Artificial Intelligence · Germany
AI regulation in Germany: laws & policy (2026)
Germany shaded by its artificial intelligence status
AI in Germany: comprehensive law.
FrameworkEU AI Act (Regulation (EU) 2024/1689) as directly applicable law, implemented nationally by Germany's KI-MIG (Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz), in force since 29 July 2026. The Bundesnetzagentur (BNetzA) is the central market surveillance authority and national point of contact.
As an EU member state, Germany is governed by the directly applicable EU AI Act, whose prohibitions have applied since 2 February 2025 and whose general-purpose AI (GPAI) obligations have applied since 2 August 2025, with most Annex III high-risk obligations now applying from 2 December 2027. Germany's national implementing statute, the KI-MIG, entered into force on 29 July 2026 and designates the Bundesnetzagentur as the central market surveillance authority, single point of contact to the EU AI Office, and complaints body, complemented by sectoral supervisors (BaFin for financial services, BfArM for medical devices, state media authorities, and DPAs for data protection aspects). Germany also runs a national AI Strategy with substantial funding and infrastructure initiatives (Agentic AI Hub, National Data Centre Strategy).
The EU AI Act in Germany
In Germany, artificial intelligence is governed by the EU AI Act, the first comprehensive AI law, which applies directly as an EU regulation.
- Framework
- the EU AI Act (Regulation (EU) 2024/1689)
- Approach
- risk-based: unacceptable-risk AI is banned, high-risk AI faces strict duties, limited-risk AI has transparency rules
- General-purpose AI
- transparency duties for all GPAI models; systemic-risk models add safety and evaluation obligations
- Timeline
- phased: prohibitions from Feb 2025, GPAI rules from Aug 2025, most high-risk obligations from Aug 2026
- Maximum fine
- €35 million or 7% of global annual turnover for prohibited-AI breaches
- Oversight
- national market-surveillance authorities, coordinated by the EU AI Office
The AI Act is an EU regulation applied directly in Germany; national market-surveillance authorities handle enforcement.
The EU AI Act in Germany: FAQ
Yes. As an EU member, Germany is covered by the EU AI Act (Regulation (EU) 2024/1689), which applies directly.
It uses a risk-based approach: unacceptable-risk AI is banned, high-risk AI faces strict obligations, and general-purpose AI models carry transparency duties.
It is phased: prohibitions applied from February 2025, general-purpose-AI rules from August 2025, and most high-risk obligations from August 2026.
Up to €35 million or 7% of global annual turnover for breaching the prohibited-AI rules, with lower tiers for other breaches.
Key points
Regulation (EU) 2024/1689 applies directly in Germany. Prohibitions on unacceptable-risk AI have applied since 2 February 2025; GPAI/foundation-model obligations since 2 August 2025; high-risk Annex III system obligations now apply from 2 December 2027 following the Commission's 'Digital Omnibus' adjustments, with embedded high-risk products following on 2 August 2028.
The KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) was adopted by the Bundestag on 11 June 2026, cleared the Bundesrat on 10 July 2026, and entered into force on 29 July 2026, days before the 2 August 2026 EU AI Act supervisory-authority deadline.
BNetzA is designated as the default market surveillance authority for AI systems, the national single point of contact to the EU AI Office, and the central complaints office. A Coordination and Competence Centre (KoKIVO) sits within BNetzA to pool AI expertise and support other supervisors; an independent AI Market Surveillance Chamber inside BNetzA oversees sensitive biometric AI in law enforcement and justice.
In fully harmonised product sectors and regulated industries, incumbent supervisors remain competent: BaFin for AI in financial services, BfArM for AI medical devices, the state media authorities (Landesmedienanstalten) for AI in media, and federal/state data protection authorities for GDPR-relevant AI uses. KI-MIG coordinates these bodies rather than replacing them.
The Datenschutzkonferenz (DSK) — federal and 16 Länder DPAs — issued substantially revised guidance on 17 June 2025 on technical and organizational measures for the GDPR-compliant development and operation of AI systems, structured around design/development/implementation/operation phases and seven data-protection goals; non-binding but treated as authoritative supervisory expectations.
Germany maintains a national AI strategy with a EUR 5.5 billion policy envelope, a National Data Centre Strategy adopted in March 2026 (targeting a doubling of data-centre capacity and a fourfold rise in AI/HPC capacity by 2030, with data centres treated as critical infrastructure), a planned AI 'gigafactory', and the March 2026 Agentic AI Hub pairing municipalities with start-ups on 18 pilot projects.
Timeline - major decisions & events
Germany's Cabinet adopted the 'Gesetz zur Durchführung der Verordnung über künstliche Intelligenz', designating the Bundesnetzagentur as the central market surveillance authority, notifying authority and single point of contact for the EU AI Act. It moves to the Bundesrat and Bundestag for enactment.
Gleiss Lutz ↗The Federal Ministry for Digital and Public Administration circulated a ministerial draft of the AI Market Surveillance and Innovation Promotion Act for consultation with federal states and associations, setting the national authority structure (BNetzA plus an independent AI Market Surveillance Chamber). It drew 57 responses.
Heuking ↗The Federal Network Agency set up an AI Service Desk and earlier (June 2025) published AI-literacy guidance to help businesses comply with the EU AI Act, signalling its operational role ahead of formal designation as the national supervisor.
Bundesnetzagentur ↗The Datenschutzkonferenz (DSK), the conference of German federal and state data protection authorities, published 'Orientierungshilfe KI und Datenschutz', the first national guidance on using AI, especially large language models, in compliance with the GDPR.
DSK (via Hogan Lovells) ↗The Federal Ministry of Education and Research issued an action plan updating the national AI Strategy, treating the rise of generative AI as a catalyst for accelerated investment in research, infrastructure, skills and applications.
BMBF (via Regulations.AI) ↗The Federal Government revised its AI Strategy, raising planned federal investment to EUR 5 billion by 2025 and re-centring 'trustworthy, human-centred AI made in Europe', aligning national policy with emerging EU-level AI regulation.
Federal Government (KI-Strategie) ↗The government-appointed Datenethikkommission published a 240-page opinion with 75 recommendations, proposing a risk-adapted, tiered regulatory approach to algorithmic systems that strongly influenced both German and EU thinking on AI regulation.
European Commission (Futurium) ↗The Federal Government adopted the AI Strategy promoting 'AI made in Germany' as a brand for trustworthy, human-centric AI, pledging around EUR 3 billion through 2025. This established the foundational policy direction for German AI governance.
Bundesregierung ↗Germany - other topics
Artificial Intelligence in other countries
Last verified 9/11/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →