KI-MIG analysis: Bundesnetzagentur at AI Act center

German AI compliance just acquired a front desk. According to the Bundesnetzagentur, Germany's KI-MIG entered into force on 2026.07.29 and gives the agency an immediate role in implementing the European AI Act. That is not poetry, it is routing information. If your AI system is placed on the German market, the question is no longer only what Brussels wrote, but which German authority receives the complaint, watches the market, and starts asking for files.

The regulator now has

a name The Bundesnetzagentur says KI-MIG makes it the market surveillance authority, single point of contact, and point for complaints for the AI Act in Germany. Heise described the same handoff as the Federal Network Agency taking over market surveillance, complaints, and innovation promotion under the AI Act. For builders, this is the practical layer that often matters first: where supervisory expectations will be published, where complaints may surface, and which authority will be associated with market monitoring. Gleiss Lutz places the German move inside the wider EU calendar. The AI Act entered into force on 1 August 2024, member states had implementation obligations to define competent authorities and enforcement powers by 2 August 2025, the Federal Cabinet adopted a draft KI-MIG on 11 February 2026, and the AI Act will apply directly from 2 August 2026. The Bundesnetzagentur then reported that KI-MIG entered into force on 2026.07.29. The calendar is a useful antidote to compliance theater. The EU regulation is directly applicable, but national implementation decides who does what at home. Article 70, as summarized by Gleiss Lutz, means Berlin had to designate at least one notifying authority and at least one market surveillance authority, including a central market surveillance authority. In plain English: someone has to own the inbox.

What KI-MIG changes in practice

Regulations.ai summarizes Germany's KI-MIG as implementing Regulation (EU) 2024/1689 and designating the Bundesnetzagentur for oversight while fostering responsible AI innovation and fundamental rights protection. That combination is doing real work. Market surveillance is the part that asks whether systems offered in the market comply. Innovation support is the part that tries not to make every product team treat the regulator as a locked door with a fax machine behind it. The Bundesnetzagentur's own notice is more operational: it becomes the market surveillance authority, single point of contact, and complaints point. Article 52 style LinkedIn commentary may tell you to redesign your entire company by Monday; KI-MIG tells you to update the regulatory map. Vendor contracts, incident escalation paths, and customer facing compliance materials should now know which German authority is relevant when AI Act questions become concrete.

Germany is turning

EU text into supervisory plumbing Technology's Legal Edge reported that the Federal Government's draft KI-MIG set out Germany's supervisory architecture, enforcement powers, and penalty regime for AI systems under the EU AI Act. That architecture matters because the AI Act's risk classifications do not enforce themselves. A high risk label is a checklist only after somebody can request documents, inspect obligations, and process complaints. Gleiss Lutz also notes that a draft bill in the last legislative period had not been passed and that the later Federal Cabinet draft was adopted to avoid infringement proceedings by the European Commission and reduce legal uncertainty for companies and authorities. Translation: Germany was not adding decorative bureaucracy. It was filling a missing national implementation layer that the EU framework expected member states to provide. This is where two governance levels meet awkwardly. Brussels writes harmonized rules, but Berlin names the German desks and powers. Builders operating across the EU still need a cross border compliance model, yet German market activity now has a more identifiable supervisory path. That does not eliminate ambiguity, but it narrows where to look first.

What builders should watch next

Heise's summary of the new law points to three areas companies should monitor: market surveillance, complaints, and innovation promotion. The first tells you what evidence the authority may care about. The second tells you how unhappy users, customers, or competitors may bring issues into the system. The third may shape how compliant experimentation is encouraged rather than merely tolerated. The useful work now is mundane. Keep an AI Act inventory, map which systems touch the German market, record the basis for risk classification, and align customer support with regulatory escalation. If the Bundesnetzagentur starts publishing guidance, consultation material, or complaint handling patterns, treat those as implementation signals, not public relations. The law is now less abstract because the mailbox has a name. For readers building, buying, or teaching with AI systems in Germany, the next watch point is how the Bundesnetzagentur translates its new role into routine supervision. The first serious test will not be a speech. It will be the first compliance request that asks for the document your team either kept or wished it had.