AI Act: Federal Government Sets AI Law in Motion

Contents

The Federal Cabinet on Wednesday set in motion its draft law for the implementation of the European AI Regulation (AI Act). The AI Act contains a cross-border regulatory framework for the use of Artificial Intelligence, which is gradually coming into force since 2024. The German implementation law stipulates that the Bundesnetzagentur will assume the role of the AI supervisory authority.

The "KI-Marktüberwachungs- und Innovationsförderungsgesetzes (KI-MIG)" (AI Market Surveillance and Innovation Promotion Act) regulates the national supervisory structure for the development, provision, and operation of AI systems. The Bundesnetzagentur is to lead this supervision. The legal basis for this has been delayed by the end of the traffic light coalition and the new elections. The draft must now still pass through the Bundestag and Bundesrat.

High Risk, High Requirements

Companies that develop or use AI must assess the risk level of their systems and then take appropriate measures to meet legal requirements. The higher the risk, the stricter the requirements for transparency and security.

The EU regulation prohibits, for example, the use of AI programs that perform assessments based on social behavior. For instance, emotion recognition in the workplace or in educational institutions is not permitted. Facial recognition in public spaces is generally prohibited, but there are exceptions for law enforcement agencies to prosecute certain criminal offenses.

"With this law, we are implementing European requirements in a maximally innovation-friendly way and creating lean AI supervision with a clear focus on the needs of the economy," praises Federal Digital Minister Karsten Wildberger. "We are not building an additional bloated authority, but relying on existing structures, proven contact persons, and bundling digital expertise at the Bundesnetzagentur."

Cooperation with Supervisory Authorities

The Bundesnetzagentur is to serve as the "central coordination and competence center, market surveillance authority, and notifying authority." To avoid duplication of structures, existing capacities at other market surveillance authorities such as the Bundeskartellamt (Federal Cartel Office), the Bundesanstalt für Finanzdienstleistungsaufsicht (Bafin), the Bundesamt für Sicherheit in der Informationstechnik (BSI - Federal Office for Information Security), and the data protection authorities are to be used.

The Bundesnetzagentur is thus slowly becoming a super-authority. In addition to its classic tasks of regulating telecommunications, postal services, energy, and rail, the Bonn-based agency is now also the German coordinator for the European Digital Services Act. In this role, it supervises online platforms such as Facebook, Instagram, YouTube, TikTok, and X.

However, the new role of the Bundesnetzagentur is not undisputed. The data protection officers at federal and state level had also claimed the sole AI supervision and had also received support from their European colleagues. This would have given the federal states more weight in AI supervision. There were also voices in favor of establishing a completely new authority.

"Fundamental Design Flaws"

Industry representatives, meanwhile, are calling for the European AI Act to be improved. "With the implementation of the AI Regulation, the federal government is sending an important signal for more practical relevance. However, this does not fix the fundamental design flaws of the European AI Regulation," explains Sarah Bäumchen, Managing Director of the German Electrical and Digital Industries Association (ZVEI).

"We urgently need a fundamental reform of the AI Act," demands Bäumchen. "Because the still existing dual regulation in the use of Artificial Intelligence creates legal uncertainty. Furthermore, it unnecessarily drives up compliance costs. In the industrial context, legal acts such as the Machinery Regulation or the Medical Devices Regulation already explicitly regulate AI safety. These cases should therefore be excluded from the AI Regulation."

(vbr)