Germany: AI Act implementing law (KI-MIG) clears the Bundesrat, oversight goes to the Bundesnetzagentur

The law implementing the AI Act (the Gesetz zur Durchführung der Verordnung über künstliche Intelligenz), whose Article 1 is the KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz (KI-MIG), cleared the Bundesrat at its 1067th sitting on 10 July 2026 – a committee recommendation to demand the mediation committee, reasoned on the ground that market surveillance should be centralised federally instead of being left to the Länder, failed to gain a majority, so the law can now be signed and promulgated. The Bundesnetzagentur (Federal Network Agency) becomes the central market surveillance authority (§ 2(1)), the single point of contact under the third sentence of Article 70(2) (§ 6(1)) and the central complaints office (§ 8(1)); it hosts a coordination and competence centre (§ 5) and an independent AI market surveillance chamber, the KI-Marktüberwachungskammer (§ 4), made up of the agency's president and two vice-presidents, which acts entirely independently and takes no instructions, deciding on high-risk systems under Annex III points 6 to 8 (law enforcement, migration and borders, justice and democratic processes) and on biometrics under point 1 where deployed for law enforcement, border management, justice and democracy. Financial-sector AI supervision goes to BaFin (§ 2(3)), while systems of Länder public bodies and of media service providers fall to the competent Land authorities (§ 2(6) and (8)); the federal and Länder data protection authorities are not market surveillance authorities and are merely to be involved where their remit is affected (§ 9(4)). Beyond oversight, the law requires the Bundesnetzagentur to set up and operate at least one AI regulatory sandbox under Articles 57 and 58 (§ 13(1)) and to take innovation-promoting measures – general information and guidance, advice to public bodies, and training (§ 12). The German fine of up to EUR 50,000 (§ 15(3)) covers not only failures to inform the authorities (Articles 21 and 45) but also failure to carry out the fundamental rights impact assessment under Article 27 and a deployer's failure to ensure an affected person is given the explanation required by Article 86; the AI Act's own sanctions are unaffected, and no fines at all are imposed on authorities and public bodies (§ 17(2)). The law enters into force the day after its promulgation.