Source: Global Law Experts

EU AI Act obligations are now operational realities for companies with German operations and 2026 marks the year national enforcement structures, market surveillance activity and coordinated data-protection scrutiny begin to take shape. The Regulation (EU) 2024/1689 is being phased in with staggered timelines for prohibited practices, general-purpose AI (GPAI) obligations and high-risk systems; the Regulation is directly applicable across Member States so German firms do not await national transposition. Firms must map every AI system they place on the market or put into service, determine whether they act as provider, deployer, importer or distributor for each system, and peg internal deadlines to the earliest applicable EU obligation.

Germany’s enforcement picture is national and multi-bodied: market surveillance duties must be assigned by Member States and Germany’s federal structure means several authorities will likely coordinate rather than a single super-regulator. The Bundesnetzagentur has been identified in national planning as the intended central market surveillance coordination point but companies should verify final designations; the Federal Ministry for Economic Affairs and Energy is a key policy reference and the BSI supplies technical and cybersecurity guidance. Practical compliance priorities are risk classification, robust technical documentation and conformity assessment for high-risk systems, demonstrable post-market monitoring and incident reporting, and readiness for parallel GDPR scrutiny by the Federal Commissioner for Data Protection and state DPAs.