Five Things German Firms Believe About the AI Act, and What the Text Says

Checking the claims that circulate in German boardrooms against Regulation 2024/1689, the Digital Omnibus in force since 27 July 2026, and the KI-MIG

AsiaPresswire – The claim arrives in the same shape every time. A German Mittelstand manufacturer asks its lawyers whether the new European rules apply to the scheduling tool it has been running since 2023, and someone in the room says the high-risk obligations start in August 2026. That sentence was correct for about eighteen months. It stopped being correct on 27 July 2026, when the Digital Omnibus entered into force, and a remarkable number of documents produced after that date still say it.

This is not a story about companies being careless. It is a story about a regulatory calendar that moved twice, in two instruments, administered by two levels of government, reported by an industry of advisors whose published output is not versioned. The result is that five specific beliefs are now widespread among German firms, each of them was defensible at some point, and each of them is wrong in a way that changes what a company should do this quarter.

The Claim List, With Its Sources

Each of the five below is stated in the form it circulates, with the kind of source that carries it. None of the sources is disreputable. Several are law firm publications.

Myth One: The High-Risk Rules Start in August 2026

This was true. Regulation (EU) 2024/1689 set 2 August 2026 for the high-risk obligations covering stand-alone systems listed in Annex III, the category that includes recruitment, credit scoring, education and biometrics. Then the Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved them.

The new dates are 2 December 2027 for Annex III systems and 2 August 2028 for high-risk AI embedded in products regulated under Annex I, which covers machinery, medical devices and toys. The Omnibus did not weaken what the requirements demand. It moved when they become enforceable.

The detail that matters for a firm planning its year is not the deadline. It is that the deadline is now fixed rather than conditional. The Commission’s original proposal linked application to the availability of harmonised standards, which could have produced an open-ended postponement. Both the Parliament and the Council rejected that mechanism and replaced it with dates. A company that was waiting for standards now has a date it can plan against, and the planning horizon is roughly fourteen months.

Myth Two: Nothing Is Enforceable Until 2027

This one is the most consequential of the five, because it converts a postponement into a holiday.

Four sets of obligations already apply in Germany. The prohibitions in Article 5 and the AI literacy duty in Article 4 have applied since 2 February 2025. The obligations for providers of general-purpose AI models in Chapter V have applied since 2 August 2025, together with the governance structure and the penalty framework. Article 50 transparency, covering chatbot disclosure and the labelling of synthetic content, has applied since 2 August 2026. And the German enforcement architecture has been live since 29 July 2026, when the KI-MIG entered into force.

The Article 5 list is where a German company is most likely to be exposed without knowing it. It bans biometric categorisation using sensitive characteristics outside narrow exceptions, real-time remote biometric identification in publicly accessible spaces outside the law enforcement carve-outs, social scoring, and manipulation of people by exploiting vulnerabilities. A retailer using emotion recognition on customers, a logistics firm scoring warehouse staff, an HR platform inferring health status: all of those sit in territory that has been enforceable for more than a year.

There is a further item that lands inside the planning window. The Omnibus added a prohibition on systems generating child sexual abuse material or non-consensual intimate imagery, where that output is a reasonably foreseeable result and the system lacks adequate safeguards. It carries the top penalty tier and applies from 2 December 2026.

Myth Three: The Fine Is Thirty-Five Million Euros

The 35 million euro figure is the one that travels, and it is real. It is also the top of three tiers and it applies to a narrow set of violations.

Article 99 sets 35 million euros or 7% of total worldwide annual turnover, whichever is higher, for breaches of the Article 5 prohibitions. It sets 15 million euros or 3% for non-compliance with most other obligations, which includes the high-risk requirements in Articles 9 to 15, the provider obligations in Article 16, the deployer obligations in Article 26 and the Article 50 transparency duties. It sets 7.5 million euros or 1% for supplying incorrect, incomplete or misleading information to notified bodies or authorities.

For small and medium enterprises, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. A German company with 20 million euros of turnover cannot face a 15 million euro fine for a high-risk breach, because 3% of 20 million is 600,000 euros, and that is the ceiling. German procedural breaches under the KI-MIG carry separate domestic penalties in the tens of thousands.

The practical point is not that penalties are lower than advertised. It is that the tier a company lands in is determined by which obligation it breached, and most of the obligations a mid-sized German firm will actually touch sit in tier two or below.

Myth Four: Germany Watered It Down

Germany did the opposite of diluting, and the confusion comes from conflating two different instruments.

The AI Act is a regulation. It applies directly in all member states without transposition. What member states must do is designate competent authorities, build market surveillance structures and set national penalty procedures. Germany did that with the KI-Marktüberwachungs- und Innovationsförderungsgesetz, the KI-MIG, adopted by the Bundestag on 11 June 2026 and in force from 29 July 2026.

The design is deliberate and it is described in German policy circles as lean supervision. Instead of adding national requirements on top of the European ones, Germany routed enforcement through existing regulators. The Bundesnetzagentur in Bonn is the central market surveillance authority and the single national point of contact with the European AI Office. BaFin keeps financial-sector AI. The state media regulators keep transparency rules affecting journalism and deepfakes. A new competence centre inside the Bundesnetzagentur, known as KoKIVO, is meant to support the other regulators. The agency added 43 posts to staff the function.

Whether lean supervision is adequate is a fair argument. A regulator that coordinates rather than duplicates depends on the sector regulators having the technical capacity to assess models, and BaFin’s expertise is in prudential supervision, not in machine learning. But that is a criticism of implementation, not evidence of dilution, and the distinction matters because a company that believes the rules were weakened will under-prepare.

What the design does give a mid-sized firm is an unusually clear first contact point. The Bundesnetzagentur runs a KI-Service Desk for questions about classification and obligations, and publishes an online Compliance Kompass that walks a user through whether a system is high-risk and which duties follow. Both existed before the KI-MIG and both are free. For a manufacturer with one AI feature and no compliance department, that is a more useful resource than a law firm memo, and almost none of the firms that repeat the five claims above have used it.

Myth Five: The Delay Means Brussels Caved

The delay is real, and the reason for it is more uncomfortable than the lobbying story.

As of June 2026, nine of the 27 member states had formally designated their competent authorities under the AI Act, against a deadline of 2 August 2025. The Commission missed its own deadline for the guidelines on high-risk classification under Article 6, publishing a draft of 148 pages on 19 May 2026 with consultation running to 23 June, months late and still not final. Standardisation bodies had not delivered the harmonised standards the original timetable assumed.

A regime that requires conformity assessment, notified bodies and market surveillance cannot start on time if the bodies that perform conformity assessment have not been notified and the standards against which conformity is assessed do not exist. The postponement is not a concession to industry. It is an admission that the infrastructure the Act depends on was not built.

That reading has a practical consequence that the lobbying reading does not. If the constraint was institutional capacity, the constraint does not disappear in December 2027. It either gets fixed or the date moves again. A company planning to be ready by the new deadline is making a bet on the Commission and the member states solving a coordination problem they have already failed once.

What a German Firm Should Have Filed Already

Strip away the calendar argument and the operative question is smaller: what documentation should exist in a German company’s files today, given that four sets of obligations are live?

The first is an inventory. The Act does not require an AI register as such, and companies often read that as relief. It is not, because without a list of systems and of the role the company plays in each, there is no way to show which obligations attach. Provider status follows whoever places a system on the market under its own name, which catches more firms than expect it: a manufacturer that ships a predictive maintenance module under its own brand is a provider, not a deployer.

• A list of every AI system in use, with the vendor, the version and the date it entered service.
• For each one, the role: provider, deployer, importer or distributor.
• For each one, a screen against Article 5, recorded even when the answer is negative.
• For each one, a screen against Article 50, covering chatbot disclosure and the labelling of synthetic content.
• Records of AI literacy measures, which Article 4 requires and which most firms have never documented.

The second is the interaction between the AI Act and the GDPR, which German companies tend to run as two separate workstreams and which the regulators do not. A public body deploying an AI tool to assess eligibility for a benefit needs a data protection impact assessment under Article 35 and, where the conditions are met, a fundamental rights impact assessment under Article 27. The two share most of their factual base. Running them separately doubles the work and produces two documents that can contradict each other.

The third is records. Article 12 requires record-keeping for high-risk systems. Article 22 of the GDPR governs automated decision-making and the right to meaningful information about the logic involved. A German company running an AI screening tool in recruitment has obligations under both instruments on documentation, transparency and human review, and the human review requirement is the one that fails most often in practice, because a review that consists of a manager clicking approve is not a review.

The Deadline That Did Not Move

The most useful thing about the Omnibus postponement is what it distracts from. The civil liability timetable was not postponed, and it bites sooner than the new high-risk dates.

The revised Product Liability Directive, 2024/2853, must be transposed into German law by 9 December 2026. It introduces rebuttable presumptions of defectiveness for complex products, and software including AI systems falls inside its scope. Germany’s existing Produkthaftungsgesetz applies to AI software in principle, but the revised directive changes what a claimant has to prove, which is the variable that decides whether cases are brought.

For a company, the exposure runs through two channels. The first is litigation: a claimant who does not have to prove the specific defect because the presumption applies is a claimant with a viable case. The second is insurance. Standard German commercial liability and professional indemnity policies typically do not extend affirmatively to AI errors without an explicit endorsement, and a firm that has checked its AI Act obligations and not its policy has checked the smaller of its two problems.

That is the pattern behind all five myths. Each one directs attention to a date that moved and away from a date that did not, or to a penalty that is dramatic and away from a duty that is mundane. A company that reorganises its compliance function around December 2027 and leaves its product liability cover untouched has read the regulation correctly and the risk wrongly.

Why These Five Travel

The propagation mechanism is worth naming, because understanding it is the only defence against the next version of the same error.

Law firm publications are not versioned. A guide written in early 2026 and updated in August may still contain sentences composed before the Omnibus, and readers have no way to see which sentences those are. One guide reviewed for this piece states plainly that it “still carried the pre-Omnibus position in several places”, that it had told German operators to plan for 2 August 2026, and that every instance has since been rewritten. That is an unusually honest note, and it is also a description of the entire genre.

The headline number beats the tier structure because 35 million euros fits in a slide and three tiers do not. The word delay beats the phrase fixed commencement date because delay implies relief and commencement implies work. And a national law and a European regulation look identical to a reader who has never had to distinguish them, which means a German implementation story gets filed as a European weakening story.

The fifth mechanism is arithmetic. Twenty-seven member states at twenty-seven stages of readiness produce twenty-seven different national situations. Any one of them, reported accurately, becomes false the moment it is generalised. A German firm reading that France has not finished its designations may reasonably conclude that nothing is operating anywhere, when the Bundesnetzagentur has had powers since July.

There is a sixth mechanism that is harder to name and easier to observe: the incentive to be useful. A compliance publication that tells readers the deadline is fixed and most of their exposure sits in tiers two and three is less useful, commercially, than one that tells them a 35 million euro fine is coming. Alarm is a product. The firms that sell it are not lying about the statute, they are selecting the true sentence with the higher open rate.

The defence is mechanical rather than intellectual. Before acting on any summary, check three things: the date the summary was updated, whether it cites a regulation number and an article, and whether it distinguishes the European instrument from the national implementing law. A document that fails all three is not necessarily wrong. It is simply not evidence, and in a calendar that has moved twice in eighteen months, evidence is the only thing worth planning against.

Data basis

Dates and tier amounts are taken from Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force on 27 July 2026; the amendment replaced a standards-linked commencement mechanism with fixed dates of 2 December 2027 for Annex III and 2 August 2028 for Annex I. German institutional facts, including the KI-MIG adoption on 11 June 2026, its entry into force on 29 July 2026, the designation of the Bundesnetzagentur, the retention of BaFin and BfDI competences and the addition of 43 posts, are from reports of the Bundesnetzagentur announcement and from national implementation analyses. The figure of nine designated authorities among 27 member states as of June 2026 is from a compliance tracker published in October 2026. The Article 6 guidelines timeline is from the same tracker. Penalty tiers are quoted from Article 99, including the SME rule in Article 99(6).

Limitations of the Five Tests

Three limits apply. The consolidated text of Regulation 2026/1744 was not read directly; dates come from analyses that cite it, and one source could not confirm parts of the German implementation record against a primary legislative source. The nine-of-27 figure is a point-in-time count that will have changed. No German regulator or company was interviewed, so how these beliefs spread rests on published material, not testimony.

Sources

• EUR-Lex — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, Official Journal
• EUR-Lex — Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force 27 July 2026
• eyeon.ai — Germany’s KI-MIG enters into force, Bundesnetzagentur becomes central AI Act authority, July 2026
• Confir — EU AI Act in Germany: enforcement, authorities and business obligations
• AI Law Radar — Germany: AI regulation and deadlines, checked October 2026
• RegDossier — AI Act compliance deadlines: what applies now and what is delayed
• FutureCode — EU AI Act after the Digital Omnibus: what companies must have ready

This article was prepared by the expert team at Global Infinity Labs, drawing on insights and data provided through its MCP data services.

About Global Infinity Labs

Global Infinity Labs is an AI innovation company specializing in MCP data services.

Email: support@globalinfinitylabs.com