Germany names BaFin the first financial regulator to enforce Article 50 of the AI Act on banking chatbots from 2 August — but its own record of soft enforcement (the Wirecard affair) is the real unknown
Germany's KI-MIG law, in force since 29 July 2026, gives BaFin (the German financial regulator) the power to fine banks and insurers up to €35 million for misuse of AI. Chatbot transparency (saying "you are talking to an AI") becomes enforceable from 2 August; AI credit scoring waits until December 2027.
The legal timeline is now precise. The Bundestag passed the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) on 11 June 2026, the Bundesrat approved it on 10 July, and the law entered into force on 29 July — closing a real delay: Germany had missed the European deadline of 2 August 2025 to designate its national AI Act enforcement authorities. The chosen setup splits supervision in two: the Bundesnetzagentur covers AI in the rest of the economy (HR, internal tools), and BaFin keeps exclusive authority over AI "directly linked to a regulated financial activity" — banks, insurance, credit scoring. Concretely, two obligations take effect on different dates: transparency (Article 50 — clearly informing that one is talking to an AI, not a human) is enforceable from 2 August 2026, with fines of up to €15 million or 3% of worldwide turnover; the full high-risk AI obligations (credit scoring, insurance pricing) will only enter BaFin's active supervision on 2 December 2027, because of the Digital Omnibus postponement. Jens Obermöller, BaFin's director general for cyber risk and technology, said the regulator would favour dialogue: sanctions will remain "the exception" for institutions that cooperate early.
What cannot be ignored when reading this announcement is BaFin's own history. It is the same regulator whose failed supervision of Wirecard — €1.9 billion in cash that never existed — earned it a damning report from ESMA (the European securities regulator) and a criminal investigation into its own conduct. Having a legal mandate and actually exercising it are two different things: analysts who followed the GDPR rollout note that the first significant fines arrived 18 to 24 months after enforcement began — a pace which, if repeated, would push BaFin's first real AI sanction to early 2028. At AppH, this announcement changes nothing about what we already do: the direct verification of Chichi's code (documented on 30 July in an earlier digest) confirms that the widget's persistent subtitle and the very first message sent, in all 4 languages, disclose "virtual assistant" — not only because a regulator might one day check, but because supporting an SMB owner means never letting them believe they are talking to a human when they are not.
For AppH
- BaFin becomes the first named sector regulator — not just the generic text of the AI Act — to make financial chatbot transparency an active, quantified obligation (up to €15M in fines). It confirms that country-by-country enforcement is becoming concrete, not just theoretical.
- The disclosure Chichi already shows in all 4 languages — verified directly in the code, not taken on someone's word — is exactly what BaFin is starting to check at German banks. AppH did not have to change anything to be ready.
Against / what does not hold indefinitely
- BaFin's enforcement record (Wirecard, the ESMA censure) is a real reason for scepticism about whether this announcement will turn into concrete sanctions before 2028 — having the legal power does not mean using it.
- This remains a German law for the German financial sector. France has not yet named a sector equivalent for its SMBs — the direction is there, the direct obligation for AppH's customers is not yet.
We could have headlined this article "Germany finally tightens the screws on financial AI" — the most honest headline is almost the opposite: it has just given a regulator that itself failed to supervise Wirecard the power to sanction other institutions for a lack of algorithmic control. That is not a problem that invalidates the law — it is a reminder that transparency must never depend solely on the promise that a regulator will one day check. At AppH, Chichi says it is a virtual assistant from the very first message, in all 4 languages, not because a German law makes us, but because an SMB owner has the right to know who they are talking to before deciding whether to trust it. And the same logic applies to action, not only to words: whether it is a German banking chatbot or an AppManager agent drafting a customer reminder, no action with real consequences goes out without a human validating it — it is not the law pushing us, it is the basic condition for "supporting an owner" to mean anything.
Reviewed by a human at AppH