Germany's AI Authority Goes Live: What the Bundesnetzagentur Means From 2 August
Germany's AI market surveillance law (KI-MIG) entered into force on 29 July 2026, the Bundesnetzagentur is operational – and from 2 August 2026 an online complaints form lets any natural or legal person report violations, competitors included. A sober look at what that means in practice.
Christian Lechner
Since 29 July 2026, AI supervision in Germany has an address: the AI Market Surveillance and Innovation Promotion Act (KI-MIG) is in force, making the Bundesnetzagentur the official market surveillance authority, single point of contact, and complaints office for the EU AI Act. A few days later, on 2 August 2026, the transparency obligations of Article 50 start to apply – and the authority switches on its online complaints form.
The news is not that rules exist: those have been settled since 2024. What is new is that there is now a concrete, low-threshold way to report violations – and an authority responsible for handling them. This article explains what the KI-MIG does, who supervises what, and what follows in practice.
What the KI-MIG Does
The KI-MIG is Article 1 of the German act implementing Regulation (EU) 2024/1689. The legislative path:
- Bundestag: 11 June 2026
- Bundesrat: 10 July 2026
- Signed: 22 July 2026
- Promulgated: 28 July 2026 (Federal Law Gazette, BGBl. 2026 I No. 223)
- In force: 29 July 2026
Substantively, the law does not create a new authority – it distributes tasks among existing ones. Federal Minister Wildberger put it this way: "We are not building an additional bureaucratic authority."
The Bundesnetzagentur has backed its new role with four building blocks that are already live:
- AI Service Desk – information and orientation, including an "AI Compliance Compass" for risk classification
- Complaints office – the reporting channel for suspected violations
- KoKIVO – coordination and competence centre for aligning the authorities involved
- AI regulatory sandbox – a test environment for AI applications
Bundesnetzagentur President Klaus Müller said on 29 July 2026: "In its new role, the Bundesnetzagentur will ensure both safety and the protection of fundamental rights, and promote innovation."
One detail stands out: the law does not regulate penalties itself. The KI-MIG instead orders the corresponding application of the German Administrative Offences Act (OWiG), which makes the local courts (Amtsgerichte) the courts of first instance. Legal trade press (LTO) considers this "unfortunate" given the potential size of the fines and the complexity of the subject matter – a point likely to be debated further in practice.
Who Supervises What
Germany has not created a single AI regulator but a network of existing supervisory bodies:
| Area | Competent body |
|---|---|
| Residual competence, radio equipment, Annex III areas (e.g. HR, education, critical infrastructure) | Bundesnetzagentur |
| Financial sector | BaFin |
| Media | State media authorities |
| Medical devices (from 2027) | BfArM |
| Further bodies involved | BSI, BfDI and the state data protection authorities |
For most website operators, online shops, and agencies, the Bundesnetzagentur is therefore the relevant address – it holds the residual competence, and Article 50 transparency duties fall into none of the sector-specific areas.
One clarification for the public sector: public bodies of the federal states and municipalities are not subject to market surveillance by the Bundesnetzagentur.
The Complaints Office: Online From 2 August
The most practically relevant part of the new supervision is the complaints office. Complaints run through an online form that goes live on 2 August 2026. The key facts:
- Free of charge – no fees for filing
- No formal requirements – no prescribed structure or reasoning
- No deadline – complaints are not bound by a limitation period
- Open to everyone – any natural or legal person may file
That last point deserves attention. "Any legal person" explicitly includes competitors. Whoever files does not have to be affected themselves or demonstrate an infringement of their own rights. The channel is therefore not just for consumers – in practice it is open to anyone in the market who looks closely.
The process is standardised: receipt → acknowledgement → assessment or forwarding to the competent body → notification of the decision. A complaint does not automatically trigger proceedings – it first enters a preliminary assessment, and if another authority is competent, it gets forwarded.
Important for anyone publishing AI content: the transparency obligations under Article 50 are explicitly listed on the Bundesnetzagentur complaints page as a possible subject of complaint. Missing or unclear AI labelling is therefore not a footnote of the regulation but an expressly foreseen reason to report.
Two Routes, Not One
Anyone assessing the risk soberly should distinguish two separate paths.
The regulatory route. Violations of Article 50 can be fined under Art. 99(4)(g) with up to €15 million or 3% of global annual turnover – whichever is higher. For context: the frequently quoted €35 million / 7% do not apply to transparency violations, only to the prohibited practices under Article 5.
The unfair competition route. The second path does not involve an authority at all. Article 50 is widely regarded as a market conduct rule within the meaning of Section 3a of the German Act Against Unfair Competition (UWG). In its guide "Labelling of AI-Generated Content" (version 1.1, as of 4 February 2026), the Wettbewerbszentrale writes that violations of the AI Regulation may "also constitute unfair competition under the UWG, so that competitors and associations can assert injunctive relief".
Honesty requires the caveat: this has not been settled by the highest courts. There is a serious counter-argument – the so-called blocking effect: Section 3a UWG does not apply where the specialised norm contains a conclusive sanctions regime. Exactly that was disputed for years in relation to the GDPR. The defensible formulation is therefore: Article 50 violations are widely regarded as actionable via cease-and-desist letters, but the question has not yet been decided in court.
And one expectation should not be built up: there is no official grace period. Neither the Bundesnetzagentur nor the responsible ministry has announced leniency, an "advice before penalties" principle, or specific enforcement priorities. The eco association called for exactly that on 31 July 2026: managing director Alexander Rabe demands "advice, EU-wide coordinated interpretation and proportionality" for the initial phase and calls the EU guidelines, published only 13 days before the rules applied, "a false start you could see coming". Whether and how the supervisory authorities respond remains to be seen.
What to Do Now
The to-do list is short and unspectacular – which is precisely the point:
- Take inventory: Where do you use AI across your channels? Images, text, chatbots, product descriptions, social posts.
- Label: Visibly on the content itself – plus a machine-readable layer (Schema.org, IPTC) so the labelling can be read technically.
- Disclose chatbots: Users must be able to recognise that they are interacting with an AI system.
- Document: Record what was labelled and when. In an audit or complaint, what counts is what you can prove.
- Clarify competence: In regulated sectors (finance, media, medical devices) your counterpart is the sector regulator, not the Bundesnetzagentur.
If you want a structured starting point, the free EU AI Act Check provides one.
Putting It in Perspective
For a typical mid-sized company, a Bundesnetzagentur fine proceeding over an unlabelled AI stock photo is an unlikely scenario. Authorities prioritise, and supervision is only just starting. The more realistic risk looks different: a complaint or cease-and-desist letter from a competitor who looks closely – free to file, no need to be affected, and from 2 August just a few clicks away.
That is exactly why order pays off, not panic. Anyone who labels and documents AI content consistently removes the target for both routes – and no longer needs to worry about fine ceilings or unresolved UWG questions.
How AIActify Helps
AIActify automates precisely points 2 and 4 of that list: visible labels with the official EU AI icon, the machine-readable Schema.org layer, and immutable audit logs proving when which content was labelled. One script tag, roughly two minutes of setup – and in the event of a complaint you have evidence instead of a recollection.
---
Further reading: EU AI Act: Fines and Penalties Overview · AI Act Omnibus: New Deadlines
Sources: KI-MIG (AI Market Surveillance and Innovation Promotion Act), Art. 1 of the German act implementing Regulation (EU) 2024/1689, BGBl. 2026 I No. 223 of 28 July 2026; Bundesnetzagentur press release and information pages of 29 July 2026; Regulation (EU) 2024/1689 (EU AI Act), Articles 50 and 99; Wettbewerbszentrale, guide "Labelling of AI-Generated Content", version 1.1 (as of 4 February 2026); eco – Association of the Internet Industry, statement of 31 July 2026.
