Germany: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCAR, Regulation (EU) 2023/1114) implemented nationally by the Kryptomärkteaufsichtsgesetz (KMAG, published in the Federal Law Gazette 27 Dec 2024); supplemented by the Banking Act (KWG), the Electronic Securities Act (eWpG, in force since 10 June 2021) and the AML Act (GwG). Competent authority: BaFin, with the Deutsche Bundesbank co-involved for prudential supervision.

Crypto is fully legal in Germany and is comprehensively regulated. Since 30 December 2024 the EU-wide MiCAR regime applies, with the national KMAG giving BaFin enforcement powers and transitional rules; Germany's earlier KWG crypto-custody licence and the eWpG framework for tokenised securities remain part of the stack. The 12-month national grandfathering for KWG-licensed crypto firms expired on 31 December 2025, so CASPs now operate in Germany only with a MiCAR authorisation (or by EU passport).

Framework: EU AI Act (Regulation (EU) 2024/1689) as directly applicable law, implemented nationally by Germany's KI-MIG (Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz), in force since 29 July 2026. The Bundesnetzagentur (BNetzA) is the central market surveillance authority and national point of contact.

As an EU member state, Germany is governed by the directly applicable EU AI Act, whose prohibitions have applied since 2 February 2025 and whose general-purpose AI (GPAI) obligations have applied since 2 August 2025, with most Annex III high-risk obligations now applying from 2 December 2027. Germany's national implementing statute, the KI-MIG, entered into force on 29 July 2026 and designates the Bundesnetzagentur as the central market surveillance authority, single point of contact to the EU AI Office, and complaints body, complemented by sectoral supervisors (BaFin for financial services, BfArM for medical devices, state media authorities, and DPAs for data protection aspects). Germany also runs a national AI Strategy with substantial funding and infrastructure initiatives (Agentic AI Hub, National Data Centre Strategy).

Framework: EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) as directly applicable law, implemented and supplemented nationally by the Bundesdatenschutzgesetz (BDSG, Federal Data Protection Act, in force since 25 May 2018, last amended 2021), with sector-specific rules in the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, formerly TTDSG). Enforcement is decentralised: the Federal Commissioner for Data Protection and Freedom of Information (BfDI) supervises federal public bodies and telecoms/postal providers, while 16 state (Länder) data protection authorities supervise the private sector and Land bodies.

Germany has one of Europe's oldest and most developed data-protection regimes, anchored today in the directly applicable EU GDPR and the national BDSG, which uses GDPR opening clauses to add stricter national rules on employee data, video surveillance, credit scoring, DPO appointments and criminal penalties. Supervision is uniquely decentralised across the BfDI plus 16 Länder authorities coordinating through the Datenschutzkonferenz (DSK); the 2025 coalition agreement (CDU/CSU–SPD) proposes centralising private-sector oversight under a renamed BfDI. Cookies and device-storage tracking are governed by §25 TDDDG (ePrivacy transposition), with a consent-management ordinance that took effect on 1 April 2025.

Framework: Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – ZAG), transposing EU PSD2 and EMD2, administered by BaFin with operational supervision by the Deutsche Bundesbank; complemented by the EU Instant Payments Regulation, PSD2 open-banking rules, the new Sales Financing Supervision Act (AbsFinAG) for BNPL, and MiCA/KMAG for crypto-asset services.

Germany operates a mature, EU-harmonised licensing regime for digital payments and fintech. BaFin authorises payment institutions (PIs) under §10 ZAG and e-money institutions (EMIs) under §11 ZAG, and registers account information service providers (AISPs) under §34 ZAG, applying the EBA PSD2 authorisation guidelines. Open banking is implemented via PSD2/XS2A (Berlin Group NextGenPSD2 standard), instant payments are mandatory under the EU Instant Payments Regulation, and BNPL is being brought under supervision through the new AbsFinAG that transposes CCD II, entering into force on 20 November 2026.

Framework: German Residence Act (Aufenthaltsgesetz, AufenthG) — no dedicated digital-nomad visa; remote workers use §21(5) Freiberufler (liberal-profession freelance) permit, §21(1) self-employment permit, the Chancenkarte (Opportunity Card, effective June 2024), or the EU Blue Card (§18g). Competent authorities: German consulates abroad, the Federal Foreign Office (Auswärtiges Amt), and local Ausländerbehörden.

Germany has NO dedicated digital-nomad visa. Remote workers who wish to relocate use adjacent long-stay routes — most commonly the Freiberufler (freelance) residence permit under §21(5) AufenthG for liberal professions (IT, consulting, design, journalism, etc.), the broader self-employment permit under §21(1) for commercial founders, the Chancenkarte (Opportunity Card) points-based job-seeker permit launched 1 June 2024, or the EU Blue Card for employed skilled workers. All are issued via German consulates and the local Ausländerbehörde, initially for up to 3 years.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) implemented nationally by the Digitale-Dienste-Gesetz (DDG, in force 14 May 2024), enforced by the Bundesnetzagentur as Digital Services Coordinator; complemented by federal youth-protection law (JuSchG) and the interstate Youth Media Protection Treaty (JMStV) enforced by BzKJ and KJM

Germany operates a comprehensive, in-force regime for online content and platform safety anchored in the EU Digital Services Act and its national implementation, the Digitale-Dienste-Gesetz (DDG), which entered into force on 14 May 2024. The DDG designates the Bundesnetzagentur (BNetzA) as the national Digital Services Coordinator, largely repealed the earlier Network Enforcement Act (NetzDG) and replaced the Telemedia Act (TMG) for platform matters. Youth protection online is layered on top through the federal JuSchG (with the Bundeszentrale für Kinder- und Jugendmedienschutz / BzKJ) and the interstate JMStV (enforced by the Kommission für Jugendmedienschutz / KJM), which impose strict age-verification and 'closed user group' requirements for age-restricted content.

Framework: NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG), which amends the BSI-Gesetz (BSIG); administered by the Bundesamt für Sicherheit in der Informationstechnik (BSI). Complemented by the KRITIS-Dachgesetz (Critical Infrastructure Resilience Act), sector rules under DORA/BaFin for finance, and the EU GDPR regime for personal-data breaches.

Germany has a comprehensive, in-force cybersecurity regime. The NIS2UmsuCG entered into force on 6 December 2025 without a transition period, transposing EU Directive 2022/2555 and rewriting the BSIG; the BSI became the central supervisor and incident-reporting hub, with a national registration portal live since 6 January 2026. The regime is layered with the KRITIS-Dachgesetz (in force 17 March 2026) for critical-infrastructure resilience and DORA (applicable since 17 January 2025) under BaFin for the financial sector.

Framework: GmbH-Gesetz (GmbHG) and Handelsgesetzbuch (HGB) for company formation, Gewerbeordnung (GewO) for trade registration, § 21 Residence Act (AufenthG) for non-EU self-employment; competent bodies are the local notary, the Handelsregister at the Amtsgericht, the Gewerbeamt (trade office), the Finanzamt (tax office), and the Transparenzregister.

Germany imposes no nationality or residency restriction on shareholders — foreigners and foreign entities can own 100% of a German company (GmbH, UG, AG or branch). Formation is straightforward on paper but procedural: notarization is mandatory, the GmbH requires €25,000 share capital (€12,500 paid-in) while the UG 'mini-GmbH' can be formed from €1, and a typical timeline to full Handelsregister entry is around 2–8 weeks. Non-EU founders who want to run the business from Germany additionally need a self-employment residence permit under § 21 AufenthG.