Updated May 2026 to reflect the Digital Omnibus agreement of 7 May 2026, which pushes the AI Act high-risk enforcement deadline from August 2026 to December 2027.
The EU AI Act is already partially in force across the European Union — including in Germany.
While the regulation applies directly in all EU member states, each country must still organise how supervision, enforcement, and innovation support will work nationally.
Germany has now taken major steps in that direction. In February 2026, the federal government approved a draft national implementation law called the KI‑Marktüberwachungs‑ und Innovationsförderungsgesetz (KI-MIG).
The law still needs to pass the German Bundestag and Bundesrat before it enters into force. Separately, the final enforcement phase of the AI Act has been pushed from August 2026 to December 2027, following the agreement on the Digital Omnibus package reached by the Council of the European Union and the European Parliament on 7 May 2026.
For German SMEs, the key takeaway is simple:
The regulatory framework is already taking shape — and companies should start preparing now.
For a comprehensive analysis of Germany’s AI Act implementation — including enforcement architecture, SME exposure, and business climate — see the EU AI Act in Germany — Country Intelligence Brief. A German-language version is also available here.
Germany’s Approach to AI Regulation
The German government has chosen a strategy described as “schlanke KI-Aufsicht” (lean AI supervision).
The idea is to avoid adding national requirements beyond the EU regulation and instead rely on existing regulators.
The central authority will be the Bundesnetzagentur, headquartered in Bonn.
BNetzA will coordinate AI oversight across Germany and act as the main interface with the European AI Office, which supervises AI implementation at EU level.
Sector regulators will continue to handle domain-specific issues, such as:
- BaFin for financial sector AI
- Competition authorities for market issues
- State media regulators for transparency rules affecting journalism and deepfakes
Inside BNetzA, a new competence centre called KoKIVO (Koordinierungs- und Kompetenzzentrum) is planned to support other regulators and act as Germany’s AI expertise hub.
For country-level intelligence on Germany’s AI Act readiness, enforcement outlook and supervisory architecture, visit the Germany country profile on the EU AI Act Intelligence Hub.
What Parts of the AI Act Already Apply in Germany
Although the main enforcement phase arrives in 2027, some obligations already apply.
Since 2 February 2025, the following provisions of the AI Act have been active across the EU:
- Ban on certain prohibited AI practices
- AI literacy obligations (Article 4)
- Initial transparency requirements
These rules already apply to companies operating in Germany — including SMEs using AI tools internally.
If you need a detailed breakdown, see the guide on → AI Act implementation timeline.
Key Milestones for AI Regulation in Germany
Below is a simplified overview of the most important regulatory developments affecting businesses.
| Year / Date | Regulatory Landmark | What It Means for German SMEs |
|---|---|---|
| February 2025 | First AI Act provisions apply | AI literacy requirements and bans on prohibited AI systems enter into force |
| Mid-2025 | BNetzA launches KI-Service Desk | SMEs gain a contact point for questions on AI Act compliance |
| February 2026 | Cabinet adopts draft KI-MIG law | Germany defines its AI supervision structure |
| 2026 (ongoing) | Parliamentary approval process | Bundestag and Bundesrat must approve KI-MIG |
| December 2027 | Main AI Act enforcement phase | High-risk AI rules and most obligations become fully applicable |
| 2026-2027 | Sandboxes and guidance | National AI sandbox and compliance guidance expand |
Support Tools for SMEs in Germany
Germany’s implementation strategy places particular emphasis on helping small and medium-sized companies (KMU) comply with the new rules.
Several initiatives are already available or planned.
KI-Service Desk
The KI-Service Desk run by the Bundesnetzagentur provides a low-threshold advisory service for organisations with questions about the AI Act.
Companies can receive guidance on:
- risk classification of AI systems
- compliance obligations
- documentation and governance requirements
For SMEs without large legal teams, this is expected to become the first entry point for regulatory questions.
Compliance Kompass
Another tool that is already live and usable for German SMEs is an interactive “Compliance Kompass” that helps companies determine:
- whether their system is high-risk
- which AI Act obligations apply
- what compliance steps are necessary
This tool aims to simplify the otherwise complex classification process. German SMEs can already use the Bundesnetzagentur’s online Compliance Kompass as a first, free check of how their AI use will be classified under the EU AI Act.
For background, see → AI Act risk categories explained.
AI Regulatory Sandboxes (KI-Reallabore)
Under the KI-MIG law, Germany must establish at least one AI regulatory sandbox.
These sandboxes allow companies to:
- test AI systems under regulatory supervision
- receive guidance from authorities
- identify compliance risks before market deployment
SMEs and startups are expected to receive priority access.
This is particularly useful for companies developing high-risk AI systems, such as those used in HR, finance, or critical infrastructure.
For more detail see → High-risk AI systems under the EU AI Act.
What Still Needs to Happen
Despite the progress, several elements of Germany’s AI regulatory framework are still under development.
Parliamentary approval of KI-MIG
The draft law adopted by the federal cabinet must still pass both chambers of Parliament.
Only then will the supervisory structure and operational procedures become legally binding.
Implementing rules and guidance
Even after the law passes, authorities still need to issue additional rules covering:
- supervisory procedures
- fees and administrative processes
- sandbox participation criteria
EU technical standards
Another challenge comes from the European level.
The harmonised technical standards that will define how companies demonstrate compliance with the AI Act are still being developed.
Many industry groups argued this uncertainty made it difficult to plan compliance efforts ahead of the August 2026 enforcement deadline. That deadline has since been pushed to December 2027 following the agreement on the Digital Omnibus package reached by the Council of the European Union and the European Parliament on 7 May 2026.
Practical Steps German SMEs Should Take Now
Waiting until the final legislation passes is risky.
Companies that start preparing early will have a much easier transition.
1. Create an AI inventory
List all systems and tools in your organisation that use AI, including:
- generative AI tools
- HR screening software
- predictive analytics systems
- automated decision-making tools
2. Determine your role under the AI Act
Companies may have different responsibilities depending on whether they are:
Each role has different compliance obligations.
3. Classify risk levels
Use available tools — such as the Compliance Kompass — to determine whether your AI systems fall into:
- minimal risk
- limited risk
- high risk
This classification determines the regulatory burden.
4. Establish basic AI governance
Even simple governance policies can significantly reduce compliance risks.
These may include:
- documentation of AI systems used internally
- clear internal rules on AI use
- human oversight procedures
- transparency guidelines for employees and customers
For a practical template, see → AI Act compliance checklist for SMEs.
Why Germany’s Implementation Matters for Businesses
Germany is the largest economy in the European Union and home to a large base of industrial SMEs (Mittelstand).
How the country implements the AI Act will therefore strongly influence:
- compliance costs
- innovation conditions
- regulatory clarity for businesses
By opting for a lean supervisory model, the German government aims to ensure that regulation does not hinder innovation — particularly for smaller companies.
However, the transition period between now and December 2027 remains challenging due to regulatory uncertainty.
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
FAQs
When does the AI Act fully apply in Germany?
Most provisions become fully applicable in December 2027, when the high-risk AI regime enters into force, following the Digital Omnibus agreement of 7 May 2026.
Which authority will supervise AI in Germany?
The central authority will be the Bundesnetzagentur (BNetzA), supported by sector regulators such as BaFin and regional media authorities.
Is the German AI implementation law already in force?
Not yet. The KI-MIG law was adopted by the federal cabinet in February 2026 but still needs approval by the Bundestag and Bundesrat.
Will Germany add stricter rules than the EU AI Act?
The government has stated that it aims to avoid “gold-plating”, meaning it will not introduce additional national requirements beyond the EU regulation.
What support is available for SMEs?
German SMEs will benefit from:
- the KI-Service Desk at the Bundesnetzagentur
- the Compliance Kompass classification tool
- AI regulatory sandboxes where systems can be tested with regulatory guidance
