necessary enforcement actions. To support its functions, the Act mandates the creation of a Koordinierungs- und Kompetenzzentrum für die KI-Verordnung (KoKIVO) within the BNetzA. KoKIVO's mandate includes bundling AI expertise, ensuring a uniform interpretation of the EU AI Act across different authorities, and serving as a central point of contact for businesses and citizens seeking guidance or wishing to report potential violations.

In addition to the BNetzA's central role, the KI-MIG establishes an independent AI Market Surveillance Chamber within the Federal Network Agency, specifically tasked with overseeing certain high-risk AI systems, particularly those in sensitive areas like law enforcement, border management, justice, and democratic processes. While the BNetzA acts as the primary authority, the Act also acknowledges and integrates existing sector-specific regulatory bodies. For instance, the Federal Financial Supervisory Authority (BaFin) retains supervisory competence for AI systems used in the financial sector, and regional authorities will oversee certain public applications. This multi-layered approach ensures that specialized expertise is utilized where appropriate, while the BNetzA provides overarching coordination and a unified national stance on AI regulation. The Act also establishes a central complaints office within the BNetzA, allowing citizens to report potential breaches of the AI Act, which will then be forwarded to the relevant competent authorities.

Key Focus Areas

The KI-MIG reinforces the risk-based approach central to the EU AI Act, categorizing AI systems based on their potential to cause harm and imposing corresponding obligations. A significant focus is placed on high-risk AI systems, which are subject to stringent requirements concerning conformity assessment, quality management, technical documentation, human oversight, and cybersecurity. The Act details the national procedures for ensuring these requirements are met, including the roles of notified bodies and the market surveillance activities of the BNetzA. It also addresses prohibited AI practices, ensuring that systems deemed to pose an unacceptable risk to fundamental rights are not deployed in Germany. The aim is to strike a balance between fostering innovation and safeguarding societal values and individual freedoms.

Transparency and fundamental rights protection are also key areas of emphasis within the KI-MIG. The Act outlines national provisions for enforcing the transparency obligations of the EU AI Act, requiring providers and deployers of certain AI systems to inform users when they are interacting with an AI or when content is AI-generated. Furthermore, the KI-MIG explicitly links the implementation of AI regulation to the protection of fundamental rights, including non-discrimination, privacy, and data protection. It ensures that the deployment of AI systems respects the principles enshrined in the German Basic Law and the Charter of Fundamental Rights of the European Union, particularly when AI is used in sensitive contexts such as public services, employment, or law enforcement. The establishment of a central complaints office underscores the commitment to providing effective redress mechanisms for individuals whose rights may be affected by AI systems.

Implementation Framework

The implementation framework articulated in the KI-MIG is designed to seamlessly integrate the directly applicable provisions of the EU AI Act into the existing German legal and administrative landscape. The Act specifies the necessary adjustments to national laws and codes to ensure consistency and avoid conflicts, particularly in areas such as administrative procedures, data protection, and consumer protection. It clarifies how national authorities will cooperate with each other and with European institutions to ensure a harmonized application of the AI Act. This includes defining the procedures for reporting non-conformities, managing risks, and facilitating communication with the European Commission and other Member States.

A critical component of the implementation framework involves the establishment of clear procedural guidelines for market surveillance, conformity assessment, and the notification of AI systems. The KI-MIG empowers the BNetzA to develop and issue specific guidance and technical standards to assist businesses, especially small and medium-sized enterprises (SMEs) and startups, in complying with the new regulations. Furthermore, the Act promotes innovation through the creation of AI real-world laboratories (regulatory sandboxes), which provide a controlled environment for testing innovative AI systems under real-world conditions. These sandboxes are intended to reduce regulatory burdens for innovators while ensuring that safety and ethical standards are maintained, thereby fostering the development of trustworthy AI in Germany.

Monitoring and Evaluation

The KI-MIG includes provisions for ongoing monitoring and evaluation of its effectiveness and the broader impact of AI regulation in Germany. This commitment to continuous assessment is crucial for adapting the regulatory framework to rapidly evolving AI technologies and market dynamics. The Act mandates that the Koordinierungs- und Kompetenzzentrum (KoKIVO) within the BNetzA will play a significant role in collecting data, analyzing trends, and reporting on the implementation of the EU AI Act and the KI-MIG. This includes monitoring the performance of AI systems on the market, identifying emerging risks, and assessing the overall compliance landscape across various sectors. The insights gathered from these monitoring activities will inform future policy adjustments and ensure that the regulatory approach remains agile and responsive.

A key feature of the monitoring and evaluation framework is the planned two-stage evaluation of the KI-MIG itself. The Act stipulates that the first evaluation will take place no later than 18 months after its entry into force, with a second, more comprehensive evaluation scheduled for no later than three years after its entry into force. These evaluations will assess whether the Act's objectives—such as effective market surveillance, promotion of innovation, and protection of fundamental rights—are being met. They will also examine the efficiency of the established institutional structures, the impact on businesses, and the consistency of enforcement across federal states. This structured evaluation process underscores the German government's commitment to a dynamic regulatory approach that can be refined based on practical experience and evolving technological landscapes.

Penalties, Liability, and Appeals

To ensure robust enforcement of the EU AI Act and the national implementing provisions, the KI-MIG establishes a clear framework for penalties, liability, and appeal mechanisms. The Act outlines specific administrative offences and the corresponding fines for non-compliance with the obligations set forth in the EU AI Act and the KI-MIG. These fines can be substantial, reflecting the seriousness of potential harms caused by non-compliant AI systems. For instance, administrative offences can be punished with fines of up to EUR 50,000, with higher penalties for more severe breaches as stipulated by the EU AI Act itself. The Act also clarifies that the EU law provisions on fines under Article 99(3) to (5) AI Act apply within the framework of national proceedings, with the Act on Regulatory Offences applying accordingly.

Furthermore, the KI-MIG designates the Bundesnetzagentur not only as a market surveillance authority but also as the central complaints office for AI violations. This provides a clear and accessible avenue for citizens and other stakeholders to report potential infringements of the AI Act. Complaints lodged with the BNetzA will be forwarded to the relevant competent market surveillance authorities or other affected authorities for investigation and action. The Act also ensures that individuals and entities subject to enforcement actions or penalties have the right to appeal these decisions through established administrative and judicial procedures, thereby upholding principles of due process and legal certainty. The detailed provisions on penalties and appeals are designed to create a strong deterrent against non-compliance and provide effective redress mechanisms.

Relationship to Other Instruments

The KI-MIG operates in a complex regulatory landscape and explicitly defines its relationship to other pertinent legal instruments, both at the European and national levels. As an implementing act, its primary function is to complement and facilitate the enforcement of the EU AI Act (Regulation (EU) 2024/1689), which is directly applicable in all Member States. The KI-MIG does not alter the substantive obligations of the EU AI Act but rather establishes the institutional and procedural foundations for its effective application in Germany, particularly concerning the designation of competent authorities, market surveillance, and the administrative fines regime. This ensures a consistent application of the EU's harmonized rules while allowing for national specificities in enforcement.

The Act also clarifies its interaction with other crucial legal frameworks, such as the General Data Protection Regulation (GDPR). The GDPR retains its full validity, and the KI-MIG ensures that data protection principles remain paramount in the development and deployment of AI systems. This means that AI systems must comply with both the AI Act's requirements and the GDPR's provisions on personal data processing, including consent, data subject rights, and data security. Additionally, the KI-MIG addresses interfaces with existing sector-specific laws and regulations, ensuring that AI systems used in regulated areas like financial services (e.g., supervised by BaFin) or medical devices continue to adhere to their respective specialized legal frameworks. This layered approach prevents regulatory gaps and ensures comprehensive oversight across various domains where AI is deployed.

International Alignment

Germany's KI-MIG is inherently aligned with international efforts to regulate artificial intelligence, primarily through its direct implementation of the EU AI Act. By transposing the European regulation into national law, Germany contributes to a harmonized approach to AI governance across the European Union, fostering a single market for trustworthy AI. The Act ensures that Germany's regulatory framework is consistent with the principles and obligations established at the EU level, promoting cross-border cooperation and mutual recognition of conformity assessments. This alignment is crucial for German companies operating within the EU and for attracting international investment in AI innovation.

Beyond the EU, the KI-MIG implicitly supports broader international dialogues on AI governance. By establishing clear regulatory standards and promoting responsible AI development, Germany positions itself as a leader in shaping global norms for AI. The Act's provisions for market surveillance, transparency, and fundamental rights protection contribute to the development of internationally recognized best practices. Furthermore, the emphasis on innovation support, through initiatives like AI real-world laboratories, aims to enhance Germany's competitiveness in the global AI landscape while adhering to high ethical and safety standards. This dual focus on robust regulation and innovation positions Germany to play a constructive role in multilateral discussions on AI policy and cooperation.

Implementation Timeline

Sources and References