Definition: KI-MIG (AI Market Surveillance Act)
KI-MIG is the common short name for Germany’s draft law implementing the EU AI Act, the Gesetz zur Marktueberwachung und Innovationsfoerderung von kuenstlicher Intelligenz, which designates national authorities, sets national fine levels, and establishes AI regulatory sandboxes.
Core characteristics of KI-MIG
The draft law does not create new AI rules of its own. Instead it builds the administrative scaffolding Germany needs to apply the EU regulation that already applies directly.
- Names a lead market surveillance authority and splits responsibility across sector regulators
- Sets national administrative fines that sit alongside the EU AI Act’s own Article 99 penalties
- Creates AI regulatory sandboxes for supervised testing, with preferential access for smaller companies
- Defines the single point of contact and complaints office companies and citizens can reach
KI-MIG vs. the EU AI Act
The EU AI Act is the directly applicable EU regulation that defines risk categories, prohibited practices, and obligations for an AI provider or AI deployer across all member states. KI-MIG is Germany’s separate, national law that answers the questions the regulation leaves to each member state: which domestic body enforces it, how high national fines go, and how sandboxes are run. A company cannot be fined under KI-MIG for breaching the EU AI Act itself; the two instruments work side by side, with the EU regulation setting substance and KI-MIG setting German enforcement machinery.
Importance of KI-MIG in enterprise AI
Without a national enforcement structure, the EU AI Act’s deadlines are hard to apply in practice, which is why the regulation required every member state to designate authorities by 2 August 2025. According to Bitkom’s 2026 AI study, 85% of German SMEs have no documented inventory of the AI systems they already run, meaning most have not yet done the groundwork a KI-MIG request would require.
Methods and procedures for KI-MIG
KI-MIG organizes enforcement through three linked mechanisms: authority designation, sandboxes, and documentation duties.
Authority designation and sector split
The government draft gives the Bundesnetzagentur the default role, while sector regulators keep responsibility for AI inside their existing remit.
- Bundesnetzagentur acts as central market surveillance authority, single point of contact, and complaints office
- An independent chamber within the Bundesnetzagentur handles sensitive high-risk systems such as law enforcement and border management
- BaFin stays responsible for AI tied to regulated financial activity
- State-level authorities keep responsibility for AI used by Laender public bodies
AI regulatory sandboxes (Reallabore)
Articles 57 to 63 of the EU AI Act require each member state to run at least one AI regulatory sandbox, and KI-MIG names the Bundesnetzagentur as the coordinating body for Germany’s version. Companies submit a structured project plan covering goals, risk controls, and exit conditions, and the draft foresees reduced-cost or free participation for SMEs and startups testing AI under supervision before full market launch.
Cooperation and documentation duties
Separately, the draft obliges providers and deployers to cooperate with information requests and keep a fundamental rights impact assessment on file, mirroring duties tied to conformity assessment.
Important KPIs for KI-MIG
Because KI-MIG is still an enforcement framework rather than a product feature, the relevant KPIs sit on the compliance side of the business.
Readiness metrics
- Documented AI inventory coverage: 100% of systems in production
- Risk classification completed: before each system’s go-live date
- Fundamental rights impact assessments on file: for every applicable high-risk use case
- Response time to a documentation request: within the authority’s set deadline
Strategic compliance posture
Beyond individual metrics, the broader goal is a defensible, dated compliance record ready for an authority on request. Sprinkling Act’s April 2026 EU AI Act Readiness Report found 74% of 50 screened European AI companies trigger high-risk classification, yet 96% had no such record ready.
Process quality indicators
A mature KI-MIG posture shows up in how fast a company traces a given AI system back to its inventory entry and accountable owner, rather than reconstructing that chain only after a regulator asks.
Risk factors and controls for KI-MIG
Treating KI-MIG as a formality rather than an enforcement law carries concrete exposure.
Fine exposure at two levels
German companies face fines from two separate sources that do not cancel each other out.
- National fines of up to 50,000 euros for cooperation or documentation failures under the draft
- EU-level fines of up to 35 million euros or 7% of global turnover for prohibited practices under Article 99
- Lower, SME-adjusted ceilings where a company qualifies as a small or medium enterprise
Jurisdictional confusion
Responsibility splits across the Bundesnetzagentur, BaFin, BSI, BfArM, and state authorities by sector. Companies operating across several domains risk sending documentation to the wrong body.
Legislative uncertainty
As a draft still moving through the Bundestag, exact fine levels, sandbox conditions, and sector boundaries could change before final passage, so compliance programs built strictly around an early draft text may need revision later.
Practical example
A 150-employee medical technology manufacturer in Bavaria builds an AI-assisted diagnostic support tool that qualifies as high-risk under the EU AI Act. Unsure whether the Bundesnetzagentur, BfArM, or a notified body would ultimately review the product, the company’s compliance lead mapped each obligation in the draft law against the product’s actual data flows before the first customer rollout. The exercise surfaced gaps in the fundamental rights documentation that would otherwise have surfaced only during an authority inquiry.
- A dated, article-mapped compliance file ready to hand to an authority
- A clear internal owner for each AI system’s risk classification
- A documented sandbox application pathway kept in reserve for the next product iteration
- An escalation contact list naming which authority covers which use case
Current developments and effects
KI-MIG’s path through the Bundestag has moved in stages through 2026.
Legislative timeline
The federal cabinet adopted the government draft on 10 February 2026, and the Bundestag’s Digital Committee held a public hearing on 23 March 2026 with statements from the BSI, Bitkom, and independent legal experts.
- First reading in the Bundestag followed the cabinet decision
- Committee hearing gathered feedback from regulators and industry associations
- Final passage was targeted before the EU AI Act’s 2 August 2026 high-risk compliance deadline
Industry feedback
Bitkom and the KI Bundesverband pushed for faster clarity, noting that many smaller AI providers lack a dedicated legal department to track a moving draft, while the BSI welcomed the close coordination foreseen with the Bundesnetzagentur.
Convergence with EU-level change
KI-MIG’s final shape also depends on the Digital Omnibus package, since changes to EU AI Act deadlines there can shift what the German law still needs to cover.
Conclusion
KI-MIG matters less as new substantive AI law and more as the administrative switch that turns EU AI Act obligations into something a German authority can enforce. Its sandbox and authority-designation provisions give companies a concrete structure to plan against, even while details remain in motion. Mittelstand companies that treat the draft as a planning signal now, rather than waiting for final passage, reach the enforcement deadline with far less exposure. Its core shape, a strong central authority backed by sector regulators, is unlikely to change even if individual figures do.
Frequently Asked Questions
What does KI-MIG stand for?
KI-MIG stands for Gesetz zur Marktueberwachung und Innovationsfoerderung von kuenstlicher Intelligenz, Germany’s draft law implementing the EU AI Act at the national level.
Is KI-MIG already in force?
As of its most recent Bundestag stages in 2026, KI-MIG was a government draft in the legislative process, following the cabinet decision in February and a committee hearing in March. Check the Bundesgesetzblatt or the Bundesnetzagentur for the current status, since a fixed passage date was not yet confirmed.
Which authority will enforce KI-MIG for most companies?
The Bundesnetzagentur is designated as the default market surveillance authority and single point of contact, except where BaFin, BSI, or a state authority already has sector-specific responsibility for the AI system in question.
Does KI-MIG apply to a company with fewer than 50 employees?
Yes, there is no size exemption from the EU AI Act’s risk-based obligations. KI-MIG’s sandbox access and the EU AI Act’s fine ceilings are still lower for SMEs than for large enterprises.
What is an AI regulatory sandbox under KI-MIG?
It is a supervised testing environment, required by Articles 57 to 63 of the EU AI Act, where a company trials an AI system under a structured project plan before full market launch, coordinated by the Bundesnetzagentur.
How should a Mittelstand company prepare while KI-MIG is still a draft?
Build a documented AI inventory, complete risk classification for each system, and keep conformity assessment and impact assessment records on file now. This way, whichever authority KI-MIG finally assigns, the company already has a dated compliance position ready.