Bundesnetzagentur: what Germany's AI regulator can do

Since the summer, many newsletters have carried the same sentence: the Federal Network Agency (Bundesnetzagentur) now oversees AI. In small businesses, this triggers one of two reactions. Some wonder whether a letter from the agency in Bonn is on its way and whether they have to register ChatGPT somewhere. Others read the sentence and forgot it again straight away. Neither reaction is right. The supervisory authority is in place, it has real powers, and it is only just getting started. Here is where things stand in October 2026, with everything you need to know as a business.

The key points in brief

• Since 29 July 2026, the German AI Market Surveillance and Innovation Promotion Act (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG) has governed who enforces the EU AI Act in Germany. As a rule, that is the Bundesnetzagentur.
• Today it can mainly check two things: prohibited AI practices and the transparency obligations, such as the chatbot notice and deepfake labelling. The high-risk obligations only apply from December 2027.
• You do not have to register anything. There is no general registration obligation for AI tools.
• There is no fine for missing AI training. The obligation under Article 4 exists, but breaching it is not subject to a fine.
• Fines for small businesses are capped: in each case, the lower of the fixed amount and the percentage of turnover applies. Whether a fine is imposed at all depends on the individual case.
• No proceedings are known so far. The Bundesnetzagentur has not publicised any inspections or fines since July (as of 14 October 2026).

What has happened?

The EU AI Act required every Member State to designate a market surveillance authority by 2 August 2025. Germany got there just under a year later: the KI-MIG is part of the Act implementing the Regulation on Artificial Intelligence (Gesetz zur Durchführung der Verordnung über künstliche Intelligenz) of 22 July 2026, published in the Federal Law Gazette (Bundesgesetzblatt) 2026 I No. 223 and in force since 29 July 2026. A few days later, on 2 August 2026, the transparency obligations of the AI Act also became applicable.

Important for context: the KI-MIG essentially creates no new obligations for businesses. In its draft bill, the Federal Government states explicitly that no new obligations arise for the business sector. What you have to do is still set out in the AI Act itself. The KI-MIG only governs who supervises and how.

Who is responsible in Germany

The Bundesnetzagentur is the competent authority “unless otherwise provided in this Act” (Section 2(1) KI-MIG). This makes it the fallback authority for everything that is not expressly assigned to someone else. For a typical small business that uses ChatGPT, Copilot or a website chatbot, this means the Bundesnetzagentur is responsible.

Two rows deserve an explanation. The European Commission's AI Office supervises the large AI models and, since the Digital Omnibus, also AI systems offered by the model provider itself. However, this only concerns the provider. If your business uses such a tool, the national authority remains responsible for your obligations as a user. The data protection authority loses nothing: as soon as personal data is involved, it continues to supervise under the GDPR, and the Bundesnetzagentur has to involve it (Section 9(4) KI-MIG). So you are dealing with two supervisory authorities that apply two different laws.

What the Bundesnetzagentur can check today

The supervisory authority is in place, but not every obligation under the AI Act applies yet. An overview, as of October 2026:

For small and medium-sized enterprises (SMEs), the lower of the two amounts applies to each of these maximum fines (Article 99(6)). What that means in practice is explained further below.

What affects most small businesses today is mainly Article 50: a chatbot in customer contact must make clear that it is an AI (this obligation falls first and foremost on the provider of the chatbot), and deepfakes, i.e. AI images, videos or voices that show real people, places or events so realistically that they could be mistaken for genuine, need a notice. What exactly has to be labelled is explained in our article on AI labelling requirements.

What the authority is allowed to do

The Bundesnetzagentur's powers derive from European market surveillance law (Section 11 KI-MIG in conjunction with Article 14 of Regulation (EU) 2019/1020). They are far-reaching:

• Request documents and information, such as documentation, technical details and data. You have to provide them free of charge (Section 11(4) KI-MIG in conjunction with Section 7(2) of the German Market Surveillance Act, Marktüberwachungsgesetz).
• Carry out remote inspections, including via an interface to the AI system.
• Carry out unannounced inspections and enter business premises, but only during normal business hours, except in cases of imminent danger.
• Make test purchases, including under a cover identity.
• Require corrective action and, if nothing happens, issue orders, up to and including prohibiting or withdrawing an AI system.
• Impose fines. Within its remit, the Bundesnetzagentur is itself the authority responsible for fines (Section 17 KI-MIG).

It is just as important to know what it does not do: the authority does not issue binding classifications in individual cases. Even individual advice on whether a system counts as an AI system or as high-risk is something the law only provides for public bodies (Section 12 sentence 2 no. 2 KI-MIG).

If the Bundesnetzagentur writes to you

The authority has not yet published how it proceeds in practice. However, the structure of market surveillance law suggests that the process usually starts with a request for information, not with a notice imposing a fine. Here is what to do:

1. Note the deadline and stay calm. A request is not yet an accusation and, given the structure of market surveillance law, is typically the first step.
2. Clarify what it is about: which AI system is meant, and are you its provider or deployer? This determines which obligations apply to you at all.
3. Gather your documents: your AI inventory with the purpose of each tool, the AI policy, training records and evidence of labelling, such as screenshots of the chatbot notice.
4. Answer completely and truthfully. Incorrect or misleading information is itself subject to a fine, even if the original allegation was unfounded. If, however, the letter is a formal hearing notice (Anhörung) in administrative fine proceedings, get legal advice before giving any answer.
5. If anything is unclear, get legal advice early, especially where prohibited practices or a possible order are involved.

If you have documented your use of AI, you can answer such a request quickly. If you are starting from scratch, it will take much longer, and that is exactly when things get uncomfortable.

Complaints: who can complain and what happens next

Any person and any business can lodge a complaint about a possible infringement (Article 85 AI Act). The Bundesnetzagentur is the central complaints office (Section 8 KI-MIG). Complaints are submitted exclusively via an online form, are free of charge and are not subject to any deadline. The authority checks who is responsible, handles the complaint itself or passes it on, and informs the complainant accordingly.

For you as a business, this means: a complaint does not automatically trigger proceedings. Under the AI Act, it is “taken into account” for market surveillance (Article 85, second sentence), so it can prompt a request for information. There are two other ways in which infringements can come to light:

• Competitors and associations: in its guide to AI labelling (as of 29 July 2026), the Wettbewerbszentrale (the German Centre for Protection against Unfair Competition) takes the view that infringements of the AI Act can also constitute unfair competition where fair competition is affected. This would allow competitors and associations to send cease-and-desist letters (Abmahnungen). We are not aware of any court decision on this so far (as of October 2026).
• Whistleblowers: since 29 July 2026, the German Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) has expressly listed infringements of the AI Act (Section 2(1) no. 10 HinSchG). If you have an internal reporting office (as a rule mandatory from 50 employees, Section 12 HinSchG), you must also accept and handle reports of AI infringements through it.

A realistic look at fines

The maximum amounts in the AI Act sound like they are aimed at large corporations, and that is exactly who they are designed for. For small and medium-sized enterprises, the lower of the fixed amount and the percentage of turnover applies in each case. A business with an annual turnover of €2 million that breaches the transparency obligations would therefore face a maximum of €60,000, not €15 million. Since the Digital Omnibus, this cap also applies to small mid-cap enterprises, but not for prohibited AI practices (Article 99(6a)).

On top of that, the AI Act expressly names warnings and non-monetary measures as possible penalties and requires that the interests of SMEs and their economic viability be taken into account when penalties are imposed (Article 99(1)). Whether a fine is imposed, and how high it is, depends among other things on cooperation with the authority and on mitigation of the harm (Article 99(7)). A first-time mistake that is quickly remedied is therefore unlikely to end with the maximum amount.

What the Bundesnetzagentur offers you

The authority expressly sees itself as a point of contact too, and some of its services are useful for small businesses:

• AI Service Desk (KI-Service-Desk): an information platform with FAQs, a guidance paper on AI literacy, events and a contact form for questions. Launched in July 2025.
• AI Compliance Compass (KI-Compliance Kompass): an online tool that gives an initial assessment of whether the AI Act applies and which risk category may be relevant. The authority itself stresses that this is for orientation only and not a binding assessment.
• AI regulatory sandbox (KI-Reallabor): the Bundesnetzagentur must operate at least one regulatory sandbox in which businesses can test new AI systems under supervision. For SMEs, access is in principle free of charge. By mid-October 2026, the Bundesnetzagentur had not published an application procedure; the EU deadline for the launch is 2 August 2027.

A word of caution: in October 2026, some Bundesnetzagentur pages had not yet been updated to reflect the Omnibus. They state, for example, that the rules apply “in full from August 2027”. In fact, the high-risk obligations for AI in regulated products only apply from 2 August 2028. You can find the current timeline in our overview EU AI Act: the deadlines that really apply now.

What you should do now, and what you should not

• Do not register anything. Only providers of high-risk AI systems and public authorities that use such systems have to register. That affects hardly any small business.
• Briefly check the prohibitions. For most office applications this takes minutes, but it should be documented once.
• Implement Article 50: activate the chatbot notice and label realistic AI media.
• Keep your proof ready: AI inventory, AI policy, training records. With these documents you can answer a request quickly and on a solid basis.
• No panic buying. Neither certificates nor expensive expert opinions are mandatory. What you need is clean documentation of what you actually use.

How Klaus prepares you for a request

When the Bundesnetzagentur sends a request, what counts is what you can prove. Klaus helps you build these foundations as you go. In the free onboarding chat, Klaus records your AI tools with 13 questions and creates a profile for each one with a classification: allowed, allowed with conditions or prohibited. This produces your AI inventory and an AI policy as a PDF.

The training module takes your team through a training course with comprehension questions (for one person in the Free plan, for teams from the Basic plan) and records participation in your training records. And for systems you want to examine more closely, such as a chatbot on your website, the Basic plan and above include an assessment project with prioritised tasks and a compliance report as a PDF. Behind Klaus is a legal team that builds changes in the law into the assessment logic.

Conclusion

Since 29 July 2026, Germany has had an AI supervisory authority, and as a rule it is the Bundesnetzagentur. It can request documents, carry out inspections, issue orders and impose fines. What matters most for small businesses today are the prohibitions and the transparency obligations; the high-risk obligations only arrive in 2027 and 2028, and there is no fine for missing AI training. So far, there are no publicly known proceedings by the Bundesnetzagentur (as of October 2026). The best preparation is unspectacular: know which AI is running in your business, implement the transparency obligations and document it all. Then a request from Bonn is easy to answer.