GermanyGesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz… KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20
In force since .
An AI governance rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).NIST AI RMFGOVERN 1.1NIST AI RMFMAP 5.1NIST AI RMFMEASURE 2.9
- If you provide a high-risk AI system listed in point 2 of Annex III to the Regulation, you or your authorised representative must register you and the system in the Bundesnetzagentur's non-public register before you place the system on the market or put it into service, supplying the information that Annex VIII, Section A lists. This duty does not apply to a public body of a Land.NIST AI RMFGOVERN 1.1
- If you are a federal public body that deploys a high-risk AI system listed in point 2 of Annex III to the Regulation, you must register yourself and the system in the same register before you put the system into service or use it, supplying the information that Annex VIII, Section C lists.NIST AI RMFGOVERN 1.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-09Information Security
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- 1.1Board Structure & Oversight
- 1.2Risk Management
- 3.5Post-deployment Monitoring
- 4.1System Documentation
- 4.2Risk Disclosure
- 4.3Incident Reporting
1 more
- 4.5Third-Party System Access
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
This is KI-MIG's own national administrative fine, reaching only the specific national duties that § 15 lists: failing to inform or document under Article 21, failing to carry out or update a fundamental rights impact assessment under Article 27, failing to inform a notifying body under Article 45, or failing to explain a decision to an affected person under Article 86.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 50,000
Who enforces it
Enforcement body
The Bundesnetzagentur is Germany's central market surveillance authority for the EU AI Act, except that the Bundesanstalt für Finanzdienstleistungsaufsicht is the market surveillance authority for an AI system directly connected to a regulated financial activity carried out by a financial undertaking it already supervises, a competent Land authority is the market surveillance authority where a Land public body, or a broadcaster or media service provider, deploys an AI system for a journalistic or advertising purpose, the authorities already responsible for the Annex I Section A product legislation act where an AI system relates to such a product, and another financial supervisor acts for a financial firm the Bundesanstalt für Finanzdienstleistungsaufsicht does not supervise.
Settledness
- As of
- Open questions
- Does 'öffentliche Stellen der Länder' in section 2(6) KI-MIG cover a private company that runs an AI system for a Land body under contract, so that a Land authority and not the Bundesnetzagentur supervises that company?
- Which authority is 'nach Landesrecht zuständig' under section 2(6) and (8) KI-MIG for a provider that serves Land bodies or media services in several Länder?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 11 gives Germany's market surveillance authorities the powers under Article 14(4) and (5) and Article 16 of the Market Surveillance Regulation (EU) 2019/1020, which include requiring an economic operator to provide relevant documents, technical specifications, data or information, alongside on-site inspection and technical-examination powers. The clause does not itself create a logging capability or say what must be recorded; it requires the party to produce documentation and information on demand. Section 18 separately continues the AI Act's own Article 18(1) technical-documentation duty through a provider's or representative's dissolution, without independently stating a retention period of its own; that period is the EU AI Act's own, in its Article 18(1).
- Kind
- Implicit
- As of
- Provision
- § 11 Abs. 1
- Trigger
- all_systems
What this law does
KI-MIG names the Bundesnetzagentur as Germany's central market surveillance authority for the EU AI Act. The Bundesnetzagentur is also the Regulation's single point of contact under Article 70. The Bundesnetzagentur is the Regulation's central complaints office under Article 85. The Bundesanstalt für Finanzdienstleistungsaufsicht is instead the market surveillance authority for an AI system that a regulated financial undertaking it already supervises places on the market.
A competent Land authority is the market surveillance authority instead where a Land public body deploys an AI system. A competent Land authority is also the market surveillance authority where a broadcaster or media service provider deploys an AI system for a journalistic or advertising purpose. A person who fails to carry out or update the fundamental rights impact assessment that Article 27 requires commits a national administrative offense.
The operator of a high-risk AI system under point 1, 3, 4 or 5 of Annex III who fails to give an affected person the explanation Article 86 requires commits the same national administrative offense. That administrative offense is punishable by a fine of up to 50,000 euros. A violation of the Regulation under Article 99(3) to (5) is instead prosecuted in Germany through the OWiG administrative-offense procedure.
The Bundesnetzagentur separately operates at least one KI-Reallabor, an AI regulatory sandbox, under Articles 57 and 58. A provider of a high-risk AI system listed in point 2 of Annex III to the Regulation, or its authorised representative, must register itself and the system in the Bundesnetzagentur's non-public register before placing the system on the market or putting it into service. That provider duty does not apply to a public body of a Land.
A deployer that is a federal public body must register itself and such a system in the same register before putting the system into service or using it.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .