The EU AI Regulation became directly applicable across the European Union on 2 August 2026, establishing a uniform legal framework for artificial intelligence systems.
The regulation covers the development, placing on the market, putting into service, and use of AI systems throughout the EU.
In Germany, a key component of national implementation is the Act on Market Surveillance and the Promotion of Innovation in Artificial Intelligence, known as the AI-MIG.
Under Section 2(3) of the AI-MIG, BaFin has been assigned the role of competent market surveillance authority for AI systems directly related to regulated financial activities.
This supervisory remit applies to AI systems placed on the market, put into operation, or used by relevant financial entities operating within Germany.
BaFin’s market surveillance focuses on ensuring compliance with transparency requirements for AI systems that interact directly with people, such as chatbots used in customer communications.
The regulator is also responsible for ensuring compliance with provisions of the EU AI Regulation concerning prohibited AI practices across the financial sector.
BaFin’s supervisory scope extends to high-risk AI systems, which include systems used by credit institutions as part of creditworthiness assessments.
AI systems not directly related to a regulated financial activity, such as applications used in human resources management, fall under the jurisdiction of the Federal Network Agency rather than BaFin.
On 27 July 2026, BaFin issued Circular 08/2026 (WA), clarifying how investment products are classified under the PRIIPs Regulation regarding packaged investment products.
Separately, existing medium-sized and large ESG rating providers wishing to continue operating in the EU were required to have notified ESMA of their intention to apply for authorisation by 2 August 2026.
Those providers must also submit their full application for authorisation no later than the applicable regulatory deadline set out under the transitional arrangements.
After 2 November 2026, third parties will be prohibited from publishing or disseminating ESG ratings from any provider not listed in the register on the ESMA website.
A provider must have submitted an application for authorisation, recognition, or a notification of registration under the transitional arrangement for small ESG rating providers to remain on that register.
On 22 July 2026, BaFin published Supervisory Notice 05/2026 (WA) addressing the full entry into force of the ban on payment for order flow, known as PFOF.
The PFOF ban prohibits accepting payments from third parties for the routing of client orders to trading venues and was introduced through the revision of the EU Regulation on Markets in Financial Instruments, MiFIR.
Investment managers and financial services firms operating across the EU should review their AI systems, ESG rating provider relationships, and order routing practices to ensure full compliance with these overlapping regulatory developments.