The KRITIS Umbrella Act: New Regulatory Framework for Critical Infrastructure Resilience
The KRITIS Umbrella Act (KRITIS-DachG), approved by the Bundesrat on March 6, 2026, marks a milestone in German security law. Germany is thereby implementing EU Directive (EU) 2022/2557 on the resilience of critical entities (CER Directive). For the first time, the KRITIS-DachG establishes a cross-sectoral framework for the physical and organizational protection of critical facilities against all hazards such as natural disasters, technical failures, sabotage, or terrorist attacks. Additionally, the act lays the foundation for a new national KRITIS resilience strategy, which will replace the outdated 2009 strategy and serve as the guideline for protective measures, risk assessments, and coordination between the federal government, states (Bundesländer), and operators.
The KRITIS-DachG seamlessly complements existing regulations such as the BSI Act (BSIG) on cybersecurity and NIS-2, without replacing them. While BSIG and NIS-2 primarily cover cyber threats, the KRITIS-DachG addresses physical resilience.
Who is affected?
The core addressees are operators of critical facilities responsible for delivering critical services in key sectors. Criticality is based on supply thresholds—typically starting at around 500,000 individuals served. Federally regulated sectors include energy, transport and traffic, financial and social insurance services, IT/telecommunications, space-ground infrastructure, and public administration. State-level sectors like healthcare, drinking water and wastewater management, food supply, and municipal waste disposal are subject to more flexible classification by state authorities.
Which specific facilities qualify as critical will be defined in a federal ordinance setting sector- and facility-specific thresholds, prospectively replacing the existing BSI-KRITIS Regulation. States may also designate additional facilities as critical within their competence.
What are the core obligations?
Affected companies must verify their scope, register if applicable, and implement various technical and organizational measures (TOMs):
Financial sector and IT/telecom operators are largely exempt from operational obligations (incident reporting, prevention, evidence)—beyond registration—due to DORA and NIS-2/BSIG as special regimes. Operators in municipal waste and social insurance are exempt from most operational rules but must conduct a § 12 KRITIS-DachG risk analysis every four years, fully documented and available upon request.
The KRITIS-DachG empowers the Federal Ministry of the Interior to issue cross-sector minimum requirements via ordinance (e.g., emergency preparedness, crisis communication, physical security). Sector-specific standards from associations can be BBK-recognized. Oversight lies with federal/state authorities, leveraging existing security regulations, in particular BSIG, to avoid double checks and to minimize burdens.
What are the consequences of non-compliance?
The KRITIS-DachG establishes a graduated fine regime for violations. Serious breaches of resilience duties or audit refusal can incur fines up to € 1 million. Like the BSIG, it imposes implementation/oversight duties and personal management liability under corporate law.
Conclusion and Outlook
The KRITIS-DachG enters into force the day after publication in the Federal Law Gazette (expected late March/early April 2026). Companies should therefore proactively prepare for the requirements, starting with an impact assessment (identification of relevant facilities, review of thresholds) and, if necessary, preparation for registration. In order to realize synergies with regard to existing compliance requirements, further implementation should be designed as an integrated compliance and documentation concept (especially in connection with technical and organizational measures based on BSIG/NIS-2).
Dr. Söntje Julia Hilberg, LL.M. (Fordham, NYC)
