Summary
Germany's KI-MIG (AI Market Surveillance and Innovation Promotion Act) entered into force on July 29, 2026, designating BaFin as the financial sector AI authority. The law creates a hybrid enforcement model: Bundesnetzagentur handles general AI surveillance, BaFin handles financial sector AI. Compliance has two layers: immediate transparency obligations (chatbot disclosure, enforceable Aug 2) and deferred high-risk requirements (credit scoring, insurance pricing, enforceable Dec 2027). Fines reach €35M or 7% of global turnover for prohibited practices.
Key Points
- KI-MIG effective July 29, 2026; Germany missed EU's Aug 2, 2025 deadline for AI authority designation
- Hybrid model: Bundesnetzagentur (general AI), BaFin (financial sector), BfDI (GDPR intersection)
- BaFin monitors AI used in "direct connection with regulated financial activities"
- Transparency obligations (Article 50): chatbots must identify as AI — enforceable Aug 2, 2026
- Fines: up to €15M or 3% of global turnover for transparency/high-risk violations
- Prohibited AI practices: sensitive data collection leading to discrimination — fines up to €35M or 7%
- High-risk AI (credit scoring Annex III 5(b), insurance pricing): enforceable Dec 2, 2027
- BaFin published AI ICT risk guidance Dec 2025: AI = ICT asset in DORA-compliant risk frameworks
- Institutions must maintain complete AI inventory including "shadow AI" in standard software
- BaFin President Branson: "People have to be able to trust that their fundamental rights will be protected"
- BaFin's enforcement history contested (Wirecard scandal); first major AI action expected early 2028
- Obermöller (BaFin Director-General): sanctions "the exception" for institutions that engage early