Implementing the EU AI Act & KI-MIG

The KI-MIG (German AI Market Surveillance and Innovation Promotion Act) governs supervision of the AI Act in Germany. The Federal Network Agency (Bundesnetzagentur) now checks whether companies meet their obligations. We bring your use of AI into an auditable management system.

AI inventoryRecord every AI system you use or develop in-house, including AI inside purchased tools.

Risk classificationClassification under the AI Act: prohibited practices, high risk, transparency obligations, minimal risk. Clarify your role as provider or deployer.

AI literacy under Art. 4Training concept and evidence for everyone who operates or oversees AI systems.

Governance and AI OfficerRoles, approval process and policies. On request, we provide the external AI Officer with an annual task calendar. More on AI governance

Management system according to ISO/IEC 42001A certifiable AIMS, integrated with your ISMS and data protection. The evidence also counts for the AI Act.

Suppliers and contractsAssess AI providers, review contract clauses and transparency information.

What applies today

Since 2 Feb 2025Prohibited AI practices and the AI literacy obligation (Art. 4)

Since 2 Aug 2025Obligations for general-purpose AI models

Since 29 Jul 2026KI-MIG in force, Federal Network Agency as the central market surveillance authority

Sector supervisionBaFin for financial services, specialist authorities for regulated products

FinesUp to €35 million or 7% of worldwide annual turnover

The deadlines for high-risk systems are currently being adjusted at EU level. The platform shows you the applicable status for each AI system.

In the platform: AI register, risk classification via questionnaire, training evidence under Art. 4, ISO 42001 document library with 20 documents in German and English.

The AI Act requires more than individual measures. It requires clear accountability. Senior management must be able to prove that the use of AI is steered and monitored. We build this structure with you and map it in the platform.

Organisation

AI strategy and AI policy approved by senior management
Role model with RACI matrix: senior management, AI Officer, business units, IT, data protection, information security
AI committee for policy decisions and escalations
Clear role assignment as provider or deployer for each AI system

Processes

Approval process for new AI applications, from request to go-live
Risk and impact assessment, and where required a fundamental rights impact assessment (Art. 27) and DPIA
Human oversight under Art. 14 and deployer obligations under Art. 26
Transparency obligations under Art. 50, for example for chatbots and AI-generated content

Control and evidence

Monitoring in operation and retention of logs
Handling AI incidents and reporting channels
Annual task calendar for the AI Officer
Internal audits and reporting to senior management, integrated into the ISMS and ISO/IEC 42001

In the platform: role matrix, approval workflow for AI applications, policy templates, measure tracking and a governance report for senior management.

AI risk analysis for information security

Our own risk model: identify, assess and control the risks of AI use in an audit-ready way

Classic ISMS risk analyses capture AI scenarios only inadequately. Prompt injection, manipulated agent tools, data leakage via copilots or model drift in production are missing from conventional threat catalogues. Our model closes this gap.

AUse of generative AI by employeesBIn-house AI applications (LLM, RAG, agents)CAI supply chain and third partiesDAI as an attack toolEGovernance and operationsFAI in production (OT security)GAgentic AI and AI assistantsHData protection in the AI lifecycleIEmbedded AI in SaaSJAuthenticity and identityKAI in security processesLLaw, governance, dependencyMAI lifecycle and evidence

Verified knowledge base

76 sample risks, 58 threats, 67 vulnerabilities and 70 measures, backed by 42 documented sources. Your time goes into assessing your situation, not into collecting the basics.

Methodology

Risk chain according to ISO 31000 and ISO/IEC 27005: asset, threat, vulnerability, risk. Aligned with the OWASP Top 10 for LLM and agentic applications, MITRE ATLAS, NIST AI RMF and guidance from BSI, NCSC-UK and ENISA.

Results

Living risk register with live residual risk, measures matrix referencing ISO/IEC 27001, ISO/IEC 42001 and IEC 62443, heat maps, results report and management presentation, ready to use for ISMS, AIMS and NIS2.

Packages: BASIC – AI quick check (6 risk areas, 3–4 consulting days) · STANDARD (12 risk areas, 8–10 consulting days) · PREMIUM incl. OT (all 13 risk areas, 15–20 consulting days). Usually 4 to 8 weeks.

EU AI Act and KI-MIG: use AI with legal certainty