Skip to main content

    AI by country · Western Europe

    AI in Germany: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Germany know before starting with AI?

    In Germany, AI that uses personal data falls under the GDPR and the Federal Data Protection Act (BDSG). The EU AI Act applies in stages, and since 29 July 2026 the KI-MIG makes the Bundesnetzagentur the main AI Act supervisor. Before starting, a company should sort its AI uses by risk, read the data protection authorities' joint AI guidance, and involve its works council where AI changes how people work.

    At a glance

    Germany at a glance

    Key facts about Germany
    Data protection lawGDPR (applies since 25 May 2018) and the Bundesdatenschutzgesetz (BDSG)
    RegulatorFederal and state data protection authorities (joint body: Datenschutzkonferenz, DSK); Bundesnetzagentur for the AI Act
    AI policyEU AI Act, implemented by the KI-MIG (in force 29 July 2026); Hightech Agenda Deutschland names AI as a key technology
    Time zoneCET, UTC+1 in winter; CEST, UTC+2 in summer (India is 4.5 or 3.5 hours ahead)
    CurrencyEUR (euro)
    Business languageGerman; English is common in international business

    Why now

    Why Germany is worth watching

    Each point links to the document it comes from.

    • Destatis reports that 26% of German enterprises with 10 or more staff used AI in 2025, including 57% of large enterprises.[9]

    • The KI-MIG entered into force on 29 July 2026, making the Bundesnetzagentur the AI Act's market surveillance authority, contact point and complaints office.[2]

    • The Bundesnetzagentur offers an AI service desk aimed at SMEs and start-ups, with an online tool for a first risk-class check, and is setting up an AI regulatory sandbox.[2]

    • The federal government's Hightech Agenda Deutschland lists artificial intelligence first among six key technologies.[10]

    • Most of the EU AI Act applies from 2 August 2026, and the AI Omnibus moved the start of high-risk rules for Annex III uses to 2 December 2027.[1]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    GDPR and Bundesdatenschutzgesetz (BDSG)

    In force2018The BDSG adds German rules to the GDPR, including section 26 on employee data and section 31 on scoring and credit reports. In the SCHUFA case of 7 December 2023, the EU Court of Justice held that a credit score counts as an automated individual decision, prohibited in principle, where a bank gives it a determining role in granting credit.[5]

    EU AI Act, Regulation (EU) 2024/1689, as amended by the AI Omnibus

    Phased2024Banned practices and AI literacy have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and most other rules, such as chatbot transparency, from 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved high-risk rules to 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products.[1]

    KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG)

    In force2026The Bundesnetzagentur is the AI Act supervisor, contact point and complaints office. In fully harmonised product areas, existing sector authorities stay in charge, for example BaFin for financial services and the state media authorities for media. The Bundesnetzagentur also hosts a coordination centre for the other authorities.[2]

    Works Constitution Act (Betriebsverfassungsgesetz), sections 87 and 90

    In force1972Section 90 requires the employer to inform the works council in good time about planned work processes, expressly including the use of artificial intelligence. Under section 87(1) no. 6, the works council has a say over technical systems designed to monitor employee behaviour or performance.[7]

    Where AI fits first

    Where AI fits first

    Banking, credit and insurance

    Credit scoring support, document checks and customer service, with a person making the final decision.

    BaFin remains the AI Act authority for the financial sector. The SCHUFA judgment means a score that drives the lending decision is treated as an automated decision.[6]

    Manufacturing and engineering

    Quality inspection from images, predictive maintenance and searching technical documents.

    AI built into products covered by EU product safety law, such as machinery, is high-risk under Annex I, with obligations from 2 August 2028.[1]

    Workplace tools and HR

    Office assistants, scheduling and support for screening applications.

    Inform the works council early under section 90 BetrVG; monitoring tools need its agreement under section 87. Hiring AI is high-risk under Annex III from 2 December 2027.[8]

    Public administration and SMEs

    Chatbots and document search built on large language models, often with retrieval from internal files.

    The DSK has published guidance for deployers (May 2024), technical and organisational measures for AI systems (June 2025) and RAG systems (October 2025).[4]

    Your first steps

    Your first steps

    1. Use the Bundesnetzagentur's online tool or your own review to sort each AI use into an AI Act risk class.
    2. Read the DSK guidance on AI and data protection before choosing an AI tool, and document purpose, legal basis and transparency.
    3. Involve the works council early where AI changes work processes or could monitor staff.
    4. Keep a person in the final decision for credit, hiring and similar decisions, in line with the SCHUFA judgment.
    5. Train staff in AI literacy, which the AI Act has required since 2 February 2025.
    6. If personal data will be accessed from India or another non-EU country, put a GDPR transfer mechanism in place first.
    7. If a system may be high-risk, plan documentation, logging and human oversight now for 2 December 2027.

    AI services for Germany

    AI consulting and development for teams in Germany

    We work remotely with companies in Germany, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) works 9:30 to 18:30, which is 04:00 to 13:00 UTC. In German winter (UTC+1) that gives about 5 hours of overlap, 09:00 to 14:00 German time; in summer (UTC+2) about 6 hours, 09:00 to 15:00. India has no EU adequacy decision, so any personal data we access from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Germany

    Who supervises AI in Germany?

    The Bundesnetzagentur is the main AI Act authority under the KI-MIG, in force since 29 July 2026. Sector authorities such as BaFin keep their role in their areas, and the data protection authorities still supervise personal data use.

    Does our works council need to be involved?

    Often, yes. Section 90 BetrVG requires informing it about planned AI use in work processes, and section 87 gives it co-determination over technology that can monitor staff.

    Can an AI score decide who gets a loan?

    Not on its own, in principle. The EU Court of Justice held in 2023 that a score with a determining role in a credit decision is an automated decision prohibited in principle unless an exception applies.

    When do the high-risk AI rules start?

    On 2 December 2027 for Annex III uses such as hiring and credit scoring, and 2 August 2028 for AI in regulated products, after the EU AI Omnibus changed the dates.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the AI Act timeline and the AI Omnibus, which the page says entered into force on 27 July 2026. We could not open EUR-Lex directly.

    2. [2] Bundesnetzagentur, 2026-07-29. Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Ver…(bundesnetzagentur.de)
      Full title and what we used it for

      Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung. Primary (press release, German). Used for the KI-MIG entering into force, the agency's roles, BaFin and media authorities, the service desk, sandbox and coordination centre.

    3. [3] Datenschutzkonferenz (DSK), 2024-05-06. Künstliche Intelligenz datenschutzkonform einsetzen: Datenschutzkonfere…(datenschutzkonferenz-online.de)
      Full title and what we used it for

      Künstliche Intelligenz datenschutzkonform einsetzen: Datenschutzkonferenz veröffentlicht Orientierungshilfe. Primary (press release, German). Used for the purpose and audience of the DSK guidance on AI and data protection.

    4. [4] Datenschutzkonferenz (DSK), 2026-10-29. Orientierungshilfen(datenschutzkonferenz-online.de)
      Full title and what we used it for

      Orientierungshilfen. Primary, accessed on this date. Used for the list and dates of DSK AI guidance (May 2024, June 2025, October 2025).

    5. [5] Federal Ministry of Justice (gesetze-im-internet.de), 2026-10-29. Bundesdatenschutzgesetz (BDSG)(gesetze-im-internet.de)
      Full title and what we used it for

      Bundesdatenschutzgesetz (BDSG). Primary, accessed on this date. Used for the section headings of section 26 (employment) and section 31 (scoring and credit reports).

    6. [6] Court of Justice of the European Union, 2023-12-07. Press release No 186/23: judgments in C-634/21 SCHUFA Holding (Scoring)…(curia.europa.eu)
      Full title and what we used it for

      Press release No 186/23: judgments in C-634/21 SCHUFA Holding (Scoring) and joined cases C-26/22 and C-64/22. Primary. Used for the holding that scoring is an automated individual decision where it plays a determining role in granting credit.

    7. [7] Federal Ministry of Justice (gesetze-im-internet.de), 2026-10-29. Betriebsverfassungsgesetz, section 90(gesetze-im-internet.de)
      Full title and what we used it for

      Betriebsverfassungsgesetz, section 90. Primary, accessed on this date. Used for the duty to inform the works council about planned work processes including the use of AI.

    8. [8] Federal Ministry of Justice (gesetze-im-internet.de), 2026-10-29. Betriebsverfassungsgesetz, section 87(gesetze-im-internet.de)
      Full title and what we used it for

      Betriebsverfassungsgesetz, section 87. Primary, accessed on this date. Used for co-determination over technical systems that monitor employee behaviour or performance.

    9. [9] Federal Statistical Office (Destatis), 2025-11-24. Enterprises using artificial intelligence (AI) technologies, by employm…(destatis.de)
      Full title and what we used it for

      Enterprises using artificial intelligence (AI) technologies, by employment size class. Primary. Used for AI use by 26% of enterprises in 2025, and 57% of large enterprises.

    10. [10] Federal Government (Bundesregierung), 2026-10-29. Hightech Agenda Deutschland(bundesregierung.de)
      Full title and what we used it for

      Hightech Agenda Deutschland. Primary, accessed on this date. Used for the six key technologies. Press reports cite a goal of 10% of economic output being AI-based by 2030; we did not find it on this page, so we do not state it.

    11. [11] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary, accessed on this date. Used to confirm India has no EU adequacy decision.

    This is general information, not legal advice. The KI-MIG is new and the AI Act dates changed in 2026. Check with a qualified German lawyer (Rechtsanwalt) before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Germany?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score