Summary
Germany's financial regulator BaFin formally acquired its AI oversight mandate on July 29, 2026, when the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) entered into force. BaFin can now scrutinize, sanction, and fine banks and insurers that misuse AI — covering algorithms that decide who gets a loan, what insurance premium someone pays, and whether a chatbot identifies itself as a machine. Transparency obligations (chatbot disclosure) become enforceable from August 2, 2026. Full high-risk AI requirements for credit scoring and insurance pricing become enforceable in December 2027.
Key Facts
- KI-MIG law effective July 29, 2026; Bundestag passed June 11, Bundesrat approved July 10
- BaFin monitors AI used in direct connection with regulated financial activities
- Transparency obligations (Article 50 EU AI Act) enforceable from August 2, 2026
- Chatbots must clearly identify themselves as AI; fines up to €15M or 3% of global turnover
- High-risk AI (credit scoring, insurance pricing) enforceable from December 2, 2027 (per EU Digital Omnibus)
- Prohibited AI practices: collecting sensitive personal data leading to discrimination — fines up to €35M or 7% of global turnover
- BaFin will review a sample of AI applications, not every system at every institution
- BaFin published guidance on AI ICT risks in December 2025 (DORA-compliant)
- BaFin President Mark Branson: "People have to be able to trust that their fundamental rights will be protected when AI is used"
- BaFin's enforcement history contested (Wirecard scandal); first major AI action expected early 2028
Why It Matters
Germany is among the first major EU economies to translate the EU AI Act into live, sector-specific enforcement inside financial services. The KI-MIG creates a hybrid model: Bundesnetzagentur handles general AI surveillance, BaFin handles financial sector AI. For banks and insurers operating in Germany, the compliance picture has two layers: immediate transparency obligations (chatbot disclosure, AI content identification) and deferred high-risk requirements (credit scoring, insurance pricing). The key question is whether BaFin — an agency with a contested enforcement history — will actively deploy its new powers or maintain its historically restrained posture.