Germany Misses AI Act Deadline:
No Supervisory Authority Designated

The EU AI Regulation (AI Act) requires all member states to designate national market surveillance authorities by August 2, 2025. These authorities are crucial for monitoring compliance with the new rules. Germany has not met this important deadline.

• Legislative Process Stalled

  A national implementation law, the so-called AI Market Surveillance Act (KIMÜG), is in progress but has not yet been passed. The process was delayed, among other things, by the early federal election in February 2025.

• Sharp Criticism from Experts

  Data protection officers and consumer protection associations sharply criticize the federal government for the delay. They warn of a control gap and missing contact points for companies and consumers.

Thomas Fuchs, Hamburg's Data Protection Commissioner, puts the problem in a nutshell: 'Due to the delay, companies and authorities now lack their binding contact point for questions about the AI Regulation. This is also a disadvantage for Germany as an AI innovation hub.'

The Federation of German Consumer Organizations (vzbv) also urges haste. Lina Ehrig warns of the risks for consumers when there is no oversight of rights compliance.

The missing supervisory authority creates a climate of uncertainty but does not exempt companies from their obligations. The following AI Act requirements must already be implemented:

• Risk Assessment for AI Systems

  Companies must classify and assess the AI systems they use, especially high-risk systems.

• Documentation Requirements

  Technical documentation and compliance evidence must be prepared and maintained.

• Competence Requirement under Art. 4

  All relevant employees must be trained in handling AI systems and their regulation.

Violations can result in severe fines of up to 35 million euros or 7% of global annual turnover.

To minimize legal risks, companies should act now:

• Clarify Internal Responsibilities

  Designate one or more people responsible for AI compliance in your company.

• Conduct Risk Classification

  Analyze and classify all AI systems in the company according to AI Act criteria.

• Train Employees

  Fulfill the competence requirement under Art. 4 through targeted training, even without national guidelines.

• Start Documentation

  Begin immediately with documenting all technical, organizational, and legal aspects of your AI systems.