One Regulator, Not Twelve
Germany's Act on Market Surveillance and Innovation Promotion of Artificial Intelligence (KI-MIG) entered into force on July 29, 2026, days ahead of the EU AI Act's August 2, 2026 deadline for direct application of the high-risk and transparency provisions (Articles 6–27). Under Section 2 of the law, the Bundesnetzagentur — Germany's telecoms and energy-network regulator — becomes "die für die Einhaltung der Verordnung (EU) 2024/1689 zuständige Marktüberwachungsbehörde," the market surveillance authority responsible for compliance with the EU AI Regulation (gesetze-im-internet.de). BaFin, the financial supervisor, keeps a narrower lane: Section 2(3) gives it jurisdiction only over AI systems "in direktem Zusammenhang mit einer regulierten Finanztätigkeit" — directly connected to a regulated financial activity — at institutions it already supervises.
This is the sensible design choice buried in a law that's gotten less attention than it deserves. The EU AI Act (Regulation 2024/1689) leaves it to each of the 27 member states to designate market-surveillance authorities under Article 70, and several have opted for fragmented, sector-by-sector regimes that force a company deploying AI across multiple business lines to negotiate with different regulators for different products. Germany's Digital Ministry took the opposite path: consolidate almost everything in one agency, with a single AI Service Desk, regulatory sandboxes ("KI-Reallabore"), and one complaints portal, plus a dedicated Coordination and Competence Centre (KoKIVO) to pool expertise rather than duplicate it across ministries (BMDS press release). Federal Digital Minister Karsten Wildberger framed it as a competitiveness move, saying the law "creates legal certainty for investments" and "strengthens AI as Germany's location." The Bundestag passed the bill on June 11, 2026, with the CDU/CSU–SPD coalition in favor and the Greens, Left Party and AfD opposed (Bundestag record).
The Legitimate Objection
The dissent isn't from industry — it's from Germany's own data protection apparatus, and it deserves to be taken seriously rather than waved off as bureaucratic turf-guarding. Berlin's data protection commissioner, Meike Kamp, argued that routing AI oversight through a telecoms regulator rather than through data protection authorities amounts to "a massive weakening of fundamental rights," since the EU AI Regulation's underlying logic ties high-risk AI scrutiny to exactly the kind of rights-impact analysis data protection bodies already do for algorithmic systems under the GDPR. Kamp's sharper point is structural: state-level data protection authorities have existing statutory competence and case experience evaluating AI used in policing, welfare administration, and other core state functions, and centralizing that review inside a federal network regulator that has none of that history raises real questions about who catches a discriminatory fraud-detection algorithm or a flawed benefits-eligibility model before it does damage to individuals (LDI NRW).
That's a fair critique, and Germany's answer to it — the independent AI Market Surveillance Chamber (UKIM), established inside the Bundesnetzagentur under Section 4 specifically to review sensitive high-risk categories like biometrics and law enforcement — is only as good as its independence turns out to be in practice. A chamber housed inside the agency it's meant to check is not the same guarantee as an autonomous data protection authority with its own budget and appointment process. That's worth watching, not dismissing.
Why Consolidation Still Wins on Balance
But the fundamental-rights objection, taken to its logical end, argues for the fragmented model the rest of the EU is now stuck untangling — and fragmentation has its own victim: the mid-sized company that can't tell which of four regulators has jurisdiction over its product, and burns compliance budget on jurisdictional mapping instead of on the actual risk controls the AI Act demands. A single point of contact with real technical capacity, which is what the Bundesnetzagentur is being built into via KoKIVO, is more likely to develop the specialized competence to evaluate a high-risk system's technical documentation than eighteen sub-scale sectoral bodies each seeing a handful of AI Act cases a year. The stakes of getting this wrong are real: Article 99 of the EU AI Act sets fines up to €35 million or 7% of global turnover for prohibited-practice violations and up to €15 million or 3% for other high-risk non-compliance (Article 99, EU AI Act) — numbers large enough that regulatory clarity is itself a competitiveness input, not a nicety.
The better fix isn't reverting to per-sector fragmentation — it's making the Bundesnetzagentur's fundamental-rights review demonstrably rigorous: publish UKIM's caseload and reasoning, give data protection authorities a formal consultation role on Annex III cases touching policing or welfare, and revisit the design if early enforcement shows the gap Kamp warned about materializing. Germany chose institutional clarity over institutional pluralism. That's the right call for innovation and legal certainty — provided the fundamental-rights guardrail inside the new structure is real, not decorative.