KI-MIG, Germany's AI Act implementation law

What it is

The Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz, known as the KI-MIG, is the German law that puts the EU AI Act into practice. The AI Act is an EU regulation and applies directly in Germany. What it leaves to member states is who supervises it, with what powers, and how innovation is supported. The KI-MIG answers those questions.

The law was signed on 22 July 2026, published in the Federal Law Gazette as Article 1 of BGBl. 2026 I Nr. 223, and entered into force on 29 July 2026. On that day the Bundesnetzagentur took up its role as Germany’s central AI Act authority.

Who supervises what

Section 2 sets out a hybrid model. A central authority covers the ground no one else covers, and existing regulators keep the sectors they know.

• Bundesnetzagentur. The default market surveillance authority under section 2(1). Its own press release names personnel management, critical infrastructure and education as examples of the sensitive areas it covers, along with transparency duties and prohibited practices within its remit.
• Sector authorities. Under section 2(2), the authorities responsible for the product laws in Annex I Section A of the AI Act also supervise AI in those products.
• BaFin. Under section 2(3), BaFin supervises AI systems used in direct connection with regulated financial activities by a list of financial entities, including credit institutions, insurers, pension funds and crypto-asset service providers.
• KI-Marktüberwachungskammer. Section 4 sets up an independent chamber at the Bundesnetzagentur, chaired by its president, for high-risk systems in biometrics, law enforcement, migration and the administration of justice (Annex III points 1, 6, 7 and 8). It reports to the Bundestag each year.
• The federal states. State authorities cover AI used by their own public bodies and by media service providers. A state can ask the Bundesnetzagentur to supervise on its behalf.

The Bundesnetzagentur is also the single point of contact under section 6 and runs the central complaints office under section 8, which receives complaints and passes them to the competent authority. Section 5 sets up a coordination and competence centre, the KoKIVO, which supports the other authorities with expertise, coordinates horizontal legal questions and provides training and guidance.

Section 9 requires the authorities to cooperate, naming the federal and state data protection authorities and the Bundeskartellamt among the bodies to involve. Section 3 makes the Federal Office for Information Security (BSI) the interim notifying authority for high-risk biometric systems.

What it requires

The KI-MIG does not add duties for AI systems. An organisation still works from the AI Act. It must know which of its systems are prohibited, high-risk or subject to transparency duties, and meet the obligations that go with each role. The law matters in four practical ways.

It tells you who will ask. For most organisations the Bundesnetzagentur is the authority. For banks and insurers it is BaFin for AI in their regulated business, and the Bundesnetzagentur for systems such as HR tools.

It adds national fines. Section 15 makes it an administrative offence to fail to provide information, documentation, access or risk assessments the authorities request, and for certain deployers of high-risk systems to fail to give the explanation required by Article 86(1). Fines are up to €50,000. The AI Act’s own fines apply on top.

It sets up the sandbox. Section 13 requires the Bundesnetzagentur to run at least one AI regulatory sandbox, with research institutions and universities given priority access. Section 14 deems approval of a real-world testing plan for a high-risk system granted if the authority does not answer within 30 days.

It creates a register. Section 20 has the Bundesnetzagentur keep a non-public register of high-risk systems in critical infrastructure (Annex III point 2).

Key dates

• 22 July 2026. KI-MIG signed into law.
• 29 July 2026. KI-MIG enters into force and the Bundesnetzagentur takes up its role.
• 2 August 2026. General application of the AI Act, including the Article 50 transparency duties.
• 2 December 2027. Obligations for Annex III high-risk systems apply, as amended by the Digital Omnibus.

Section 19 requires the federal government to evaluate the structure after 18 months and again after three years.

How it relates to other frameworks

The KI-MIG is the national layer on top of the EU AI Act. The GDPR applies alongside it, enforced by the federal and state data protection authorities, and from 20 November 2026 the new BDSG section 37a adds German rules for scoring. Banks and insurers also manage AI as an ICT risk under DORA, which BaFin explains in its guidance on ICT risks of AI.

Organisations that structure their AI governance on ISO/IEC 42001 or the NIST AI RMF will find most of the records the AI Act asks for, such as an inventory, risk assessments and human oversight arrangements, already part of that work.

A note on this page

This is Aicura’s reading of the KI-MIG. It is not legal advice and it is not the Act itself. Read the text published on gesetze-im-internet.de, and take advice on how it applies to your organisation.