One AI Tool Approval in Germany Can Face More Than One Regulator

This is a structural feature of German federalism, not a temporary gap waiting to be simplified. It makes Germany, the EU’s largest economy and one of its most significant pharma markets, arguably the most procedurally complex AI Act enforcement environment in Europe.

The Actual Structure

At the federal level, three separate bodies each hold a piece of AI oversight. The BfDI (Federal Commissioner for Data Protection and Freedom of Information) handles data protection issues where AI overlaps with GDPR. The BSI (Federal Office for Information Security) addresses AI security concerns. And under the draft KI-MIG bill, adopted by the German government in February 2026 and having passed the Bundestag but still awaiting Bundesrat approval, the Bundesnetzagentur (Federal Network Agency) is set to become the central AI Act market-surveillance authority and single point of contact.

Below that federal layer sit 16 Landesbeauftragte für Datenschutz, one data protection authority per German state, each with independent enforcement power over AI systems used by entities headquartered or operating in that state. A coordinating body, the Datenschutzkonferenz, exists to align these authorities’ approaches, but its decisions aren’t binding on any individual state regulator.

Why This Matters More for Pharma Specifically

A multinational pharma organization with operations, research facilities, or even just enterprise customers spread across multiple German states doesn’t get to choose a single point of regulatory contact. An AI tool flagged as problematic in one state’s jurisdiction can trigger independent scrutiny from that state’s authority, regardless of how the tool was evaluated elsewhere in the country.

This is worth taking seriously specifically because Germany hasn’t finished settling its own enforcement architecture. The KI-MIG bill remains in the legislative process, meaning the exact division of federal AI Act authority is still being finalized even as the underlying EU AI Act already applies directly as binding law. Germany also missed the EU’s original August 2025 deadline to designate its enforcement authorities, part of why this framework is still being built out in real time.

What This Means in Practice

Don’t assume approval from the BfDI or any single German authority constitutes nationwide clearance, state-level authorities retain independent enforcement power regardless of federal-level sign-off.

Track AI tool use by state if your organization operates across multiple German locations, since exposure isn’t uniform, it depends on which state-level regulator has jurisdiction over each specific operation.

Watch the KI-MIG bill’s progress through the Bundesrat, since its passage will materially change which federal body serves as the primary AI Act contact point, currently still unsettled.

Key Takeaways

• Germany enforces AI and data protection oversight through 16 state-level authorities plus federal regulators (BfDI, BSI, and the pending Bundesnetzagentur role).
• A single AI tool issue can be investigated by multiple German state authorities in parallel, unlike single-supervisor systems elsewhere in the EU.
• The KI-MIG bill, still awaiting Bundesrat approval, would formalize the Bundesnetzagentur as Germany’s central AI Act authority.
• Multinational pharma organizations with multi-state German operations should track AI tool compliance by state, not assume national uniformity.