On February 11, 2026, the German Cabinet approved a draft bill to implement the EU AI Act in Germany. It regulates the national competent authorities, organises measures to promote innovation and the penalty regime, and specifies the amendments to be made to German law. The draft bill entitled ‘Gesetz zur Durchführung der Verordnung über künstliche Intelligenz’ (Law on the Implementation of the Regulation on Artificial Intelligence) is based on the version prepared and submitted for public consultation by the Federal Ministry of Digital and Public Administration in September 2025. This new version takes into account the 57 responses received by the ministry during the public consultation (available on the ministry website).

Contextual reminder

Pursuant to article 70 of the EU AI Act, member states were required to establish or designate their national competent authorities by August 2, 2025. 

Two types of national competent authorities had to be designated: 

• Notifying authorities (NA): they are responsible for supervising and organising the conformity assessment ecosystem. To that end, they set up and carry out the procedures necessary for the assessment, designation, notification and monitoring of conformity assessment bodies. The latter perform conformity assessment activities on high-risk AI systems to certify whether they meet the requirements of the EU AI Act before being placed on the market; and 
• Market surveillance authorities (MSA): they are responsible for overseeing AI systems placed on their national markets and for ensuring that these systems comply with the requirements set out in the EU AI Act once they have been placed on the market.

Each member state shall designate at least one notifying authority and at least one market surveillance authority. 

In addition, member states designating several MSAs must designate one to act as the single point of contact (SPoC) for their counterparts at national and EU levels. 

German AI supervision architecture

Germany’s AI supervision architecture is centralised and builds on authorities already designated under existing legislation (harmonisation legislation or sectoral legislation). 

According to the draft bill, the Federal Network Agency (Bundesnetzagentur) is set to play a central role, as it will be designated as MSA, NA, and SPoC. It also serves as a central complaints office, receiving and forwarding complaints to the responsible authorities, as appropriate. The Agency will be supported by a newly established independent internal body, the AI Market Surveillance Chamber (Unabhängige KI-Marktüberwachungskammer – UKIM). In addition, a coordination and competence center (Koordinierungs und Kompetenzzentrum KI-VO – KoKIVO) will be established within the Agency. Finally, the Agency will be responsible for implementing measures to promote innovation by providing information and guidance, assisting public authorities in the qualification and classification of AI systems, promoting knowledge-building and networking among players, and making its expertise accessible.

Notifying authorities: 

1. Federal Network Agency (Bundesnetzagentur)
2. Authorities designated by federal or Länder law as notifying authorities for the implementation of the EU harmonisation legislation referred to in Annex I, Section A of the EU AI Act.
3. The market surveillance authority to be designated pursuant to Article 52(2) of the Cyber Resilience Act. 

Interim:  Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik – BSI)

The German Accreditation Body (Deutsche Akkreditierungsstelle – DAkkS) is entrusted with the assessment and monitoring of conformity assessment bodies responsible for high-risk AI systems referred to in Annex III, point 1 of the EU AI Act. However, the DAkkS is not designated as a notifying authority, as its role is to provide support for assessment and monitoring activities, rather than to handle notifications.

Market Surveillance Authorities: 

1. Federal Network Agency (Bundesnetzagentur)
2. Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin)
3. The competent financial supervisory authority, pursuant to the law or an agreement concluded with the BaFin, responsible for supervising the financial institution when it is not supervised by the BaFin under Article 2, paragraph 3 of this draft bill.
4. Authorities designated by federal or Länder law as market surveillance authorities for the implementation of the harmonisation legislation referred to in Annex I, Section A of EU AI Act.
5. Authorities competent under Länder law for cases where Länder public authorities place on the market, put into service or use AI systems.
6. Authorities competent under Länder law for media service providers placing on the market, putting into service or using AI systems for journalistic or advertising purposes. 

Deutsche Welle is subject to separate statutory supervision (Deutsche Welle Act).

Single Point of Contact: 

1. Federal Network Agency (Bundesnetzagentur)

The choice of an “hybrid” approach built around existing supervisory authorities was reaffirmed in a press release issued on the day the draft bill approved by the Cabinet was published. The press release highlights the German objective of implementing the EU AI Act “without additional national requirements and as lean as possible in order to promote innovation and strengthen the business location”. 

“With this law, we are implementing European requirements in a way that is as open to innovation as possible and creating a streamlined AI supervisory authority with a clear focus on the needs of the economy. We are not setting up an additional bureaucratic authority, but are relying on existing structures and proven contacts and pooling digital expertise at the Federal Network Agency. In this way, we are ensuring the safe use of AI and strengthening the growth and innovative power of our companies.”

Dr Karsten Wildberger, Federal Minister for Digitalization and Government Modernization of Germany^[1]

Main modifications 

In terms of structure, the German executive has proposed a clearer and more organised bill than the previous version, incorporating editorial improvements such as the removal of full regulation names, the fragmentation of certain provisions, more precise references and the rewording of provisions. Substantively, the new version of the bill remains largely unchanged from the version submitted for public consultation. However, a few changes to the initial version deserve mention and are outlined below.

• General

Addition – Adds information related to budget expenditures and compliance costs for administration. 

Amendment – Clarifies the scope (objectives) of the draft bill. (Part 1, Section 1)

• National competent authorities 

Addition – Determines the market surveillance authorities responsible for certain categories of actors (state authorities, federal tax authorities, and media service providers). (Part 2, Section 1, §2 (6) to (8))

Deletion – Deletes the explicit reference to the designation of the Federal Network Agency as notifying authority. (Part 2, Section 1, §3)

Addition – Grants Länder the competence to designate notifying authorities for product-related AI systems to which Regulation (EU) 2016/424 on the installation of cables applies. (Part 2, Section 1, §3 (1))

Addition – Clarifies the procedure to notify a conformity assessment body. (Part 2, Section 1, §3 (3))

Amendment – Distributes responsibility among different authorities for the assessment and supervision of conformity assessment bodies. (Part 2, Section 1 §3 (4))

• The Federal Network Agency (Bundesnetzagentur)

Addition – Allows the Coordination and Competence Center to call upon federal authorities with expertise in the matter and external expertise in individual cases. (Part 1, Section 1, §5 (4))

Addition – Tasks the Federal Network Agency, as a single point of contact, for providing electronic forms to the national competent authorities to fulfil their reporting obligations. (Part 1, Section 1, §6 (5))

• Confidentiality

Addition – Clarifies the confidentiality obligation to which agents are bound and the conditions for disclosing information obtained in the course of their duties. (Part 1, Section 2, §6 (6) and (7))

• The Federal Financial Supervisory Authority (BaFin)

Addition – Exemption from the application of guidelines for assessing cybersecurity requirements for high-risk AI systems for market surveillance of financial undertakings. (Part 1, Section 2, §10 (2))

Addition – Instructs the BaFin to establish independent requirements for assessing the cybersecurity requirements of high-risk AI systems under Article 6 of the EU AI Act, in agreement with the Federal Network Agency and the market surveillance authority to be designated under Article 52(2) of the Cyber Resilience Act. (Part 1, Section 2, §10 (2))

• Measures to promote innovation

Addition – Includes public entities, alongside small and medium enterprises and start-ups, as recipients of general information and guidance on the application of the EU AI Act to be provided by the Federal Network Agency. (Part 4, §12 (1))

• AI regulatory sandboxes

Addition – Involves data protection authorities in assessing data protection requirements in AI regulatory sandboxes. (Part 4, §13 (2))

• Penalties 

Addition – Lists the potential violations of the EU AI Act. ( Part 5, §15 (1))

Addition – Classifies the violation of the right to explanation of individual decision-making as an administrative offense. (Part 5, §15 (2))

Timeline 

Date	Event	Additional information
December 2024	Informal work on a blueprint for the German AI Bill	An initial unofficial draft of the German AI Bill was circulating online, suggesting joint preparatory work between the Ministry of Justice and the Ministry of Economic Affairs and Climate Protection.
February 2025	Federal German Election	Elections were held on February 23, 2025, leading to a period of political instability and aslowdown in thehandling of certain matters.
September 2025	Publication of the first draft of the German AI Bill	On September 12, 2025, the Federal Ministry of Digital and Public Administration published its draft law  to implement the EU AI Act. It laid down the designation of national competent authorities (designation, powers, and cooperation), measures to promote innovation (AI regulatory sandboxes, testing in real-world conditions, etc.), and amendments to laws and codes to bring them into line with the EU AI Act. It prioritised implementing the EU AI Act‘s provisions over formulating a broader, complementary national AI strategy.
October 2025	Public Consultation	A public consultation was held from September 12, 2025, to October 10, 2025, to consult associations and Länder and allow interested parties to share their opinions on the draft bill. A week before the publication of the draft bill, German state data protection authorities  published a statement where they criticised the German decision to sideline the data protection authorities from the supervision of AI. Following the publication of the draft, a few other entities (Fraunhofer, Weizenbaum Institute, Federation of German Industries etc.) published their opinions online on the German AI Bill.
February 2026	German AI Bill approved by the German Cabinet	The German cabinet approved the draft bill which includes modification based on the comments received during the public consultation.
Next steps	German AI Bill to be submitted to Bundesrat and Bundestag	The draft bill has been received by the Bundesrat on February 13, 2026. (legislative file, working document).

Conclusion 

With regard to the designation of national competent authorities, two observations may be made. Firstly, it is noteworthy that the provision explicitly designating the Federal Network Agency as the notifying authority has been replaced by a more general formulation in Article 2, the precise scope of which can only be fully understood in light of the explanatory memorandum. Secondly, although the German approach relies on the mobilisation of already identified authorities, the communication surrounding the designation of national competent authorities remains relatively limited. In this respect, other models offer points of comparison, such as the Irish approach, which provided in the early stage of its designation a list of the national competent authorities through a press release, or the French approach, which presented the relevant market surveillance authorities in tabular form.

More broadly, the organisation of AI supervision in Germany reflects trends observable in other member states, particularly in response to concerns regarding the availability of AI expertise. By favouring the pooling of resources and specialised knowledge through a coordination and competence structure, Germany aligns with a model that is also reflected in the approach adopted by France who announced the creation of a pool of shared technical skill (socle de compétences mutualisées).

In the absence of any updates on the designation of the national competent authorities in Germany since the public consultation, this announcement has reignited hopes that Germany’s AI supervision architecture will be organised in the coming months. This comes at a time of huge uncertainty for operators in the AI sector, which has been exacerbated by ongoing negotiations on the Digital Omnibus on AI.

To stay informed about the next bills from the EU member states to implement the EU AI Act, visit our website at AI-Regulation.com and follow us on LinkedIn, Twitter and Facebook.

For more information on the status of the designation of competent national authorities as of 2 August 2025, see our article : Who Oversees AI in the EU? The Designation of National Competent Authorities under the EU AI Act.

S.P

---

^[1] Translated from German to English with an automatic translation tool.

---

Post-Scriptum: This article and analysis are based on official documents that have been translated from German into English. This process may result in some linguistic approximations. If you notice any errors in this article, please notify us.