Germany KI-MIG
Gesetz zur Durchführung der Verordnung (EU) 2024/1689 (KI-Marktüberwachungs- und Innovationsförderungsgesetz — KI-MIG)
German national law implementing the EU AI Act, designating the Bundesnetzagentur (BNetzA) as the lead market surveillance authority under a centralized hybrid model.
Jurisdiction
Germany
Enacted
Jul 22, 2026
Effective
Jul 29, 2026
Enforcement
Bundesnetzagentur (BNetzA) as lead market surveillance authority; BfDI for data protection aspects; sector regulators retain competence in their domains.
Passed Bundestag June 11, 2026; passed Bundesrat June 19, 2026; enacted July 22, 2026; published in Bundesgesetzblatt I, Nr. 223 on July 28, 2026; entered into force July 29, 2026.
Bundesministerium für Digitales und Staatsmodernisierung (BMDS)Why It Matters
Germany's centralized hybrid approach — concentrating AI market surveillance in a single federal agency (BNetzA) — contrasts with distributed models in other EU states and will shape enforcement posture across the bloc's largest economy.
Recent Developments
Entered into force July 29, 2026, days ahead of the EU AI Act's August 2, 2026 deadline for Member States to designate market surveillance authorities. Bundesnetzagentur formally confirmed as lead authority (bundesnetzagentur.de press release July 29, 2026).
At a Glance
Harms addressed
Who Must Comply
- Providers, deployers, importers, and distributors of AI systems placing products on or using AI systems in the German market
Safety Provisions
- Designates BNetzA as central market surveillance authority for AI
- Establishes national competent authorities and AI innovation support
- Procedural framework for risk-based oversight aligned with EU AI Act
- Support for regulatory sandboxes and SME innovation
Compliance & Enforcement
Penalties
€50K
View on map
Germany
Focus Areas
Cite This
APA
Germany. (2026). Gesetz zur Durchführung der Verordnung (EU) 2024/1689 (KI-Marktüberwachungs- und Innovationsförderungsgesetz — KI-MIG).
Related Regulations
Italy D.Lgs. 179/2026
Second of the two legislative decrees implementing Italy's AI law (Law 132/2025). It designates the national authorities under the EU AI Act, sets national administrative fines for AI Act breaches, creates the Italian AI regulatory sandbox, and adds rules on AI in schools, work, the professions, health and public administration, including a bar on employment decisions taken solely by automated processing.
Poland AI Systems Act
Polish national law implementing the EU AI Act. It creates the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI, AI Development and Safety Commission) as market surveillance authority and single point of contact, and sets the procedure for inspections, enforcement proceedings and administrative fines for breaches of Regulation (EU) 2024/1689.
Ireland AI Act 2026
Ireland's national implementing law for the EU AI Act. Establishes Oifig IS na hÉireann, the AI Office of Ireland, and gives effect to Regulation (EU) 2024/1689 through a distributed model in which existing sectoral regulators act as market surveillance authorities, with an adjudication system for administrative fines capped at the AI Act's Article 99 limits and criminal offences for specified non-compliance with authorities' powers.
DE JuSchG §24a (KidD)
Requires providers of certain telemedia services to implement provider-side precautionary measures ("Vorsorgemaßnahmen") with regulator-facing evaluability via published BzKJ criteria.
DE Digital Violence Bill (GgdG)
German government bill creating a standalone Digital Violence Act (GgdG) that gives victims court-ordered disclosure of anonymous offenders' identities, data preservation, content removal and temporary account suspension against platforms, and adding Criminal Code offences for sexualised deepfakes, reputation-damaging deepfakes, identity misuse and covert tracking.
CA AB 2246
Repeals and replaces the California Age-Appropriate Design Code Act. Requires a business providing an online service, product or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty or extend child protections to all users, to configure high-privacy defaults, and to take reasonable steps to prevent specified harms including severe psychological harm. Removes the exceptions to the data-collection prohibitions, lets children void contracts entered through manipulative design features, and states that it creates no private right of action.
Last updated August 2, 2026. Verify against primary sources before relying on this information.