The KI-MIG: How the Federal Network Agency Becomes Germany's Central AI Supervisory Authority

Since summer 2026, Germany has had its own answer to the European AI Regulation: the Act on Market Surveillance and Innovation Promotion in the Field of Artificial Intelligence, or KI-MIG for short. It sounds unwieldy, but it matters to companies, public authorities and ultimately anyone who comes into contact with AI systems. This article explains what the law regulates, why the Federal Network Agency became the central AI supervisory authority, and what concretely changes for businesses and consumers.

What is the KI-MIG – and why does Germany need it at all?

With Regulation (EU) 2024/1689 – better known as the “AI Act” – the European Union created a comprehensive legal framework for artificial intelligence back in 2024. The Regulation entered into force on 1 August 2024 and has applied directly in principle since 2 August 2026; it follows a risk-based approach with bans on certain practices, special requirements for high-risk AI systems and transparency obligations. An EU regulation applies directly in all member states, but it still needs national implementing legislation – above all to determine which authority takes over supervision locally, who imposes fines and how complaints are handled.

That is exactly what the KI-MIG does. It implements Regulation (EU) 2024/1689 and thereby creates the national enforcement architecture for the AI Act in Germany. The law is part of a larger omnibus act, but it quickly became the actual centrepiece of German AI regulation.

The road to the law: a timeline

The KI-MIG took several months to come about – with one clear goal in mind: to be ready by the deadline of 2 August 2026, from which central obligations of the EU regulation became directly applicable.

• 10 February 2026: The Federal Cabinet adopts the draft bill for the KI-MIG.
• 20 March 2026: The Bundestag debates the draft bill for the first time in plenary and then refers it to the lead Digital Affairs Committee.
• 23 March 2026: The Committee for Digital Affairs and State Modernisation takes up the draft; experts welcome the decision to designate the Federal Network Agency as market surveillance authority, while the broadly spread notification responsibilities at state level are viewed sceptically.
• 10 June 2026: The committee recommends adopting the law, which is then passed.
• 10 July 2026: The Bundesrat approves the KI-MIG without calling the mediation committee.
• 29 July 2026: The law enters into force.
• 2 August 2026: The Federal Network Agency officially takes over market surveillance – at the same time as the deadline from which the transparency obligations of the EU regulation apply.

Remarkably, only a few days passed between the law entering into force and the start of actual supervisory activity. Germany thus completed its national enforcement structure literally at the last minute before the European deadline.

The Federal Network Agency: a new task for a familiar authority

Most people know the Federal Network Agency from telecommunications or energy law – for instance when it comes to mobile networks, electricity prices or the expansion of charging stations. Since 2 August 2026, a completely new responsibility has been added: it now carries out market surveillance for AI systems, receives complaints and runs a free service desk for companies.

Why this authority? The legislator explicitly did not want to build new, additional bureaucracy. The aim was a deliberately lean AI supervision that implements European requirements in an innovation-friendly way. From its previous work, the Federal Network Agency already has experience with complex technical regulation and market supervision – an advantage over building a completely new authority from scratch.

The KI-MIG thus creates a clear, practical supervisory structure: the Federal Network Agency is to actively support companies in their use of artificial intelligence. To this end, an AI service desk, AI regulatory sandboxes for testing new applications, and information, advisory and networking services were provided for. The authority is thus both a supervisor and a point of contact. This dual role is deliberately built into the law so that companies are not only sanctioned but also guided through implementation.

As we know from data protection, this does not work in practice in Germany. Sanctions for GDPR violations are almost never seen. Some authorities, with Hesse right at the front, do not want to impose fines at all. Is it compassion that prevails here, or fear of too much work?

The agency’s president, Klaus Müller, described the new role of his authority as a significant step towards the responsible use of artificial intelligence in Europe. This can be read as a signal that the Federal Network Agency sees its new responsibility not merely as a burdensome extra task but as a strategically important policy field.

The AI Market Surveillance Chamber: independence for the most sensitive cases

Not every AI system is supervised equally strictly. For applications that are particularly sensitive in terms of fundamental rights, the legislator created a separate, independent institution within the Federal Network Agency: the AI Market Surveillance Chamber.

This chamber is responsible for the market surveillance of high-risk AI systems used for law enforcement, border management, the judiciary and democracy, as well as other areas named in Annex III of the EU regulation. This concerns, for example, biometric recognition systems, AI in migration and asylum administration, and AI applications that affect democratic processes – technologies where errors or misuse weigh particularly heavily.

The reason for this special construction lies in EU law itself: for these areas, European law requires designating an authority that meets certain independence requirements of an EU directive on law enforcement. It is interesting which choice the German legislator made: instead of entrusting the existing data protection authorities with this task, it opted for a fully independent, three-member chamber within the Federal Network Agency.

This independence is spelled out very concretely in the law. The chamber acts completely independently, is subject to neither direct nor indirect external influence, and neither takes nor seeks instructions. Organisationally, it is attached to the Federal Network Agency and can draw on its staff and resources, but the employees assigned to it are subject exclusively to the chamber’s members while working for it – a clear separation from the rest of the authority. In addition, the chamber must be accountable: it submits an annual activity report to the Bundestag, for the first time for 2026, by 31 March of the following year.

A patchwork with a system: sectoral responsibilities

Anyone who now thinks the Federal Network Agency is responsible for all AI applications in Germany is mistaken. The KI-MIG deliberately does not create a one-stop system, but interlinks the new AI supervision with existing specialist authorities.

This is particularly clear in the financial sector: it mainly concerns AI systems for assessing the creditworthiness of natural persons, for risk assessment and pricing in life and health insurance, and for fraud detection at banks and insurers. Here BaFin remains in charge, having positioned itself in advance: on 18 December 2025 it published guidance on ICT risks in the use of artificial intelligence, which clarifies the supervisory framework for supervised firms.

The fines, too, show this interlinked system: BaFin imposes fines in the financial sector, BfArM for medical devices, the data protection authorities for data protection violations, and the Federal Network Agency takes those cases that cannot be assigned to any sectoral responsibility. For companies, this means that fine risks are not concentrated in a single body. A bank using an AI system for credit decisions may face measures from BaFin, while the same system, in the event of a simultaneous data protection violation, may additionally be sanctioned by the data protection authority. To avoid double punishment for the same facts, the law provides for coordination duties between the authorities – although their exact design has not yet been conclusively clarified.

Another peculiarity concerns the federal states: where public state bodies use AI systems, market surveillance is not the job of the Federal Network Agency but of the authorities competent under state law. It was precisely this federal fragmentation that experts viewed most critically during the legislative process.

Service desk, regulatory sandboxes and advice: support instead of mere control

The KI-MIG sees itself not only as an instrument of control but explicitly also as an instrument for promoting innovation – that is already in the name of the law. A central tool for this are so-called AI regulatory sandboxes: defined test environments in which companies can develop and trial new AI applications under official supervision before they go to market.

The EU regulation obliges every member state to set up at least one such sandbox. The KI-MIG designates the Federal Network Agency as the coordinating body for the national sandbox, but expressly allows further sectoral sandboxes to be operated in parallel under the lead of the competent specialist authority. This offer is complemented by low-threshold advisory formats: a free service desk to which companies can turn with specific implementation questions, as well as general information and networking services.

Transparency obligations from 2 August 2026: what now has to be labelled

For the general public, another aspect of the 2 August 2026 deadline is likely to be more noticeable than the authorities’ responsibilities in the background: the new labelling obligations. Since that date, the transparency obligations of the AI Regulation have applied, under which certain AI-generated or manipulated audio, image, video or text content must be labelled. The European Commission has published supplementary guidelines on the detailed design of these obligations.

For consumers, this ideally means that AI-generated images, deepfake videos or chatbot answers should in future be more clearly recognisable as such. How consistently this labelling is enforced in practice is likely to be one of the first big tests for the new supervisory structure.

Fines: how expensive is a violation?

The actual fine ranges are not set out in the KI-MIG itself but already in the EU regulation – the German law merely determines which authority imposes them in each case. The AI Act’s penalty system is tiered and based on the severity of the violation:

• Up to EUR 35 million or 7% of worldwide annual turnover – whichever is higher – threaten the most serious violations, such as the use of prohibited AI practices like manipulative systems or certain forms of social scoring.
• Up to EUR 15 million or 3% of annual turnover are provided for most other breaches of obligations, for example violations of the requirements for high-risk AI systems.
• A special rule applies to small and medium-sized enterprises: unlike for large companies, the lower of the two possible amounts is applied rather than the higher – a deliberate safeguard so that fines do not threaten the existence of SMEs.

Several criteria play a role when setting the fine in an individual case: among others, the nature, gravity and duration of the infringement, the number of persons affected and the extent of the damage caused, and whether the conduct was intentional or negligent are taken into account. Mitigating factors include measures to reduce damage, the degree of cooperation with the authority and existing technical and organisational safeguards. Those who report violations themselves, stop them immediately and limit damage therefore tend to end up at the lower end of the fine scale – repeat offenders who are uncooperative towards the supervisory authority at the upper end.

Important for companies that already operate AI systems that are sensitive from a data protection perspective: fines under the AI Regulation and under the GDPR can be imposed cumulatively where personal data is involved. The sanction risks may therefore add up. In Germany, this effectively means that sanctions are now possible after GDPR fines went unimposed (see, for example, Real-Time Bidding, web tracking or Facebook fan pages).

Criticism and open questions

However well thought out the supervisory structure looks on paper, the KI-MIG did not escape criticism. A particularly striking point concerns legal recourse: anyone who wants to challenge a fine notice in court ends up, at first instance, before the local court (Amtsgericht) – a choice that lawyers criticise as unusual for such a technical subject. Local courts are traditionally not specialised in highly complex, technical proceedings involving international corporations; whether they will do justice to the subject matter will only become clear in practice.

The federal split of notification responsibilities among the states also met with scepticism from experts during the legislative process, as described above. And finally, it remains to be seen how well the promised coordination between the numerous sectoral authorities – BaFin, BfArM, data protection authorities, Federal Network Agency – actually works in practice to avoid double sanctions.

The legislator itself evidently anticipated these uncertainties: the KI-MIG is to be evaluated after 18 months – a sign that improvements are planned from the outset.

What does this mean for companies and private individuals?

For companies that develop, distribute or use AI systems, the KI-MIG above all brings one thing: clarity about who to turn to. There is now a clear contact, a competent complaints office and an authority with real enforcement powers – up to inspection of the source code where there is a concrete suspicion. Start-ups and mid-sized companies in particular should look at the Federal Network Agency’s free advisory services and at the option of testing new applications in a regulatory sandbox before going live.

For consumers, the new complaints office is the most relevant change: anyone who believes that an AI system violates applicable law – for example because AI-generated content is not labelled as such or a high-risk system operates opaquely – can in future turn directly to the Federal Network Agency.

Conclusion

With the KI-MIG, Germany has created a functioning, if complex, supervisory structure for artificial intelligence in time for the European deadline. The Federal Network Agency takes on a dual role as central contact point and supervisor, while sensitive fields of application such as biometric systems or AI in law enforcement are reserved for a specially created, particularly independent chamber.

At the same time, German AI supervision remains an interplay of many actors – from BaFin and the data protection authorities to the federal states – whose practicability has yet to be proven. The evaluation of the law planned for 2027/2028 should show whether the chosen construction delivers what it promises: lean but effective AI supervision “made in Germany”.