Who watches the machines? Institutional design and the ethics of national AI enforcement: lessons from Germany’s KI-MIG

Abstract The effectiveness and the moral credibility of the European Union’s Artificial Intelligence Act will be decided less by its substantive provisions than by the national institutions charged with enforcing them. This article examines Germany’s KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG), adopted by the Bundestag on 11 June 2026 and in force since 29 July 2026, as one of the first comprehensive national enforcement frameworks for the AI Act and as a test case for the claim that institutional design is itself an ethical variable. The article reconstructs the KI-MIG’s architecture—the centralisation of market surveillance at the Federal Network Agency, a coordination and competence centre (KoKIVO), an independent market surveillance chamber for fundamental-rights-sensitive systems, a central complaints body, and a hybrid model that preserves sectoral competences—and evaluates it against five criteria of legitimate enforcement derived from regulatory theory: independence and mandate fidelity, competence and capacity, accessibility and voice, coherence, and regulatory candour. The assessment yields verdicts rather than a mere inventory. The design earns genuine credit on coherence and on accessibility, but the article concludes that the independence construction for fundamental-rights-sensitive supervision—a chamber staffed, in personal union, by the leadership of a hierarchically embedded economic regulator—falls short of the AI Act’s heightened requirements. Further concerns—dispersed notification responsibilities, undersecured Länder capacity, and an official rhetoric of ‘lean oversight’ that risks normalising under-enforcement—are sharpened by the Digital Omnibus’s deferral of high-risk obligations to December 2027. The article concludes with transferable design principles for jurisdictions that are now building AI enforcement institutions.