Germany now has an AI supervisor — what the KI-MIG actually changes if you run AI yourself

Since 29 July 2026, Germany has a named authority for artificial intelligence. It is the Bundesnetzagentur — the federal agency most companies already know from telecoms and energy — and it is now the market-surveillance authority, the national contact point and the complaints office for the European Union’s AI Regulation.

If you run AI inside your own company, what that changes is smaller and more specific than the headlines suggest. It is also more useful.

A note on terms first. The EU AI Regulation (often called the AI Act) is the European law governing artificial intelligence. Market surveillance is the enforcement function: the authority that can investigate a product, ask for documentation, and require changes. The German law that assigns those roles is the KI-Marktüberwachungs- und Innovationsförderungsgesetz — the AI market-surveillance and innovation-promotion act, mercifully shortened to KI-MIG.

What the law actually does

The KI-MIG does not create new obligations for AI systems. The obligations come from the EU Regulation, and they apply across the Union whether or not a member state has passed an implementing law. What the KI-MIG settles is the German institutional question: who supervises, who you contact, and where a complaint goes.

Its answer is the Bundesnetzagentur, in three capacities — market-surveillance authority, national point of contact, and complaints office.

The part almost every summary drops

The common framing is that the Bundesnetzagentur has taken over AI supervision in Germany. That is half of what the announcement says, and it is the half that travels.

The other half is in the same paragraph of the ministry’s own press release: the law “builds on the established competences of the existing market-surveillance authorities”, and — the clause worth reading twice — “companies keep their familiar contacts, including for questions about the AI Regulation.”

So this is not a transfer of supervision to a single new regulator. It is a coordination layer placed over an existing structure. If you are in a regulated sector, the authority you already answer to keeps its remit. The Bundesnetzagentur is the central door, the place a complaint lands, and the body that coordinates nationally.

That distinction matters because the two readings imply different work. “A new regulator is coming” suggests a relationship to build from scratch. “Coordination over existing competences” suggests something much less dramatic: knowing which door is which.

The support mandate nobody mentions

There is a second half of the Bundesnetzagentur’s new role that has been almost entirely absent from coverage, and for a mid-sized company it is arguably the more immediately useful part. The agency is mandated to actively support companies in using AI — not only to supervise them.

Two instruments carry that:

• A KI-Service Desk — a first point of contact for questions about the AI Regulation, reachable at bundesnetzagentur.de/ki. If you are trying to work out internally whether an application falls in scope at all, this is somewhere to put that question before you commission an opinion.
• Regulatory sandboxes — supervised environments for trialling new applications before you commit to them. For an organisation that wants to introduce an AI application but cannot yet judge its regulatory classification confidently, this is the more interesting of the two.

Supervision with a support function attached is rarer than it should be. It is worth knowing both exist.

What already applies, and what does not

This is where current coverage is doing real damage, so it is worth being precise.

Applying since 2 August 2026: the AI Regulation’s transparency chapter, Article 50. It reaches systems that interact directly with people, systems generating synthetic content, emotion recognition and biometric categorisation, and deepfakes or AI-generated text published to inform the public. It applies to providers and to deployers, it is not limited to high-risk systems, and open-source systems are not exempt from it. We covered what a compliant disclosure actually looks like in the Article 50 guidelines explainer. The Commission’s enforcement powers over general-purpose AI models activated the same day.

Not applying yet: the high-risk chapter. Several write-ups about the KI-MIG state that high-risk obligations applied from 2 August 2026. They did not. The Digital Omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026 — fixed those duties at 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for high-risk systems embedded in regulated products. Those are legislated dates, not conditional ones, and they are not expected to move again.

The confusion is understandable. 2 August 2026 was the original high-risk date before it moved, and a great deal of material written in 2025 still says so. But a plan built on the wrong date is a plan with sixteen months of phantom urgency in it — or sixteen months of runway you did not know you had. We set out the corrected timeline in EU AI Act readiness: what actually changed in 2026.

What to do about it this week

Nothing in the KI-MIG requires you to file anything or change a system. It is a map, not a duty. But three internal questions are worth answering while the subject is open:

None of those needs a lawyer to start. All three are cheaper to answer now than in the week someone asks.

The honest summary

Germany’s supervisory picture for AI is now named, and it is less disruptive than the headlines imply. A familiar agency has taken on a coordinating role, existing authorities keep their competences, companies keep their contacts, and there is a service desk and a sandbox route for organisations that want to ask before they build.

The most valuable thing in the whole development may simply be this: if you have a question about the AI Regulation and no obvious person to ask, there is now an address.

Frequently asked questions

← All posts