Skip to main content

KI-Verordnung in Germany: Duties, Deadlines and Supervision

What the EU AI Act (KI-Verordnung) requires of companies in Germany: risk levels, application dates, fines and the supervising authority.

Providers, deployers, importers and distributors of AI systems in the EU must follow Regulation (EU) 2024/1689 (KI-Verordnung). Most banned practices apply since 2 February 2025. High-risk duties apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

The Regulation covers systems placed on the market or put into service in the EU. Article 2 lists exclusions. In Germany the Bundesnetzagentur is the default market surveillance authority (§ 2(1) KI-MIG). Fines for banned practices: up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher (Article 99(3)). Next step: classify each AI system by risk level.

Key dates

Entry into force
1 August 2024
Banned practices apply (Article 5)
2 February 2025; bans on certain intimate and abusive material: 2 December 2026
Duties for general-purpose AI models (Chapter V)
2 August 2025; models placed on the market earlier: 2 August 2027
Transparency duties (Article 50)
2 August 2026
High-risk duties (Chapter III, Sections 1 to 3)
2 December 2027 (Annex III); 2 August 2028 (Annex I)

What applies to which system (our grouping of the Act’s rules)

  • Banned practices (Article 5)

    Examples are harmful manipulation, social scoring, untargeted scraping of facial images, and emotion inference at work and in education, except for medical or safety reasons. Most bans apply since 2 February 2025.

  • High-risk AI systems (Article 6)

    Annex III areas such as employment, education, credit scoring and law enforcement. Also systems that are a safety component of a product, or are themselves a product, under Annex I legislation that needs a third-party conformity assessment. Providers meet Articles 9 to 15 and Article 16; deployers meet Article 26. For Annex I Section B legislation only Articles 6(1), 60a and 102 to 112 apply.

  • Transparency duties (Article 50)

    Chatbots tell people they interact with AI, unless this is obvious. Providers mark synthetic content in a machine-readable format, and deployers disclose deepfakes and inform people exposed to emotion recognition or biometric categorisation. Article 50 sets exceptions, for example for systems authorised by law to detect or prosecute criminal offences.

  • General-purpose AI models (Articles 51 to 55)

    Providers document the model, put a copyright policy in place and publish a summary of the training content. Providers of free and open-source models are exempt from the documentation duties unless the model has systemic risk (Article 53(2)). Models with systemic risk have further duties.

  • All other AI systems

    Beyond AI literacy (Article 4) and transparency duties where Article 50 applies, the Act sets no specific requirements for them. Codes of conduct are voluntary (Article 95).

Three in-depth guides: high-risk systems, checklist and requirements by role

Further resources: EU AI Act hub and risk classification

Fines: three tiers in Article 99

  • Up to EUR 35 million or 7% of worldwide annual turnover

    Whichever is higher. For banned practices under Article 5 (Article 99(3)).

  • Up to EUR 15 million or 3% of worldwide annual turnover

    Whichever is higher. For breaches of the obligations of providers, authorised representatives, importers, distributors and deployers, and of Article 50 (Article 99(4)). The Commission can fine providers of general-purpose AI models up to the same amounts (Article 101).

  • Up to EUR 7.5 million or 1% of worldwide annual turnover

    Whichever is higher. For incorrect, incomplete or misleading information to notified bodies or authorities (Article 99(5)).

In Germany, the KI-MIG regulates fines (§ 1).

Exclusions, older systems and fine caps

The Regulation does not apply to AI systems used exclusively for military, defence or national security purposes (Article 2(3)). It does not apply to AI systems specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)), or to research, testing or development before placing on the market or putting into service, except testing in real-world conditions (Article 2(8)). Free and open-source systems are excluded unless they are placed on the market or put into service as high-risk systems or fall under Article 5 or 50 (Article 2(12)). Natural persons who use a system in a purely personal non-professional activity are not bound as deployers (Article 2(10)). For high-risk systems related to products under Annex I Section B legislation, such as motor vehicles, aviation, rail, marine equipment, agricultural vehicles and machinery, only Article 6(1), Article 60a and Articles 102 to 112 apply. Articles 57 to 59 apply only in so far as that legislation integrates the requirements (Article 2(2)).

High-risk systems placed on the market or put into service before the application date are covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

For SMEs, each fine is up to the percentage or amount, whichever is lower (Article 99(6)). For small mid-cap enterprises (SMCs, defined in Article 3(14b)), the same cap applies to fines under Article 99(4) and (5) (Article 99(6a)). The EUR 15 million tier also covers the obligations of providers and operators under Article 25(2) and (4) (Article 99(4), point (da)).

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.