The KRITIS Umbrella Act and Physical Resilience

What the KRITIS Umbrella Act does

The KRITIS Umbrella Act (KRITIS-Dachgesetz, KRITISDachG) of 11 March 2026 creates, for the first time, a uniform federal framework for the physical resilience of critical infrastructure in Germany. It implements the Critical Entities Resilience Directive (Directive (EU) 2022/2557, CER Directive) and entered into force on 17 March 2026. While the BSI Act (BSIG) as revised for NIS2 deals with cybersecurity, the KRITIS Umbrella Act addresses all other hazards: natural disasters, sabotage, terrorism, insider threats, public health emergencies and supply chain disruptions.

Operators of critical facilities (Betreiber kritischer Anlagen) must register, carry out risk assessments, take resilience measures, document them in a resilience plan, report incidents and ensure that management implements and monitors the measures. The obligations are triggered step by step after an operator has registered, and their scope depends on an ordinance that defines critical services and facility thresholds.

The CER Directive required Member States to transpose it by 17 October 2024 and to identify their critical entities by 17 July 2026 (Articles 26 and 6 of the Directive). Germany adopted its implementing law later than the transposition deadline, so the practical identification of operators is now catching up. Companies that have not previously been regulated as critical infrastructure under the BSIG thresholds may be covered for the first time.

Who is covered

The KRITIS Umbrella Act applies to operators of critical facilities in ten sectors (§ 4(1) KRITISDachG): energy; transport; finance; social insurance and basic income support for jobseekers; health; water; food; information technology and telecommunications; space; and municipal waste disposal. The Federal Ministry of the Interior determines by ordinance which critical services belong to each sector (§ 4(3)) and which categories of facilities are significant for providing them, using thresholds based on the level of supply (§ 5(1)). As a rule, the threshold is a facility serving 500,000 inhabitants (§ 5(2)). The ministry can also determine in individual cases that a facility is or is not significant (§ 5(3)).

Several sectors are largely exempt from the operative obligations because they are covered by other regimes (§ 4(2)): financial entities subject to the Digital Operational Resilience Act (DORA), operators in the IT and telecommunications sector, and — except for risk assessments — operators in the waste disposal and social insurance sectors. Operators should therefore check carefully which parts of the law apply to them.

Resilience measures and the resilience plan

Operators must take measures to prevent incidents, ensure adequate physical protection of premises and facilities, respond to and limit the effects of incidents, and ensure rapid recovery of the critical service (§ 13(1)). The measures must be proportionate, based on the national risk assessments and the operator's own risk assessment, and should reflect the state of the art; economic aspects, including the operator's capacity, are taken into account (§ 13(2)).

Examples listed in the law include emergency preparedness, fencing and building protection, surveillance of surroundings, detection equipment and access controls, crisis management procedures and alarm protocols, business continuity measures such as emergency power supply, alternative supply chains, personnel security management (including staff of external service providers), and training and exercises (§ 13(3)).

The measures must be set out and applied in a resilience plan explaining the considerations behind them, which must be updated as needed and after each risk assessment (§ 13(4)). The Federal Office of Civil Protection and Disaster Assistance (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe, BBK) is to publish templates. Minimum requirements may be specified by ordinance, and sector associations may propose sector-specific resilience standards for recognition (§ 14).

Using existing evidence

Operators do not have to start from scratch. Risk analyses, documents, measures and certificates that an operator has prepared or obtained under other legal obligations or voluntarily can be used to demonstrate compliance (§ 17(1)), and factual findings by other authorities on such documents are binding in the operator's favour (§ 17(2)). The ministry may also declare by ordinance that obligations under other public-law provisions are equivalent. For operators in heavily regulated sectors, such as energy, water or hospitals, a careful mapping of existing documentation against the KRITIS Umbrella Act can significantly reduce the additional effort.

Critical entities of particular European significance

Operators that provide the same or similar essential services for or in at least six EU Member States can be notified by the European Commission that they are critical entities of particular European significance (§ 9). Such entities may be subject to advisory missions organised by the Commission to assess their resilience measures (§ 10). For German groups with cross-border infrastructure, for example in energy transmission or logistics, this European dimension should be considered when planning governance and documentation.

Incident reporting

Operators must report incidents that significantly disrupt or could significantly disrupt the provision of critical services to the BBK via the joint reporting office set up with the BSI without undue delay and at the latest within 24 hours of becoming aware of them; a detailed report follows within one month (§ 18(1)).

The reports must contain the information needed to understand the nature, cause and possible cross-border effects of the incident, including the number and share of persons affected, the duration and the geographical area (§ 18(2)). Reporting obligations under other laws, such as the BSIG for cyber incidents, remain unaffected. A single event such as a sabotage attack that also affects IT systems may therefore trigger reports under both regimes. See our insight on incident response after a cyber attack.

Management duties under the KRITIS Umbrella Act

Mirroring the NIS2 rules, § 20 KRITISDachG requires management of operators to implement the resilience measures and to ensure their implementation through suitable organisational measures. Managers who breach this duty are liable to their entity for culpably caused damage under the company law rules applicable to the legal form, for example § 93 AktG or § 43 GmbHG (§ 20(2)). Unlike § 38 BSIG, the KRITIS provision does not contain a training obligation. See our insight on NIS2 management liability.

Supervision, audits and fines

The BBK is the central contact point; competent authorities vary by sector — for example, the Federal Network Agency for electricity, gas, hydrogen and telecommunications, and authorities of the federal states for many other services (§ 3). Authorities select operators for checks on a risk-based approach and can request evidence, including the resilience plan and audit results, and carry out inspections (§ 16). They can also draw on evidence submitted to the BSI under the BSIG.

Fines under § 24 KRITISDachG are moderate compared with cybersecurity law: up to EUR 100,000 for registration failures, up to EUR 200,000 or EUR 500,000 for certain breaches of orders and audit duties, and up to EUR 1 million for failing to comply with an enforceable order relating to registration. The real risks lie elsewhere: orders by authorities, reputational damage, liability of management and, in a crisis, the consequences of insufficient preparation.

Exemptions

The Federal Ministry of the Interior can partially or fully exempt operators from obligations where their resilience is otherwise ensured and supervised by the state, in particular for operators active in national security, public security, defence or law enforcement (§ 22). For most commercial operators, exemptions will not be relevant, but operators that work closely with security authorities should examine the option.

Practical steps for operators

The operative obligations depend on the ordinance under §§ 4(3) and 5(1) that defines critical services and thresholds. The same ordinance is relevant under the BSIG, which makes certain provisions on critical facilities applicable only once it has entered into force (§ 66 BSIG). Companies should monitor its adoption and in the meantime:

1. Assess whether any of their facilities could qualify as critical under the expected thresholds.
2. Prepare registration data, including contact points and facility information.
3. Start an all-hazards risk assessment, including dependencies on suppliers and other sectors.
4. Map existing physical security, business continuity and crisis management measures against § 13.
5. Establish incident reporting processes aligned with BSIG reporting.
6. Brief management on its duties and set up reporting lines.

Suppliers and service providers of operators should also expect contractual requirements on personnel security, access controls and continuity of supply. The law expressly includes personnel security management for staff of external service providers among possible measures, and operators will need to pass on requirements to security firms, maintenance contractors and facility managers working on their sites. Supply contracts for critical inputs, such as chemicals for water treatment or spare parts for grid equipment, may need to address stockholding, alternative sourcing and priority delivery in a crisis.

Illustration

Illustration (hypothetical): a municipal utility supplies drinking water to more than 500,000 inhabitants and therefore expects its main waterworks to qualify as a critical facility. Within three months of qualification, it registers via the joint BBK and BSI platform. Nine months after registration, it must have completed an all-hazards risk assessment covering flooding, drought, power outages, sabotage and dependencies on chemical suppliers. One month later, its resilience plan must be in place, describing perimeter protection, emergency power, crisis organisation and staff training, and its management must have arranged for implementation and regular reporting. The utility uses its existing technical safety management documentation to show compliance where possible.

How TRW & Co helps with the KRITIS Umbrella Act

We advise operators of critical facilities and their suppliers on the KRITIS Umbrella Act: scope and registration, risk assessments, resilience plans, incident reporting and the interaction with the BSIG, DORA and sector regulation. We advise management and supervisory boards on their duties and liability, draft supply and service contracts with resilience requirements, and represent clients before the BBK and competent authorities. See our pages on cybersecurity and NIS2 and energy and infrastructure, or contact us.