Hamburg makes its privacy regulator the AI Act watchdog for city agencies

Hamburg makes its privacy regulator the AI Act watchdog for city agencies

21 October 2026: Hamburg's parliament has made the city's data protection commissioner, the HmbBfDI, the market surveillance authority under the EU AI Act for every AI system that Hamburg's public bodies place on the market, put into service or use, with effect from 1 January 2027. The change came through an amendment to the Hamburg Data Protection Act passed at the Bürgerschaft's sitting on 14 October, and it gives suppliers of AI to Hamburg's administration, police and schools a named regulator.

Not yet independently verified. We read the authority's own announcement; the text of the amended Hamburg Data Protection Act (section 19(8)) has not yet been read in the official gazette. We will update this when it can be confirmed, and remove this note.

Two kinds of supervision

The authority describes its new remit in two parts.

• Fundamental-rights-sensitive uses: law enforcement and biometric identification in particular, where the AI Act sets its tightest limits, including the general ban on real-time remote biometric identification in publicly accessible spaces.
• Everything else the city runs: AI in citizen services, the education sector and administration generally. Its own example is schools: an AI system must not lead to pupils getting lower grades or being excluded from exams because of discriminatory assessments.

The HmbBfDI also says it stands ready to set up AI regulatory sandboxes, where new systems are tested under its supervision before wider use. It already advised on LLMoin, the AI assistant the Hamburg administration built for its staff.

How the German map of AI regulators fits together

Article 70 of the AI Act requires each member state to name independent market surveillance authorities, and Article 74(8) says that for AI in sensitive areas such as law enforcement those authorities should be the data protection regulators. Germany's federal law on AI market surveillance, the KI-MIG, gives the Bundesnetzagentur responsibility for private companies and federal agencies, and leaves AI used by the states' own public bodies to authorities chosen under state law. Hamburg has now made its choice in section 19(8) of its data protection act. At European level, the Commission and the AI Office coordinate.

"Die Benennung schafft Rechtsklarheit in Hamburg und sorgt für eine digital kompetente Aufsicht aus einer Hand," said Thomas Fuchs, Hamburg's Commissioner for Data Protection and Freedom of Information: the designation creates legal clarity and puts supervision in one competent pair of hands.

What suppliers to Hamburg's administration should prepare

For a vendor selling AI tools to a Hamburg authority, the change means the same office that already reviews its data processing will also check AI Act compliance, so the documentation for both reviews can be prepared together: the risk classification, the technical documentation and the logging that high-risk systems need, alongside the data protection impact assessment. Vendors whose products touch policing, identity checks or pupil assessment fall into the sensitive part of the remit and should expect the closest look.

Each German state names its own authority under the KI-MIG, so a supplier selling the same product to several state administrations should check which regulator each one has designated. The AI Act's first harmonised standard, on quality management, is now in the Official Journal; our item on EN 18286 covers what it asks of providers.

Sources

• HmbBfDI: KI-Einsatz in Hamburgs Behörden: HmbBfDI wird Marktüberwachungsbehörde (German and English), 21 October 2026