On June 11, 2026, Germany's Bundestag passed the KI-MIG — the KI-Marktüberwachungs- und Innovationsförderungsgesetz — making Germany the first major EU member state to enact dedicated national legislation implementing the EU AI Act. The CDU/CSU and SPD coalition voted in favour; the AfD, Greens, and Left Party voted against. The same week, the federal cabinet's separate proposal to grant German federal police new social media facial recognition powers was advancing through its own legislative track. The collision between those two bills will define what EU AI Act compliance actually means in practice.
What the KI-MIG Actually Builds
The KI-MIG is not primarily a rulebook — those rules already exist in EU Regulation 2024/1689. It is an enforcement architecture. The law formally designates the Bundesnetzagentur (Federal Network Agency) as Germany's central AI market surveillance authority, with powers to investigate, sanction, and coordinate enforcement across the country's 16 states and its many sector-specific regulators. A Coordination and Competence Centre (KoKIVO) housed within the agency will pool expertise and provide a single point of contact for EU-level enforcement cooperation.
The law's most consequential provision for biometric surveillance is the creation of the Unabhängige KI-Marktüberwachungskammer (UKIM) — an independent chamber within the Bundesnetzagentur with exclusive oversight authority over AI systems deployed in law enforcement, migration and asylum, border control, and justice. Structurally, this means police-facing biometric AI is not supervised by a generalist telecom and energy regulator with dozens of other mandates, but by a purpose-built independent chamber. UKIM reports annually and directly to the Bundestag — not to the Federal Ministry of Interior that houses the very police forces it governs. That independence is the core design feature.
What the EU Framework Permits and Prohibits
The EU AI Act draws a sharp line on facial recognition, and it matters for what follows. Under Article 5(1)(h), real-time remote biometric identification of individuals in publicly accessible spaces for law enforcement purposes is a prohibited practice — an outright ban, not a high-risk category requiring safeguards. That prohibition entered force on February 2, 2025, more than sixteen months before the KI-MIG existed. August 2, 2026 marks not the start of the ban, but the full activation of the enforcement machinery that makes it meaningful: national market surveillance authorities gain formal investigation powers and Germany's entire AI Act compliance architecture goes live.
Post-hoc facial recognition — searching existing images or database records — is categorised differently. Under Annex III of the AI Act, retroactive biometric identification systems for law enforcement are high-risk AI. They are not banned, but they must meet substantial requirements: prior judicial or independent administrative authorisation for each operation, mandatory fundamental rights impact assessments, human oversight throughout the process, and registration in the EU database of high-risk AI systems. UKIM is precisely the independent administrative authorisation mechanism the AI Act envisions for this category.
The Police Bill's Uncomfortable Timing
In April 2026 — while the Bundestag was debating the KI-MIG — the federal cabinet published proposed amendments to §98e of the Code of Criminal Procedure that would grant the Federal Criminal Police Office (BKA), the Federal Police, and the Federal Office for Migration and Refugees legal authority to search social media platforms using facial recognition to identify criminal suspects. The government frames the proposal as explicitly post-hoc: no real-time camera surveillance, no permanent cross-platform databases. Officials argue it merely automates an already legally permitted manual process.
That framing is not entirely wrong. German police can lawfully match a suspect's photograph against available images. What the bill adds is scale, speed, and reach — querying Instagram, X, and other platforms algorithmically rather than through labor-intensive manual review. For proponents, this is an efficiency upgrade justified by genuine law enforcement needs: human traffickers, child abusers, and terrorism suspects often maintain social media profiles that represent real investigative leads unavailable through traditional means.
Civil society was unconvinced. More than a dozen organisations — including the Chaos Computer Club — argued that the practical effect is surveillance of anyone whose face appears in publicly accessible online images, regardless of suspicion level. Approximately 150,000 people signed a petition against the proposal within weeks of the cabinet announcement. A similar bill failed in 2024 partly due to Bundesrat resistance.
Two Tracks, One Question
The regulatory question posed by the police bill is more precise than whether it is advisable: does it pass the EU AI Act's legal test, and is it designed to work inside the oversight architecture the KI-MIG just built?
The bill's social media facial recognition searches squarely satisfy the Annex III definition of remote biometric identification systems used for law enforcement. That classification means BKA operations under the proposed law would be high-risk AI subject to UKIM's exclusive jurisdiction — requiring prior authorisation, human review, and mandatory Bundestag reporting through the same chamber whose creation the government just legislated. The Left Party's rejected amendment on June 11 called for a comprehensive moratorium on all biometric remote identification — a maximalist position that would have foreclosed legitimate post-hoc investigative uses alongside problematic ones. But it pointed at the right structural question: does UKIM actually govern each individual operation, or does it provide a rubber stamp for the Interior Ministry?
This is where the architecture built by KI-MIG either proves itself or becomes decoration. UKIM's independence is meaningful only if it reviews specific authorisation requests, scrutinises each deployment, and has the political standing to say no to the Interior Ministry's preferred tools. An oversight chamber that approves everything is not oversight.
The Test Is Now
Germany now has the most explicitly structured facial recognition governance regime in the EU, and a live test case for whether it functions as designed. The proportionate outcome is not a blanket ban on post-hoc law enforcement facial recognition — that would be disproportionate to the legitimate investigative purposes involved. It is §98e amendments that explicitly require UKIM authorisation for each social media biometric search, with mandatory judicial review and Bundestag reporting. That would demonstrate the KI-MIG's architecture is operational, not ceremonial.
The alternative — police capabilities expanding faster than oversight capacity, with UKIM sidelined into retrospective auditing rather than ex ante authorisation — is exactly the failure mode the EU AI Act's biometric provisions were written to prevent. Germany just installed the mechanism. Whether it runs is what the next legislative debate will decide.