Germany's AI Market Surveillance and Innovation Promotion Act (KI-MIG) — the national law implementing the EU AI Act — was published in the Bundesgesetzblatt on July 28, 2026 and entered into force the next day, July 29. The Bundestag passed it on June 11, 2026, with the governing CDU/CSU–SPD coalition in favor and AfD, the Greens, and the Left opposed. Its practical effect: Germany's federal financial regulator, BaFin, now has explicit statutory market-surveillance authority over AI systems used by the banks, insurers, and fintechs it already supervises.
What BaFin actually got
The law splits Germany's AI oversight rather than centralizing it in one body. The Bundesnetzagentur (Federal Network Agency, BNetzA) becomes the general national coordinator and market-surveillance authority for most AI applications, running a coordination office and an AI Service Desk. BaFin's slice is narrower and sector-specific: it supervises AI systems only when they are "used in direct connection with a regulated financial activity" at an institution BaFin already oversees — roughly 1,740 banks, 674 financial services institutions, and 469 insurance undertakings and pension funds, per BaFin's own published figures. HR software, marketing tools, or other AI at the same firms falls to BNetzA instead, a division designed to prevent the dual-supervision mess that plagued early drafts of the implementing legislation.
What's live today is narrower than the headlines about BaFin's new powers suggest. The AI Act's Article 5 prohibited-practices ban (things like social scoring and certain biometric categorization) has applied EU-wide since February 2, 2025. What changed on August 2, 2026 is Article 50: transparency obligations requiring that AI chatbots, and AI-generated or altered content, be clearly disclosed to users — with a transition period through December 2, 2026 for systems already on the market. BaFin President Mark Branson framed the rationale plainly: "People have to be able to trust that their fundamental rights will be protected when AI is used."
The part that got pushed back — and why that's defensible
The more consequential piece of the AI Act for finance — Annex III's high-risk conformity-assessment regime, which classifies AI-driven creditworthiness evaluation and life/health insurance risk-scoring as "high risk" and subjects it to bias audits, human-oversight requirements, and documentation obligations — was supposed to bind from August 2, 2026 alongside the transparency rules. It won't. The EU's Digital Omnibus on AI, adopted by Parliament on June 16, 2026, given final Council sign-off on June 29, and in force since July 27, pushed the Annex III compliance deadline to December 2, 2027, a sixteen-month deferral that applies EU-wide, not just in Germany.
The case for the original August 2026 deadline was not frivolous. Credit-scoring and insurance-underwriting algorithms make decisions with direct, material consequences for people's access to housing, credit, and healthcare, and they're exactly the kind of opaque, high-stakes system the AI Act's high-risk tier was built to catch. A lender using an AI-driven scoring model that quietly encodes proxies for protected characteristics is a real and documented harm category, and financial regulators have legitimate grounds to want conformity assessments in place before deployment continues.
But compressed timelines produce compliance theater, not compliance. The Digital Omnibus deferral doesn't touch the transparency rules, the prohibited-practices ban, or general-purpose AI obligations — all of that stays on schedule. What it defers is the single most technically demanding requirement in the entire regulation: building, documenting, and having audited a full high-risk conformity-assessment pipeline, for systems that are often deeply embedded in decades-old core banking infrastructure. Rushing that against an August 2026 deadline that regulators themselves weren't fully staffed to enforce would have meant either mass non-compliance or superficial box-ticking that satisfies the letter of Annex III without improving a single scoring decision. Sequencing disclosure obligations now — which are comparatively cheap to implement and directly address the "did I know I was talking to a bot" harm — ahead of the harder structural fix is the more credible path to actual compliance, not regulatory retreat.
What to watch
The risk is not that Germany or the EU went soft on AI credit-scoring; the underlying Annex III obligations are unchanged, only delayed. The risk is enforcement capacity. BaFin's press materials describe the mandate but, notably, don't publish resourcing figures for how many staff will actually review AI systems at nearly 3,000 supervised entities. A market-surveillance power that exists on paper but isn't staffed to investigate complaints is not meaningfully different from no power at all. The December 2027 deadline gives both regulators and industry genuine runway — the test is whether BaFin uses it to build real technical capacity, not just a complaints inbox.