KI-MIG: Who Enforces the AI Act in Germany

If your AI system breaks an EU AI Act rule in Germany, you need to know which authority fines you. The KI-VO sets the rules; it leaves enforcement to each Member State. Germany's answer is the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG), approved as a Regierungsentwurf by the federal cabinet on 11 February 2026.

The core designations in the cabinet draft: the Bundesnetzagentur (BNetzA) becomes the central market surveillance and notifying authority and hosts the coordination centre ("KoKIVO"). Under Art. 74(6) KI-VO, BaFin remains the market surveillance authority for AI in regulated financial services by operation of EU law; KI-MIG preserves other sectoral regulators in their existing mandates. Under Art. 74(8) KI-VO, law-enforcement and migration-related uses land in an independent KI-Marktüberwachungskammer at the BNetzA.

Art. 99 KI-VO's fine ceilings are unchanged: up to EUR 35 million or 7% of global turnover for prohibited practices, up to EUR 15 million or 3% for most other infringements, whichever is higher. Art. 99(6) flips that for SMEs and start-ups: the lower of the two amounts applies. A startup with EUR 2 million turnover therefore caps at EUR 140,000 for a Tier 1 violation, not EUR 35 million. KI-MIG adds the German administrative-offence procedure that channels those ceilings in practice.

Two things to update now. First, the page in your AI compliance docs naming your competent authority: BNetzA for most startups, BaFin if your product is a regulated financial-services tool. Second, your transparency-reporting and incident-flagging route; that also runs through the BNetzA. Among the AI questions founders bring me, "who would even notice?" is the most common. With BNetzA sitting on the file, that is the wrong question to start from.