Germany's KI-MIG takes effect — BaFin gains AI enforcement power over banks and insurers
Germany's AI Market Surveillance and Innovation Promotion Act (KI-MIG) entered into force on 29 July 2026, finally designating national AI Act enforcement authorities after Germany missed the EU's own August 2025 designation deadline: BaFin for financial services, the Bundesnetzagentur for the wider economy, with the BfDI retaining the GDPR overlay. BaFin's mandate is live now for Article 50 transparency (chatbot disclosure, enforceable from 2 August) and prohibited-practice violations (fines to €35M or 7% of turnover); the harder Annex III high-risk tier — credit scoring, insurance pricing — is deferred to December 2027 under the Digital Omnibus, consistent with the tracker's own Annex III date. The instructive detail for any regulatory-strategy conversation: commentary is already citing BaFin's Wirecard-era enforcement failures as reason to doubt a newly-armed regulator will use these powers early, versus the 18–24 month lag GDPR fines took to materialise after enforcement began. A useful comparator for how Ireland's own 15-regulator sectoral model may behave once its AI Office is live from 1 August.
Source: Tech Times (BaFin/KI-MIG)
Senate hearing advances bill forcing social media firms into Nigeria, plus an AI Academy bill
The Senate ICT Committee held a public hearing on 24 July on two bills with direct AI-governance relevance: Sen. Ned Nwoko's bill amending the NDPA 2023 to require social media companies operating in Nigeria to maintain a physical local office (explicitly framed by its sponsor around AI research, compliance and trust-and-safety functions, citing Ireland's Big Tech hub model as the template Nigeria should emulate), and Sen. Yemi Adaramodu's bill establishing an AI Academy in Omuo-Ekiti, Ekiti State. Both cleared the hearing with Senate leadership backing and now move to committee report stage before a floor vote — a harder, better-sourced data point than the still-unconfirmed 'Digital Economy Bill has passed the Senate' claim already tracked from 21 July. For anyone advising platforms or AI vendors with a Nigerian user base, a physical-presence mandate routed through an NDPA amendment is a materially different compliance ask than the risk-classification regime NITDA has been drafting — worth tracking as its own legislative track, not a restatement of the Digital Economy Bill.
Source: The Telegraph Nigeria
EDPB and Commission announce joint guidelines on GDPR–competition law interplay, Oct. consultation
The EDPB and European Commission announced on 23 July a remote stakeholder consultation set for 15 October 2026 to inform joint guidelines on how data protection law and competition law interact — the second structured input session in a process tracing back to the CJEU's July 2023 Meta v Bundeskartellamt ruling, which let competition authorities weigh GDPR compliance in dominance cases provided they consult the lead DPA and are bound by its findings. The gap the guidelines are meant to close: what information the two regulator types can share, and which authority holds lead jurisdiction when the same data-harvesting conduct is both a privacy violation and a market-power abuse. For any client building AI products dependent on a dominant platform (data access, API terms, training-data supply), this is the direction EU enforcement is heading — a company will no longer be able to play a favourable DPA finding off against an unfavourable competition ruling on the same facts, or vice versa. No binding text yet; a formal call for expressions of interest is expected on the EDPB site in the coming weeks.
Unsure which of these developments applies to your AI systems?
Begin in writing →This briefing is general information, not legal advice, and does not create an advisor–client relationship. Summaries are original; follow source links for the full record. Adesanya AI Advisory — Abdulwahab B. Adesanya, Barrister-at-Law (Nigeria).