KI-MIG: supervision of your AI now has an address

What the KI-MIG settles

That is the point where many companies file it away. Understandable, and premature.

The Bundesnetzagentur takes on three roles at once. Market surveillance authority, single point of contact, complaints office. On top sits a coordination and competence centre for the AI Act that supports the other market surveillance authorities on difficult calls.

The sectoral supervisors stay put. The BSI for IT and cyber security, the data protection authorities for biometric systems, BaFin for finance, BfArM for medical devices. For a municipal utility two familiar addresses now converge: the Bundesnetzagentur for the AI Act and the BSI for NIS2 and the KRITIS umbrella law.

Alongside the supervision sit services. A service desk answers questions, a compliance compass helps with a first self-assessment, and regulatory sandboxes let companies develop and validate systems in a controlled setting. Smaller organisations are an explicit target.

What the authority can now do

Market surveillance is not a paper exercise. The authority can request documents, technical documentation and conformity evidence. It can test AI systems and demand access to training data, source code and technical specifications. And where it finds shortcomings it can order corrective measures, up to withdrawal from the market or a ban on making a system available.

Two things about that are less comfortable than they sound. First, a case does not have to start with a sample drawn by the authority. The complaints office receives submissions and examines them. A rejected applicant, an annoyed customer, a competitor: the trigger need not come from inside the company.

Second, the fine ceiling is not only about the substance. Incorrect information given to the authority carries up to 7.5 million euros or 1 percent of turnover. Answer wrongly because nobody in the company has an overview of the systems in use, and you have created a second problem on top of the first.

Then there is the duty to explain. Let a high-risk system decide about a natural person and you must explain that decision on request in a way the person can follow. Breaching it carries up to 50,000 euros under Section 15(2) of the KI-MIG. Measured against the rest of the range the amount is small. The requirement behind it is not: a model whose decision nobody can explain does not meet it.

Which AI in a utility is in scope

Most companies underestimate the count. Not because they run unusual amounts of AI, but because they only think of what they call AI.

Three groups are typical. Systems acting as a safety component in the operation of critical infrastructure fall under Annex III point 2 of the AI Act. An AI-assisted load forecast that merely proposes something a person then assesses is a different animal from a model that intervenes in grid control. Where exactly the line runs is covered in the article on high-risk AI in energy infrastructure.

The second group is recruitment. Pre-selection, ranking, scoring of CVs: Annex III point 4 names employment explicitly. Plenty of utilities run bought-in modules here, often as part of an HR suite, often without IT knowing.

The third is the quietest one. Every chatbot and text generator in customer contact falls under the Article 50 transparency duties, which have applied since 2 August 2026. For generative systems that were already running before that date, machine-readable marking of their output runs until 2 December 2026.

And AI literacy under Article 4 has applied since 2 February 2025. It requires staff working with AI systems to be adequately trained. That is the duty that has been in force longest and is documented least often.

Provider or deployer

This question decides almost everything that follows, and it tends to be asked too late.

Buy a system and run it unchanged and you are a deployer. That is the lighter role: use as intended, human oversight, logging, informing the people affected. Modify a bought model substantially, put it on the market under your own name or change its intended purpose, and you slide into the provider role. Then conformity assessment, technical documentation, a risk management system and registration apply.

In practice the boundary is softer than the regulation suggests. A company that fine-tunes an open-weight model on its own grid data and puts the result to work in the control room should examine the provider question seriously rather than assume it stays a deployer.

Two readings of the act

Whether the KI-MIG changes anything for a municipal utility gets two answers. Both hold up, they just measure different things.

This does not resolve. Look only at the substantive legal position and you are right and still in trouble when the request lands.

What to do now

Most of the work is stocktaking, not technology.

Five steps for the coming months

1. Create the list in the first place

   Which AI systems run in the house? Do not ask IT alone. Ask HR, customer service, grid operations, sales and procurement, and ask by function rather than by the word AI. A module that pre-sorts applications rarely calls itself that in the purchase contract. This list is the basis for every further question, and in most companies it does not exist.

2. Settle the role per system

   Provider or deployer, and why. One sentence per system is enough as long as it carries a reason.

3. Assemble the response file

   Each system needs the vendor's technical documentation, the conformity evidence where one exists, the intended purpose and a note on who holds human oversight. This is not a certification, it is a folder. The effort happens once; keeping it current is routine.

4. Catch up on training records

   Article 4 has applied since February 2025. Companies that trained back then usually did not record it. That can be caught up, and it should be, before anyone asks.

5. Name a route for requests

   Who receives a request from the Bundesnetzagentur, who answers, within what deadline? It is the same exercise as the NIS2 reporting chain, and in many companies it can be the same person.

If you are unsure whether the AI Act applies to a system at all, the compliance compass published by the Bundesnetzagentur is built for exactly that first sort and costs nothing.

Further reading

Frequently asked questions