KI-MIG: Bundesnetzagentur Becomes Germany's AI Regulator

Since July 29, 2026, Germany has had an appointed AI regulator. The AI Market Surveillance and Innovation Promotion Act (KI-MIG) makes the Bundesnetzagentur the central market surveillance authority for artificial intelligence. For business managers in mid-sized companies, this does not change what obligations apply, but rather who enforces them, where complaints go, and who you can contact with questions.

What exactly is in effect since July 29, 2026?

The KI-MIG is enacted and published law, no longer a draft. It was signed on July 22, 2026, published in the Bundesgesetzblatt 2026 I Nr. 223, and entered into force on July 29, 2026. The Bundestag enacted the law on June 11, 2026 in the version as amended by the Digital Committee, and the Bundesrat approved it on July 10, 2026.

In terms of content, the law does not regulate what AI may do. That is covered in the European AI Regulation. The KI-MIG regulates the German enforcement level: jurisdictions, powers, complaint procedures, national penalty provisions, and innovation promotion. If you want to know what obligations apply to you starting August 2, 2026, the article on the EU AI Act Deadlines for Mid-Market Companies is the right place to start. This text answers the follow-up question: Who is knocking on the door?

Why is the Bundesnetzagentur responsible, and when is it not?

According to § 2 Absatz 1 KI-MIG, the Bundesnetzagentur is the competent market surveillance authority for the AI Regulation, insofar as the law provides otherwise. This is a catch-all jurisdiction, not exclusive authority. Where sector-specific supervision already exists, it remains responsible: BaFin for the financial sector, state media authorities for media offerings, and authorities for medical devices and machinery for the respectively harmonized product areas.

For a typical mid-market company without a regulated sector, this practically means: the contact person and supervisor is the Bundesnetzagentur. The law establishes several offices for this purpose that you should know about:

AI Market Surveillance Chamber (§ 4): a three-member, independent body led by the president of the Bundesnetzagentur, responsible for supervising certain high-risk systems, with an annual report to the Bundestag.
Coordination and Competence Center (§ 5): brings together AI expertise and supports other authorities in difficult classifications.
Central Contact Point (§ 6): the single entry point for companies and authorities.
Central Complaint Office (§ 8): where complaints from citizens and companies about AI systems arrive. This is the way in which an inspection at your company can actually be triggered.

What are the penalties under the KI-MIG really?

Here careful reading is worthwhile, because the numbers in circulation mix two different laws. The national penalty framework under the KI-MIG is up to 50,000 euros. § 15 Absatz 3 KI-MIG makes this clear: the violation can be punished with a fine of up to fifty thousand euros. This norm does not recognize percentages of turnover.

The often-cited 35 million euros or 7 percent of global annual sales, on the other hand, come from Article 99 of the AI Regulation, not from the KI-MIG. Both levels exist side by side. The KI-MIG deliberately closes gaps that the regulation leaves to the member states, and in doing so targets two main groups of cases:

Cooperation and Information: anyone who does not, does not correctly, or does not timely provide requested information or documentation, or who refuses access (§ 15 Absatz 1 KI-MIG).
Obligation to Provide Explanation to Affected Persons: anyone who as operator of a high-risk system withholds from an affected person the explanation required under Article 86 Absatz 1 of the AI Regulation (§ 15 Absatz 2 KI-MIG).

The practical lesson from this is unremarkable but important: the most expensive behavior towards German supervision is not a system error, but an unanswered inquiry. Whoever documents properly and responds on time has largely left the national penalty catalog behind.

What does the Bundesnetzagentur offer before it inspects?

The KI-MIG is explicitly also a promotion instrument; it's even in the name. § 12 requires the Bundesnetzagentur to take innovation-promoting measures: general information and guidance, advice to public authorities on classifying AI systems, training, knowledge exchange, and participation in technical standardization. § 13 creates the basis for AI real labs, § 14 governs testing of high-risk systems under real-world conditions.

Today, the KI Service Desk of the Bundesnetzagentur is concretely available, which supports companies, authorities, and organizations in implementing the AI Regulation, including an AI Compliance Compass for initial classification. For a 30-person business that wants to know whether its appointment booking bot falls into a risk category at all, this is the most affordable information available.

What should you do now?

The sensible next step is not a legal review, but an inventory. In our projects, every classification starts with the same simple list: What AI systems are running in the operation, who bought or built them, who is technically responsible, and where does a disclosure requirement apply? For voice and chat projects, we set the labeling directly in the greeting rather than retrofitting it later. That's configuration work of minutes and avoids the discussion with a regulatory authority entirely.

Create a system list: every AI system with vendor, purpose, responsible party, and launch date. Without this list you cannot respond to an information request on time, and that is precisely the national penalty provision.
Clarify your role: Are you an operator or provider? Most mid-market companies are operators, and the list of obligations is then significantly shorter.
Check labeling: Chatbots and telephone assistants must identify themselves, details in the article on Article 50 and the Labeling Requirement.
Document expertise: what Article 4 requires after the Digital Omnibus is covered in the article on AI Competence Training.
Name a contact: a person to whom an inquiry from the Bundesnetzagentur is internally delivered.

If you don't want to do this inventory alone, we support you as part of our AI Consulting. This article analyzes the legal situation and is not legal advice. Whether an obligation applies in your specific case and how it is to be fulfilled should, if in doubt, be reviewed by an attorney.

Frequently Asked Questions About the KI-MIG

Is the KI-MIG enacted or still a draft?

It is enacted and in force. The AI Market Surveillance and Innovation Promotion Act was signed on July 22, 2026, published in the Bundesgesetzblatt 2026 I Nr. 223, and has applied since July 29, 2026. The cabinet draft from February 2026 is thus obsolete.

Is the Bundesnetzagentur responsible for every AI system?

No. § 2 Absatz 1 KI-MIG assigns responsibility to it, insofar as nothing else is determined. In regulated areas, sector authorities remain responsible, such as BaFin for the financial sector and state media authorities for media offerings. For non-regulated mid-market companies, the Bundesnetzagentur is the contact.

Am I now facing 35 million euros in penalties?

This amount comes from Article 99 of the AI Regulation and concerns prohibited practices. The national penalty framework under the KI-MIG according to § 15 Absatz 3 is up to 50,000 euros and primarily applies to refused information and missing explanations. For small and medium-sized enterprises, Article 99 Absatz 6 also caps European penalties at whichever of the two amounts is lower.

Where does someone complain about an AI system in my business?

At the Central Complaint Office pursuant to § 8 KI-MIG, which is located at the Bundesnetzagentur. Complaints feed into supervision planning and can trigger an investigation. This is the most realistic way that a mid-market business gets involved in a proceeding at all.

Does information from the Bundesnetzagentur cost anything?

The KI Service Desk is a low-threshold information service offered by the authority for companies, authorities, and organizations. It does not replace individual case legal review, but clarifies classification issues before you commission external consulting.

KI-MIG: Why the Bundesnetzagentur is Now Germany's AI Regulator