Enforcing the AI Act at the national level: Germany’s KI-MIG as a blueprint for AI market surveillance in Europe?

Abstract The EU Artificial Intelligence Act is directly applicable in all Member States, yet its practical effectiveness hinges on national enforcement structures that the Regulation itself only sketches in outline. Member States were required to designate notifying and market surveillance authorities by 2 August 2025—a deadline most of them, including Germany, missed. With the entry into force of the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) on 29 July 2026, Germany has now settled its national enforcement architecture: a hybrid model that concentrates residual market surveillance, coordination, single-point-of-contact and complaint-handling functions in the Bundesnetzagentur, preserves the sectoral competences of existing regulators at federal and Länder level, creates an independent chamber for fundamental-rights-sensitive high-risk AI systems, and ties the supervision of the cybersecurity dimension of high-risk AI to the market surveillance authority of the Cyber Resilience Act—a role performed in the interim by the Federal Office for Information Security. This article analyses the KI-MIG against the requirements of Chapter VII of the AI Act, situates it within the timelines recalibrated by the Digital Omnibus on AI (Regulation (EU) 2026/1744), and compares the German approach with the enforcement models emerging in Spain, Italy, Cyprus and other Member States. It argues that the German hybrid model offers instructive answers to the coordination problems of decentralised AI oversight, but that its ‘blueprint’ quality will ultimately depend on operational capacity, on the resolution of federal frictions that have already brought the law to the brink of a mediation procedure, and on whether the Union succeeds in containing the fragmentation of AI market surveillance across 27 national systems.