Frameworks · Germany

AI governance frameworks and AI regulation in Germany

Germany governs AI through EU law applied by national authorities. The EU AI Act and the GDPR apply directly, and the KI-MIG has made the Bundesnetzagentur the central AI Act authority since 29 July 2026, with BaFin covering AI at financial firms. German law adds rules on credit and behaviour scoring in the BDSG, and BaFin and the data protection authorities publish guidance on AI. These are the German instruments, with the EU and international frameworks most organisations build on.

Who regulates AI here

BundesnetzagenturThe central market surveillance authority, single point of contact and complaints office for the EU AI Act in Germany under the KI-MIG, which runs the KI-Service Desk and is setting up Germany's AI regulatory sandbox.
Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)Supervises banks, insurers and other financial firms, and is AI Act market surveillance authority for AI used in connection with their regulated activities, including credit scoring and life and health insurance pricing.
Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)The federal data protection authority, which supervises the GDPR for federal public bodies and some sectors, alongside the 16 state data protection authorities.
Datenschutzkonferenz (DSK)The conference of Germany's federal and state data protection authorities, which publishes joint guidance such as its guidance on AI and data protection.
Bundesamt für Sicherheit in der Informationstechnik (BSI)Germany's federal cyber security agency, and the interim notifying authority under the KI-MIG for conformity assessment of high-risk biometric AI systems.

Germany

Germany applies the EU AI Act through the KI-MIG, with the Bundesnetzagentur as central authority and BaFin for financial firms, and adds national rules on credit and behaviour scoring.

LawKI-MIGKI-MIG, Germany's AI Act implementation lawThe KI-MIG names Germany's EU AI Act authorities, from the Bundesnetzagentur to BaFin, and sets their powers, the AI sandbox and national fines.In force since 29 July 2026 LawBDSG section 37aBDSG section 37a and scoring in GermanyFrom 20 November 2026, BDSG section 37a governs credit and behaviour scores in Germany. Banned data, explanations and the right to a human decision.Adopted May 2026, applies from 20 November 2026 Regulator guidanceBaFin AI ICT guidanceBaFin guidance on ICT risks in the use of AI at financial entitiesBaFin's guidance on ICT risks of AI explains how DORA applies to AI at German banks and insurers, from governance and testing to cloud and incidents.Published December 2025, non-binding

All Germany frameworks

European Union

The EU AI Act sets risk-based obligations for AI placed on the EU market or used in the EU, alongside the GDPR's rules on automated decisions.

LawEU AI ActEU AI Act (Regulation (EU) 2024/1689)The EU AI Act sets risk-based rules for AI used in the EU. What it requires of providers and deployers, and the dates as amended by the 2026 Digital Omnibus.In force, applying in stages to 2028In Aicura from Enterprise LawGDPR Article 22GDPR Article 22 and automated decision-makingGDPR Article 22 limits solely automated decisions with legal or similarly significant effects. Who it applies to, the exceptions, safeguards and AI duties.In force since May 2018, amendment proposed Voluntary frameworkGPAI Code of PracticeGeneral-Purpose AI Code of PracticeThe EU GPAI Code of Practice is how model providers show they meet AI Act duties on transparency, copyright and systemic risk. What it covers and who signs.Published July 2025, in use Voluntary frameworkTrustworthy AI and ALTAIEthics Guidelines for Trustworthy AI and the Assessment List (ALTAI)The EU's Ethics Guidelines for Trustworthy AI set seven requirements, and ALTAI turns them into a self-assessment checklist. What they cover and who uses it.Published 2019 and 2020, voluntary

All European Union frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from Pro StandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current edition Voluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from Pro Voluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024 StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current edition StandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current edition Voluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024 Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-binding LawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in force Voluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 live Voluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Questions

Does Germany have an AI law?

Germany applies the EU AI Act, which is directly binding, and has its own implementing law, the KI-MIG (Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz). The KI-MIG has applied since 29 July 2026. It names the supervising authorities and sets their powers, the sandbox and some national fines, and adds no new obligations for AI systems beyond the AI Act.

Who enforces the EU AI Act in Germany?

The Bundesnetzagentur is the default market surveillance authority, single point of contact and complaints office. BaFin covers AI used in connection with regulated financial activities, sector authorities keep their product areas, an independent chamber at the Bundesnetzagentur covers sensitive areas such as law enforcement and migration, and the federal states cover AI used by their own public bodies.

What changes for credit scoring in Germany in November 2026?

From 20 November 2026 the new section 37a of the Federal Data Protection Act (BDSG) replaces section 31. It bars scores built on special category data, age, gender, name, social network data, bank account flows or address data, excludes minors, requires explanations of the main factors on request and gives people the right to contest a score-based decision and have a person decide.

Does BaFin have rules on AI?

Not a separate rulebook. BaFin published non-binding guidance on ICT risks in the use of AI in December 2025, which explains how DORA's requirements apply to AI systems at banks and insurers. Under the KI-MIG it is also the AI Act market surveillance authority for AI used by the financial firms it supervises.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.