Skip to content
Friendly disclaimer: flozi00 TechHub is a solo side-project next to a full-time job — personal learning notes, no official statements. Verify critical steps yourself.
flozi00 Logoflozi00 TechHub
ENDE

Germany's KI-MIG: Who Enforces the AI Act?

Germany's KI-MIG names the Bundesnetzagentur as the default AI Act market-surveillance authority, with statutory sectoral exceptions. A source-based map of powers, registration and application dates.

4 min readflozi00
aicomplianceai-actenforcementregulation
Skip to the full article
Watch · explore · understand

Find the authority before interpreting its powers

Germany’s authority map depends on use and sector; legal powers are not evidence of a specific inspection.

AI-assisted learning visualization · schematic article explanation

Step 1 / 4Describe the case

The same model can serve different sectors and purposes. Self-hosting alone does not identify the supervisory authority.

WorkflowCurrent stepSelect a block to explain it
System, role and sector
Describe the actual deployment and intended purpose.
Statutory sector cases
Check the specific allocations in KI-MIG § 2.
Default BNetzA path
Applies where the statutory exceptions do not.
  1. System, role and sector Statutory sector cases
    sector check
  2. System, role and sector Default BNetzA path
    general rule
What to remember

Jurisdiction, applicable duties and evidence of an actual procedure must be checked separately.

The diagram summarizes the article’s dated legal analysis. It makes no claim about a particular inspection campaign or an individual registration deadline.

Terms and the complete walkthrough
Market surveillance
Public supervision of compliance within the authority’s legal competence.
Jurisdiction
The legally assigned responsibility for a particular case.
  1. Describe the case

    The same model can serve different sectors and purposes. Self-hosting alone does not identify the supervisory authority.

  2. Read the allocation

    KI-MIG § 2 names BNetzA as the general rule and specifies exceptions. Check those exceptions before assigning the case.

  3. Keep powers and duties separate

    An authority’s procedural powers and an operator’s substantive duties are different questions. Check both the system classification and the relevant application timing.

  4. Record actual evidence

    Prepare a record of roles, purpose and applicable controls. Do not turn the existence of legal powers into a claim that an inspection has occurred.

All connections

  • System, role and sector → Statutory sector cases: sector check
  • System, role and sector → Default BNetzA path: general rule
  • Statutory sector cases → Competent authority: special allocation
  • Default BNetzA path → Competent authority: otherwise
  • Competent authority → Applicable duties and dates: scope and timing
  • Competent authority → Evidence and response record: actual procedure
  • Applicable duties and dates → Evidence and response record: document basis
Set your own pace. Pause at any time or select a step directly.

Germany's KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz (KI-MIG) entered into force on 29 July 2026. Section 2(1) names the Bundesnetzagentur (BNetzA) as the default market-surveillance authority for the EU AI Act. Sections 2(2)–(8) allocate particular cases to other authorities.12 Self-hosting a model does not by itself identify which authority has jurisdiction or which AI Act duties apply. The use case, operator role and regulated sector matter.

The authority map

CaseCompetent authority under KI-MIG § 2
General rule, unless an exception appliesBNetzA, § 2(1)
Systems linked to products covered by Annex I Section A harmonisation lawExisting product-law market-surveillance authorities, § 2(2)
Systems directly linked to regulated financial activity of covered institutionsBaFin or another competent financial supervisor as specified in § 2(3)–(4)
Certain law-enforcement, migration, border-management and justice usesIndependent AI Market Surveillance Chamber at the BNetzA, § 2(5)
AI systems of Länder public bodiesAuthorities designated by Land law, § 2(6)
Certain federal tax casesBNetzA enforcement subject to the consent mechanism in § 2(7)
Certain media-service usesAuthorities designated by Land law; Deutsche Welle has a special rule, § 2(8)

The BNetzA's announcement also names employment, critical infrastructure and education among its areas of responsibility, and describes the arrangement as a hybrid system. It does not make BNetzA the authority for every AI system.

What § 11 permits

KI-MIG § 11 gives the competent market-surveillance authorities the powers in Articles 14(4)–(5) and 16 of Regulation (EU) 2019/1020 and the AI Act. It permits technical assistance by third parties and exercise of specified powers through APIs or other remote-access means. Limits and procedural conditions still apply; for example, § 11(3) restricts the timing of entry under Article 14(4)(e), and § 11(7) specifies when appeals have no suspensive effect.3 The authority may request relevant information, but an information request does not make a postponed high-risk duty immediately applicable.

The general AI Act application date was 2 August 2026. Regulation (EU) 2026/1744 postponed Chapter III, Sections 1–3 for Annex III high-risk systems to 2 December 2027, and for Annex I high-risk systems to 2 August 2028.4 Article 4 AI literacy, Article 5 prohibitions and Article 50 transparency follow their own application dates. Refer to the Omnibus timeline guide for the role and date distinctions.

What to document

A practical file can record the system's intended use; whether you are its provider or deployer; the relevant Annex III or Annex I category, if any; how the current Article 4, 5 and 50 duties are met; and the GDPR basis if personal data is processed. For a potentially high-risk system, plan technical documentation, logs, oversight and conformity work for the applicable deadline. These are preparatory records, not a claim that every Chapter III duty is already enforceable.

Article 50(1) places direct-interaction notice duties on providers of qualifying systems. Article 50(2) concerns provider-side machine-readable marking of synthetic outputs. Article 50(4) concerns disclosure by deployers of certain deepfakes and public-interest text, with stated exceptions.5 A back-office hiring model does not acquire an Article 50(1) direct-interaction duty solely because it handles applications. Article 26(7) workplace information is part of the postponed Chapter III Section 3 duties for affected high-risk systems; it should not be listed as an already applicable AI Act duty in September 2026.4

KI-MIG § 20 provides a non-public national register for high-risk systems under Annex III point 2 (critical infrastructure). Its text sets registration before placing on the market or putting into service for providers, and before use for covered federal public-body deployers.6 It is not a general registry for all self-hosted AI. Whether a particular registration is due requires checking the system's classification and the interaction with the amended AI Act application dates; the existence of the register alone does not settle that question.

What the evidence does not show

The earlier version of this article described a coordinated September 2026 inspection wave, identified agencies and claimed an EU AI Office confirmation on 10 September. No primary authority publication was located that supports those particulars. They have been removed. The BNetzA's legal powers and its July announcement are documented; they are not proof of a particular inspection docket.

Legal status checked on 29 September 2026. This is general information, not individual legal advice.

Footnotes

  1. KI-MIG full text, including § 1 and commencement. ↩

  2. KI-MIG § 2, paragraphs 1–8. ↩

  3. KI-MIG § 11; Regulation (EU) 2019/1020, Article 14. ↩

  4. Regulation (EU) 2026/1744, Article 1(40)(b). ↩ ↩2

  5. AI Act Article 50, paragraphs 1, 2 and 4. ↩

  6. KI-MIG § 20, paragraphs 1–3; AI Act Article 49(5). ↩