Germany has not enacted a dedicated AI law to date. There are currently no specific statutes or regulations that comprehensively regulate artificial intelligence at the national level. The government has instead relied on existing, technology-neutral laws. In practice, AI systems in Germany are governed by general laws (e.g. the Civil Code, Product Liability Act, data protection law, etc.) rather than an AI-specific act.
A comprehensive AI regulation takes place only at the EU level through the EU AI Act.
To date, no new AI-specific legislation has been formally proposed in Germany. The German government has taken a cautious approach and is largely awaiting the EU’s regulatory framework instead of pursuing a separate national AI act.
However, German officials have indicated through policy statements that they are continuously evaluating whether additional national rules might be needed.
Although formal legislation is absent, Germany has developed a framework of strategies, guidelines, and ethical codes related to AI ("soft law"). Key non-binding instruments and policy documents include:
It should be noted that many of these documents were primarily intended to bridge the gap until binding AI regulations were in place. After the EU AI Act comes into effect, many (though not all) of these initiatives will likely take a back seat.
German policymakers are actively preparing for upcoming AI regulation and monitoring emerging issues:
German IP laws do not expressly reference AI or grant AI-specific rights, but AI is indirectly addressed through interpretations and recent case law. There is currently no special IP statute for AI (and no sui generis IP right for AI-generated inventions or works). However, existing patent and copyright frameworks have been applied to AI-related scenarios.
Germany’s data protection regime is primarily governed by the EU’s General Data Protection Regulation (GDPR) and the supplemental Federal Data Protection Act (BDSG). Neither of these explicitly mentions “artificial intelligence.” In other words, no German privacy law is AI-specific – but AI systems must comply with general data protection principles whenever they process personal data.
One relevant general provision is GDPR Article 22, which gives individuals the right not to be subject to decisions based solely on automated processing that have significant effects (like algorithms denying a loan with no human involvement). This rule directly applies to AI systems engaged in profiling or automated decisions.
In the absence of AI-specific statutes, German data protection authorities (DPAs) have issued extensive guidance and “soft law” for AI.
Germany has not designated a single national “AI regulator.” Oversight of AI currently falls to various existing authorities depending on the context of the AI’s use. Key competent authorities include: Data Protection Authorities (DPAs), Sectoral Regulators, Consumer Protection and Competition Authorities, Federal Office for Information Security (BSI).
As Germany prepares for the EU AI Act, there are ongoing discussions about which authority will be the national AI supervisor. The current draft of the German AI Market Surveillance Act gives first information on the potential market surveillance authority. According to the proposal, the Federal Network Agency (‘Bundesnetzagentur’, ‘BNetzA’) will be designated as the central market surveillance authority and notifying authority. It will also be responsible for operating AI sandboxes and establishing a coordination and competence centre (‘Koordinierungs- und Kompetenzzentrum KI-VO’, ‘KoKIVO’) to especially provide the agency itself technical expertise and also support other authorities.
Given the lack of AI-specific legislation, Germany has not seen any enforcement action “against AI” as such – there’s been no penalty under an AI law (since none exists). However, regulators have begun enforcing existing laws in cases where AI systems caused violations.
In certain regulated sectors, Germany has introduced specific laws or soft-law guidelines that address AI applications. These are not “AI laws” per se, but sectoral regulations that explicitly incorporate AI-driven technology or regulators’ guidance on AI use in that field. Key examples:
*Information is accurate up to 30 April 2025
