New draft bill for the implementation of the AI Regulation

The first draft bill for the implementation of the AI Act marks a key step towards the national implementation of the new European legal framework for artificial intelligence. While the EU regulation has been in force since August 2024 (we reported on this in Data Protection Update No. 185, No. 208) and the transition period is underway, it is now up to the member states to define the practical responsibilities and supervisory structures. The draft presented by the Federal Ministry for Digitalization and State Modernization (BMDS) on September 12, 2025, makes it clear how Germany intends to shape these requirements. The legislative process is currently in the interdepartmental coordination phase. This will be followed by the involvement of the federal states and associations, as well as parliamentary deliberations. For companies, this raises the question of which supervisory authorities will be responsible in the future and how the new requirements will affect their products and business models.

I. Competent authorities and supervisory structures

The draft bill provides for the Federal Network Agency (BNetzA) to play a central role in market surveillance and certification of AI systems. Its tasks include supervising prohibited practices, high-risk AI systems, and compliance with transparency requirements. At the same time, the BNetzA is to become responsible in areas where no sector-specific structures exist at present, in particular in the field of biometric systems, critical infrastructures, the application of AI in education, in the workplace, in the provision of public services, and in the judiciary, law enforcement, migration, asylum, and border control.

To avoid duplication of structures, the draft also focuses on transferring existing competences. Authorities that are already active in fully harmonized areas of product law are to remain responsible for AI systems in their sector. This includes, in particular, the supervision of machinery, medical devices, toys, elevators, and radio equipment. In the financial services sector, the Federal Financial Supervisory Authority (BaFin) is designated as the competent market surveillance authority for high-risk AI systems directly related to regulated financial activities.

II. New structures for support and control

In addition to the existing specialist and supervisory authorities, the draft provides for the establishment of a coordination and competence center for the AI Regulation (KoKIVO). This is intended to ensure that legal questions are answered uniformly and, at the same time, to promote exchange between authorities, accreditation bodies, science, industry, and civil society. KoKIVO will also be authorized to set up committees in which market surveillance and notifying authorities in particular are represented. An active role is also envisaged in the development of codes of conduct.

In addition, an independent AI market surveillance chamber (UKIM) is to be created at the Federal Network Agency. It will have its own chair, consisting of the president of the BNetzA and two vice presidents. The UKIM will be required to submit an annual activity report to the Bundestag starting in 2026 and may consult scientific experts for its work. In addition, the BNetzA will serve as the central complaints office for violations of the regulation. This complaints office is to be designed to be easily accessible, barrier-free, and user-friendly.

III. Innovation-friendly orientation

A central concern of the BMDS is to make the implementation of the AI Act in Germany as innovation-friendly as possible. The draft bill builds on concepts already envisaged by the previous federal government and expands on them with its own emphases.

The core element is the establishment of an AI real-world laboratory, which will give companies the opportunity to test AI systems under real-world conditions and take regulatory requirements into account at an early stage. Start-ups and small and medium-sized enterprises (SMEs) based or with a branch in the EU are to be given preferential access to this real-world laboratory. In addition, an AI service desk has already been set up at the Federal Network Agency to serve as an advice center for companies, authorities, and organizations and to answer questions about the new regulatory requirements.

In addition, the draft contains a programmatic note bearing the signature of the new Digital Ministry. According to this, administrative processes should be automated using AI wherever technically possible and economically viable. This is intended not only to make administrative practices more efficient, but also to send a signal for the broader use of AI in government structures. Overall, it is clear that, in addition to strict regulation, legislators are also focusing on promoting innovation and facilitating market access for young companies.

IV. Recommendations for action for companies

The draft bill makes it clear that companies should address future responsibilities and requirements at an early stage. Even though the legislative process has not yet been completed, it is advisable to take concrete steps now:

1. Take stock of the AI systems in use

Companies should systematically record and categorize their existing and planned AI applications. In particular, they should check whether these fall under the definition of high-risk AI systems and are therefore subject to stricter requirements.

2. Assignment to supervisory authorities

Since responsibility will be organized on a sector-specific basis in the future, it is necessary to analyze which authority will be the point of contact for your own systems (e. g., BNetzA, BaFin, or technical supervisory authorities). This will make it easier to prepare for subsequent approval or review procedures.

3. Use of support and advisory services

The planned AI real-world laboratory and AI service desk offer the opportunity to clarify legal and technical issues at an early stage. SMEs and start-ups in particular should use these contact points to reduce regulatory hurdles and test their systems under real-world conditions.

4. Early involvement of legal expertise

In view of the new supervisory structures and ongoing legislative developments, continuous legal support is recommended. This not only enables risks to be avoided, but also allows the strategic use of the planned innovation subsidies.

V. Conclusion

With this draft bill, the BMDS is specifying the national implementation of the AI Regulation and defining the future supervisory landscape in Germany. The focus is on the Federal Network Agency as the central market surveillance authority, the creation of new coordination and control structures, and the targeted promotion of innovation through real-world laboratories and advisory services. Even though the legislative process has not yet been completed, it is already becoming apparent that future responsibilities and structures will be more clearly defined. For companies, this means above all more guidance on which authorities will be their points of contact in the future and what support services are planned. Those who closely follow further developments and examine at an early stage how the new framework conditions could affect existing or planned AI systems will be able to react in good time and take advantage of the opportunities offered by an innovation-friendly design.

This article was created in collaboration with our student employee Emily Bernklau.