Germany's KI-MIG Handed the AI Act to the Bundesnetzagentur — Here Is What Your Audit File Needs Before It Asks

On 29 July 2026 — two days into the Digital Omnibus era and four days before the AI Act's general application date — Germany's KI-MIG entered into force.¹ Its opening sentence is administrative and easy to skim past: the law "serves the implementation of Regulation (EU) 2024/1689" and designates the competent authorities under Article 70(1) of that regulation. That is the whole game. Article 70(1) of the AI Act obliges every member state to designate market surveillance authorities; Germany answered with a single named regulator and a list of carve-outs.² If you run open-weights models on your own hardware in Germany, this law decides who can knock on your door, what they can demand when they do, and which document they will ask for first.

This is not legal news — the law was in force before the summer recess. It is the operational read: the delegation chain with section numbers, the enforcement powers and their start dates, the inspection wave reported for September 2026, the audit-file checklist a self-hoster can build from, and the honest month count to the deferred Annex III deadline.

1. The delegation chain: Article 70(1) plus ten sections

The chain is short and legible:

1. AI Act Art. 70(1) — each member state designates the market surveillance authority (or authorities) for the AI Act, entrusting them with the powers under Regulation (EU) 2019/1020 and Article 74.³
2. KI-MIG § 1 — the law implements Regulation (EU) 2024/1689 and regulates, "ergänzend" (in addition), the competent authorities under Art. 70(1)(1), innovation measures, and fines under Art. 99(1)(1).¹
3. KI-MIG § 2(1) — the Bundesnetzagentur is the market surveillance authority for compliance with the AI Act, "soweit in diesem Gesetz nichts anderes bestimmt ist" — unless another section says otherwise.⁴
4. Sections 2(2)–(8) then say otherwise, sector by sector. The BNetzA is the default, not the monopolist:⁴

Two structural facts follow. First, "BNetzA for everything" was never the design; the law's own press framing calls it a hybrid approach — oversight by the authority with subject-matter proximity, BNetzA for previously unregulated product areas, and Bundesländer may delegate their supervision to BNetzA through Organleihe.⁵ Second, for a private self-hoster none of the carve-outs matter except one: if your deployment sits in a regulated financial institution, your counterpart is BaFin; otherwise it is the BNetzA — including for personnel management, critical infrastructure and education systems, where BNetzA also polices Article 50 transparency duties and Article 5 prohibited practices.⁵

2. The powers: § 11 gives the BNetzA the 2019/1020 toolkit

Section 11(1) grants the market surveillance authorities the powers under Article 14(4) and (5) and Article 16 of Regulation (EU) 2019/1020 (the Market Surveillance Regulation) plus those of the AI Act itself, without prejudice to powers from other law.⁶ Article 14(4) of 2019/1020 is the standard enforcement catalogue — demand information "necessary for their tasks", require documentation (technical, test, risk or other), sample products, and — with authorisation — enter premises and inspect. Section 11(2) adds operator specifics: authorities can call in third parties as technical Verwaltungshelfer and can exercise the Article 14(4)(d) and (j) powers via APIs or other technical means enabling remote access. Under § 11(7), appeals against BaFin (§ 2(3)) measures — including threats and imposition of coercive means — have no suspensive effect; for product-law authority (§ 2(2)) decisions this holds only where radio-equipment (§ 36(1) Funkanlagengesetz) or medical-device (§ 45(5) MPDG) law applies. Either way: the measure stands during your appeal.⁶

Since when? The KI-MIG entered into force 29 July 2026; the AI Act's general frame and — with it — the market-surveillance and AI Office enforcement machinery apply from 2 August 2026.¹³ Fine exposure for AI Act breaches is codified nationally: KI-MIG § 17 makes the § 2 authorities the administrative fine authorities — "Verwaltungsbehörden" under § 36 OWiG — for their remits, including AI Act Art. 99(3)–(5); public bodies are exempt from fines (§ 17(2)).⁷ The AI Act penalty tiers stand at EUR 35,000,000 or 7% of worldwide turnover for Art. 5 breaches and EUR 15,000,000 or 3% for the next tier down.³ Misleading an authority itself is a finable act.

One local analogue will not save you: § 2(7) means the BNetzA needs the Finance Ministry's consent to go after federal tax AI — the consent mechanics do not extend anywhere near the private sector.

3. September 2026: the reported inspection wave

Reported coverage — treated here as reported, because no consolidated official docket was located on Commission or BNetzA pages as of this writing — attributes one detail to the official record: on 10 September 2026, the EU AI Office confirmed that automated résumé-screening and HR decision-making tools are included in the first wave of inspections, coordinated with national market surveillance authorities. The same coverage names algorithmic credit assessment and AI healthcare triage, and lists CNIL, BfDI and AESIA as leading the national requests; the BFDI-Länder carve-out for state bodies makes the BNetzA-BaFin-BfDI triangle Germany's version of the split.⁸

What is primary, not reported: the enforcement powers activated on 2 August 2026, the KI-MIG authority map, and the fact that a German authority holding § 11 powers can serve an information request today. The wave's composition is reported. Assume the categories (hiring, credit) and treat the individual names as unconfirmed.

The category choice shows the same deferred-and-live logic: résumé screening and creditworthiness are Annex III 4(a) and 5(b) high-risk categories whose Chapter III duties were deferred — but Art. 50 transparency, Art. 5 prohibitions and the information powers of Chapter IX apply now, and those are what a first-wave letter reads.

4. The self-hosters' audit file: from article to artifact

Assume the BNetzA's letter arrives under § 11 + Art. 14(4) 2019/1020. Organize the audit file so that each demand maps to a document you can produce. Note that the Chapter III artifacts are not yet enforceable (deferred) — but building them in 2026 is cheaper than in 2027, and the classification trail is testable today via Art. 6(3) — the no-significant-risk derogation.

Two rows deserve the math-first eye. The Art. 26 worker-information duty (Art. 26(7): inform workers' representatives before first use in the workplace) is not exotic — every HR-adjacent self-hosted tool in a German company hits it. And the KI-MIG § 20 register is German law live ahead of the December 2027 conformity deadline: it applies to Annex III point 2 systems — critical infrastructure, not the hiring and credit tools of inspection wave one. But BNetzA's own remit examples (critical infrastructure among them) mean a self-hoster running infrastructure-adjacent AI should check § 20 scope first: provider registration is due before placing on the market, not after.

5. The timeline math: 15 calendar months minus the burn-in

From late September 2026 to the deferred Annex III deadline of 2 December 2027:¹⁰

• Calendar months remaining: 15 (counting October 2026 through December 2027 inclusive — exactly the "15 months" headline).
• Realistic working months: subtract the December 2026 and December 2027 holiday low-points and typical German SME procurement cycles, and you are budgeting 12–13 working months for anything that needs external counsel, tooling or assessment capacity.
• Per artifact: the Art. 11 documentation alone, for a single high-risk system, is a 2–3 month drafting effort for an SME. The deferral bought 16 calendar months between the original and the moved deadline (2 Aug 2026 → 2 Dec 2027); 15 remain from today. Sequencing, not parallel tracks, decides whether you use that bandwidth or lose it.

For a self-hoster with hiring or credit tools, the honest sequencing is: Art. 50 and Art. 5 screening now (live, inspectable), classification register now, Art. 11 documentation before mid-2027, registration and conformity assessment before December 2027.

6. The verdict

Germany passed a national law whose entire content — designating an authority, granting it the existing 2019/1020 powers, adding a register and a complaints office — went live for a regime whose main obligations were deferred by the Omnibus two days earlier. The irony writes itself: the BNetzA can knock on your door today about an Annex III system whose conformity dossier you do not legally owe until December 2027. But the parts it can enforce — Art. 50 disclosure, Art. 5 bans, Art. 4 literacy, its § 11 information powers, the § 20 register — are exactly the parts of the audit file you can build in a week and maintain forever.

Compared with the member states that fragmented designation across a dozen authorities, Germany's BNetzA-centering is a genuine operational convenience: one counterpart, one register, one complaints office, clearer RFI channel. Germany did not legislate one single new substantive duty. What it did — a hybrid authority map, a KI-Marktüberwachungskammer for law-enforcement AI, a register, § 12 innovation tasks — is that rarest of compliance artifacts: paperwork that mostly points at paperwork. The counterweight is the SME cost side: someone pays for this structure's execution, and reporting obligations and register runs cost real hours in a 20-person shop — which is exactly the shop the law simultaneously promises to help via the KI-Reallabor and service desk. Build the file anyway; it is cheap, it is live where it counts, and December 2027 does not move again.

This article reflects the legal situation as of September 24, 2026 and is general information, not legal advice. Binding classification of your specific system requires individual review.