GermanyAI regulation

Regulation Status

• Germany has implemented the EU AI Act through the Act Implementing the Regulation on AI, which entered into force on 29 July 2026. The Act designates the Federal Network Agency as the primary AI market surveillance authority, single point of contact and central complaints office, while the Federal Financial Supervisory Authority is assigned market surveillance functions for AI systems used in regulated financial activities.
• German data protection authorities remain active on AI governance, issuing GDPR-oriented guidance on AI deployment, technical and organisational measures, questionnaires for AI compliance, and guidance for generative AI systems using retrieval-augmented generation. Authorities have also investigated or acted against AI services over data-transfer and privacy concerns, including DeepSeek.
• Sectoral and horizontal guidance is expanding: the Federal Office for Information Security has issued AI white papers on explainability in adversarial contexts and bias, while German agencies have published high-risk AI requirements for AI-based medical devices and recommendations for AI regulatory sandboxes.
• Germany is also addressing related AI risks through competition and online-safety channels, including scrutiny of large digital platforms’ generative AI activities by the Federal Cartel Office and a 2026 draft law targeting digital violence, including harmful sexualized deepfakes and other deceptive content.
• The Act establishes Federal Network Agency coordination, contact and complaint functions, an independent AI Market Surveillance Chamber for high-risk AI systems used in law enforcement and border management, administrative offences and fines, and innovation measures including at least one AI real-world lab. Amendments added a proactive role for the coordination centre and staged evaluations within 18 months and three years of enactment.