Preparing for the EU AI Act in Germany

The short answer

The EU AI Act is an EU regulation, so its obligations apply in Germany without any German law needing to repeat them. What Germany had to decide was who enforces it. The KI-MIG, in force since 29 July 2026, settles that. For most organisations the Bundesnetzagentur is the authority. For banks, insurers and other financial firms it is BaFin for AI used in their regulated business.

The obligations land in stages, and several already apply. The practical work for a German organisation is the same as anywhere in the EU, with a German map of authorities and German data protection guidance on top.

What already applies

• Prohibited practices (since 2 February 2025). Uses such as social scoring, emotion recognition in the workplace and in education, and untargeted scraping of facial images are banned. The Digital Omnibus adds two more prohibitions from 2 December 2026, for AI used to generate non-consensual intimate content and child sexual abuse material.
• AI literacy (since 2 February 2025). Providers and deployers take measures to support the AI literacy of staff and others who operate AI on their behalf.
• Transparency (since 2 August 2026). People must be told when they are interacting with an AI system such as a chatbot, synthetic content must be marked, and deepfakes must be disclosed. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking.

Under the KI-MIG, the Bundesnetzagentur checks the transparency duties and the prohibitions within its remit, and BaFin does so for the firms it supervises.

What comes next

Obligations for high-risk systems listed in Annex III apply from 2 December 2027. They include AI used in recruitment and the management of workers, in education, for access to essential public services and benefits, for credit scoring of natural persons, and for risk assessment and pricing in life and health insurance. Deployers of high-risk systems must use them according to the instructions, assign competent human oversight, monitor them, keep logs and, in some cases, carry out a fundamental rights impact assessment. The deployer obligations guide sets these out.

Two German dates sit alongside. From 20 November 2026, BDSG section 37a sets new rules for credit and behaviour scoring, including banned data categories and a right to have a person decide. And section 19 of the KI-MIG requires the federal government to evaluate the supervisory structure after 18 months.

Who supervises you

• Most organisations. The Bundesnetzagentur, including for AI in HR, education and critical infrastructure.
• Banks, insurers and other listed financial firms. BaFin, for AI used in connection with their regulated activities.
• AI in products covered by EU product laws. The authority that already supervises those products, such as machinery or medical devices.
• High-risk AI in biometrics, law enforcement, migration and the administration of justice. The independent KI-Marktüberwachungskammer at the Bundesnetzagentur.
• AI used by state public bodies. The state’s own authority, or the Bundesnetzagentur on its behalf.

The Bundesnetzagentur also runs the central complaints office, so a complaint about any AI system starts there and is passed to the competent authority.

Where data protection fits

The AI Act does not displace the GDPR. In Germany the GDPR is supervised by the Federal Commissioner for Data Protection and Freedom of Information (BfDI) for federal bodies and some sectors, and by 16 state authorities for everyone else. Together they form the Datenschutzkonferenz (DSK).

On 6 May 2024 the DSK published its guidance Künstliche Intelligenz und Datenschutz, a checklist for organisations selecting, implementing and using AI applications, with a focus on large language models. It works through purpose, transparency duties, data subject rights and the accuracy of results. The KI-MIG requires the AI Act authorities to involve the data protection authorities, so a system that raises both kinds of question can expect both to be asked. The GDPR Article 22 page covers the rules on automated decisions.

A working approach

1. Find the AI you run. Include generative AI tools staff use and AI built into vendor products. The shadow AI guide covers the methods.
2. Register and classify. Record each system’s purpose, owner, your role as provider or deployer, and its risk tier. The high-risk classification guide helps with the borderline cases.
3. Check what applies now. Confirm no system falls under a prohibition, put transparency notices in place for chatbots and generated content, and run AI literacy measures for the people who use AI.
4. Map the authority. Note against each system whether the Bundesnetzagentur, BaFin or a sector authority supervises it.
5. Prepare high-risk systems for December 2027. Plan oversight, logging, monitoring and impact assessments, and make sure contracts give you what providers must supply.
6. Join it up with data protection. Link each system to its GDPR records and data protection impact assessment.

Aicura supports this work with discovery, the AI register, risk and impact assessments, policies, training and monitoring. It assesses against the EU AI Act from the Essentials plan, and against ISO/IEC 42001 and the NIST AI RMF from Pro. The decisions, and the dialogue with your authorities, stay with you.