The AI Act (Regulation (EU) 2024/1689) – the EU’s first comprehensive framework for the development, placing on the market and use of AI systems – entered into force on 1 August 2024 and will apply directly from 2 August 2026. Member States were required to comply with certain implementation obligations and define competent authorities and enforcement powers by 2 August 2025. To meet these obligations, the Federal Cabinet adopted the draft AI Market Surveillance and Innovation Promotion Act (Regierungsentwurf für das KI-Marktüberwachungs- und Innovationsförderungsgesetz, “draft KI-MIG”) on 11 February 2026.
Background of the bill
Article 70 AI Act requires Member States as of 2 August 2025 to establish or designate at least one notifying authority and at least one market surveillance authority, including a central market surveillance authority. A draft bill for implementing the AI Act had been introduced in the last legislative period but not passed. To avoid infringement proceedings by the European Commission and to eliminate legal uncertainty for companies and authorities, the Federal Cabinet adopted the draft KI-MIG on 11 February 2026. The draft designates the competent authorities, regulates their tasks and cooperation, and contains provisions on administrative fines. The aim of the KI-MIG is to create a stable and innovation-friendly legal framework that enables Germany to make full use of the potential offered by artificial intelligence.
Bundesnetzagentur to play central role in streamlined administrative landscape
The draft KI-MIG consolidates existing structures and identifies clear points of contact for companies. At its core is the central role of the Federal Network Agency (Bundesnetzagentur), which is to ensure uniform application of the AI Act and thereby promote legal certainty and consistent cross-border enforcement. This concentration of responsibilities highlights the integration of existing product-safety market surveillance structures to avoid duplication and address shortages of qualified staff. The draft KI-MIG also places strong emphasis on coordinated cooperation between authorities. Section 9 of the draft governs collaboration between market surveillance and notifying authorities, including the involvement of data protection regulators, anti-discrimination bodies and the Federal Cartel Office (Bundeskartellamt). Section 10 draft KI-MIG sets out interim cooperation with the Federal Office for Information Security (BSI) on cybersecurity matters relating to high-risk AI systems pending designation of the competent authority under the Cyber Resilience Act.
Central market surveillance authority
Pursuant to section 2(1) draft KI-MIG, the Bundesnetzagentur will become the central market surveillance authority for AI Act compliance, subject to the sector-specific jurisdiction of another authority (see section 2(2) to (8) draft KI-MIG). The Federal Financial Supervisory Authority (BaFin), for example, will be responsible for AI systems in the financial sector. The Bundesnetzagentur’s market surveillance will cover the oversight of prohibited AI practices (Chapter II AI Act), high-risk AI systems (Chapter III AI Act) and transparency obligations for providers and deployers of certain AI systems (Chapter IV AI Act). The authority will also examine the classification of AI systems as high-risk AI systems in accordance with Article 6 AI Act and the relevant Commission guidelines.
Central complaints office
In addition to its role as a market surveillance authority, the Bundesnetzagentur will also act as the central complaints office. Under section 8(1) draft KI-MIG, complaints regarding infringements of the AI Act may be lodged with the Bundesnetzagentur without prejudice to Article 85 AI Act. The Bundesnetzagentur will forward these complaints to the competent market surveillance authorities or other affected authorities and will be required to establish an accessible complaints management system (section 8(3)). Section 8(2) draft KI-MIG clarifies that complaints must also be forwarded to other authorities or public bodies with relevant jurisdiction within the meaning of Article 77(1) AI Act, such as anti-discrimination bodies.
Point of contact for other stakeholders
The Bundesnetzagentur will also act as the single point of contact within the meaning of Article 70(2), sentence 3 AI Act and will thus serve as Germany’s contact for other Member States and the European Union. It will receive submissions from the EU AI Office, from the public, and from other entities, and forward them to the competent national authorities.
Sector-specific competencies
Alongside the Bundesnetzagentur’s central responsibilities, sections 2(2) to (8) draft KI-MIG set out special sector-specific competencies:
- BaFin will have general responsibility for supervising AI systems in the financial services sector.
- In the areas of the financial services sector not subject to BaFin’s supervision, market surveillance is to be carried out by the financial supervisory authority that is competent in the circumstances.
- Existing sector-specific market surveillance authorities will remain responsible for those AI systems that fall under the harmonisation legislation set out in Annex I AI Act.
- For AI systems used for managing taxes and levies, the Bundesnetzagentur’s enforcement powers will be subject to the consent of the Federal Ministry of Finance.
- Federal state authorities are to be responsible for the AI systems of public authorities in their states and for media supervision.
Establishment of a central coordination and competence centre (KoKIVO)
A central coordination and competence centre for the AI Act, known as a KoKIVO, is also to be established at the Bundesnetzagentur. The KoKIVO will serve as a service and advisory centre that pools knowledge and resources and supports federal and state authorities in the complex application of the AI Act. To keep the considerable effort of building in-house AI expertise in each product area within reasonable limits, the KoKIVO will make its AI expertise available to the authorities. The KoKIVO’s range of tasks includes, in particular, supporting complex decision-making, coordinating cooperation between the competent authorities, promoting consistent responses to horizontal legal issues and facilitating codes of conduct under Article 95(2) AI Act.
It is noteworthy in this context that advisory services provided by the authorities to public bodies on classifying AI systems as high-risk AI systems under Article 6 AI Act will require an administrative agreement with the federally or regionally competent ministry, and that the Bundesnetzagentur will publish the key considerations underlying such advice. In addition, the KoKIVO is to ensure transparent and regular involvement of the federal states and civil society stakeholders, such as business and academia. To fulfil its tasks, the centre will be able to bring in the relevant federal authorities where appropriate, seek external expert advice and create suitable committees made up of representatives of the competent authorities.
Promoting innovation
Pursuant to section 12 of the draft KI-MIG, the Bundesnetzagentur is additionally tasked with implementing measures to promote innovation. In particular, these measures include providing information and guidance on applying the AI Act – especially for SMEs, start-ups and public bodies within the meaning of section 2(1) and (2) Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”) – as well as advising public bodies on classifying AI systems as high-risk AI systems under Article 6(2) and (3) AI Act. The Bundesnetzagentur will also carry out awareness and training measures, promote the development and sharing of knowledge on artificial intelligence, and facilitate networking between the relevant players in the AI ecosystem. Finally, the Bundesnetzagentur will contribute to the technical standardisation of artificial intelligence in national and international bodies.
Obligation to set up an AI regulatory sandbox / tests outside of AI regulatory sandboxes
The Bundesnetzagentur will also be obliged to establish and operate at least one AI regulatory sandbox in accordance with the AI Act. This does not affect the power of other competent national authorities, which will likewise be able to establish and operate AI regulatory sandboxes. To perform this task, the Bundesnetzagentur is to work closely with other authorities whose areas of responsibility will be affected, in particular with the competent data protection supervisory authorities (assessment in accordance with Article 59 AI Act).
Research institutions, universities and their spin-offs established or with a presence in the European Union are to be granted priority access to the AI regulatory sandbox provided the relevant requirements and selection criteria are met. However, pure research projects with no prospect of market access will not qualify for priority access.
Section 14 draft KI-MIG provides for an administrative approval and supervisory procedure for testing high-risk AI systems under real-world conditions outside AI regulatory sandboxes. Of particular significance is the draft’s presumption-of-approval rule: Should the relevant market surveillance authority fail to reply within 30 days after the test plan is submitted, the approval will be considered granted.
Establishment of an independent market surveillance body
An independent AI market surveillance body is to be established within the Bundesnetzagentur pursuant to section 2(5) in conjunction with section 4 draft KI-MIG for high-risk AI systems under Annex III, no. 1 AI Act used for law enforcement, border management, and justice and democracy, and for systems under Annex III, nos. 6, 7 and 8 AI Act. The body will consist of three members, with the President of the Bundesnetzagentur serving as its chair. Substantively, the body will verify compliance with documentation and system requirements, without in any way substituting judicial decisions in individual cases. To ensure effective oversight, the body will be able to draw on existing expertise, staffing and experience from the Bundesnetzagentur’s established market-surveillance operations. Organisationally, the market surveillance body is to be modelled on the Bundesnetzagentur’s established decision-making bodies. Section 4(4) draft KI-MIG also requires the body to present a report to the Bundestag once a year.
Penalties and fines
The draft also sets out fines for breaches of the AI Act. Under section 15(1) draft KI-MIG, these include in particular breaches of documentation and information obligations (Article 21 AI Act), the omitted or delayed performance of a fundamental-rights impact assessment (Article 27 AI Act), and the provision of incorrect information to the notifying authority (Article 45 AI Act). Under section 15(3) draft KI-MIG, such administrative offences will be able to be punished with fines of up to EUR 50,000.
The draft finally clarifies that the EU law provisions on fines under Article 99(3) to (5) AI Act also apply within the framework of national proceedings; in this respect, the provisions of the Act on Regulatory Offences apply accordingly, subject to procedural specificities.
Section 17(2) draft KI-MIG confirms that no fines will be imposed on authorities or other public bodies within the meaning of the BDSG.
Other provisions
The Whistleblower Protection Act (Hinweisgeberschutzgesetz, “HinSchG”) will be amended so that breaches of the AI Act also fall within its scope.
In addition, when a business is wound up or becomes insolvent, responsibility for fulfilling documentation obligations will pass to the individual responsible for liquidation or the insolvency administrator.
Conclusion and recommended action
The draft AI Market Surveillance and Innovation Promotion Act seeks to establish a lean institutional structure and clear legal framework designed to give businesses greater legal certainty. Companies will receive clarity about which bodies are responsible in individual cases and what consequences can be expected if they breach the AI Act. At the same time, significant weight is given to promoting innovation, highlighting the government’s readiness to strengthen Germany’s standing as a business hub. It should be noted that the present government draft still has to be passed by the Bundestag. The KI-MIG will then take effect on the day after it is promulgated.
Companies should now review which market surveillance authority is responsible for their area. Once the KI-MIG is promulgated, it is advisable to make use of the Bundesnetzagentur’s advisory services as early as possible.
Forward
