Who Regulates the AI? The Bundesnetzagentur, Germany's AI Act Bill and What Law Firms Should Watch

Germany now has an answer to the question of who enforces the EU AI Act on its territory. The Act on market surveillance and support of innovation of artificial intelligence (the KI-Marktüberwachungs- und Innovationsförderungsgesetz, or KI-MIG) entered into force on July 29, 2026. As the Bundesnetzagentur announced that day, it makes the agency the market surveillance authority, single point of contact and complaints office for the AI Act in Germany.

For the first half of the year the law was a moving target. The federal government's draft bill was published in February 2026, as Gleiss Lutz reported at the time, and the Bundestag passed it in June. In between, industry and civil society warned that enforcement could end up spread across too many authorities.

For a law firm or legal department that already uses AI to review documents, the practical question is narrower. This story sets out the structure the KI-MIG created, the source of the fragmentation concerns and the obligations that apply to AI review work today.

What the KI-MIG sets up

The Bundesnetzagentur's own account describes a hybrid model. The agency supervises AI systems in radio equipment and in sensitive areas such as worker management, critical infrastructure and education, including the transparency rules and the prohibited practices in those areas. Established regulators keep the sectors they already know: BaFin for financial services, and the state media authorities for media. The German version of the announcement adds that the Länder can engage the Bundesnetzagentur for AI oversight through an administrative arrangement.

Around that core sit three supporting structures. A coordination and competence centre supports the other market surveillance authorities on complex questions and coordinates their work. An AI Service Desk, already running, offers guidance on the AI Act, tools for assessing an AI system's risk level, the European guidelines and material on AI literacy. A regulatory sandbox lets small and medium-sized enterprises develop and test AI systems in a controlled setting.

For most organisations that deploy AI rather than build it, the Service Desk is the part of this structure they are most likely to meet first.

Why experts warned about fragmented enforcement

The criticism followed the bill to the end. Heise reported that the Bundestag passed it with the votes of the CDU/CSU and SPD, against the AfD, the Greens and the Left. The IT association Bitkom warned of a "bureaucratic patchwork" because the federal states share enforcement, which could lead to different assessments of identical AI systems. The data protection authorities had argued that supervision of high-risk AI should go to them, and the law did not follow that proposal. AlgorithmWatch criticised the absence of a mandatory transparency register for AI used by public authorities. The same report gives the estimated cost: one-time federal costs of €4 million, annual federal costs of €15.9 million and annual costs for the states of €33.1 million.

For a firm, the effect is that the competent authority depends on the system and the setting. A tool used for document review in a law firm and the same kind of tool used by a bank or a public body may fall to different supervisors.

What applies to a firm using AI review today

Some of the AI Act already applies, and the EU has since moved part of the timetable. The Digital Omnibus on AI, adopted by the Council on June 29, 2026 as nicfab's summary of the adoption records, postpones the high-risk rules. As Gibson Dunn reads the agreement, stand-alone high-risk systems under Annex III now have until December 2, 2027, and AI embedded in regulated products until August 2, 2028.

The AI literacy duty in Article 4 has applied since February 2, 2025. In its amended form, providers and deployers must support the development of AI literacy among their staff and others who operate AI systems for them, taking account of their technical knowledge, experience and the context of use. It does not require any individual to reach a set level. In practice, a firm can show that the people running AI review understand what the tool does and where it can go wrong.

The transparency duties in Article 50 have applied since August 2, 2026. As the Jones Walker AI law team summarises them, most fall on providers of chatbots and content generators, while deployers carry duties for emotion recognition, deepfakes and AI-generated text published to inform the public on matters of public interest.

The high-risk regime turns on Annex III. Its point on the administration of justice, Annex III, point 8(a), covers AI intended to be used by a judicial authority, or on its behalf, to research and interpret facts and law and apply the law to facts, or used in a similar way in alternative dispute resolution. We read that annex against eDiscovery work in more detail in our story on whether eDiscovery AI is high-risk.

The rules that apply first: professional law and data protection

For German lawyers, the duties that shape AI review sit largely outside the KI-MIG. The Bundesrechtsanwaltskammer published its guidance on the use of AI in December 2024. As IWW's practice journal reads it, the guidance treats independent review and final control of AI results by the lawyer as mandatory, with the level of care rising with the degree of automation. It also expects service providers to be bound to confidentiality, with comparable protection where the provider is abroad.

The Anwaltspraxis Magazin summary of the same guidance points to professional secrecy under § 43a(2) BRAO and § 203 StGB, and warns that information entered into an AI application is usually forwarded to servers, often abroad. The GDPR continues to apply to every review that touches personal data, and the data protection authorities enforce it whatever the KI-MIG says about market surveillance.

Where Claira fits

Claira runs inside Nuix Discover, and its design speaks to several of these questions. According to the help centre's privacy and security article, model requests go only to providers in the deployment's country, documents, prompts and results are never used to train a provider's models, and providers do not log or keep the content. Claira keeps no copy of the document text or the response, which lives in your Nuix Discover field. Claira can keep a case's data in the EU.

The workflow also supports the lawyer's final control. The help centre recommends testing a prompt on 10 to 25 benchmark documents where you know the right answer, using single review, before running it across a set as a bulk scan. Each run writes its results to fields in Nuix Discover, and the minimum field set includes a Prompt field that records the prompt used and a Log field that tracks which Claira operations touched each document. Those records give a supervising lawyer something concrete to check. Case Context gives every reviewer on the matter the same structured briefing on the parties, the issues and the relevance criteria.

What to watch next

The next dates are already set. Under the Digital Omnibus, as nicfab's summary notes, systems placed on the market before August 2, 2026 must meet the machine-readable marking duty by December 2, 2026, and the high-risk rules for stand-alone systems follow on December 2, 2027. In Germany, the Bundesnetzagentur's Service Desk guidance and any arrangements between the agency and the Länder will show how far the fragmentation concerns come true.

For most firms using AI review, the questions to settle remain the familiar ones: verification of the output, the location of the data and the record the review leaves behind. If you would like to see how Claira handles them on your own documents, you can talk to our team.