KRITIS-Dachgesetz Overview

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

Occasion

Why a KRITIS-Dachgesetz^[1] and why now?

With the KRITIS-Dachgesetz, Germany implements the Directive (EU) 2022/2557 („CER Directive“)^[2] on the resilience of critical entities into national law, establishing for the first time a federal, cross-sector minimum standard for the physical protection of critical facilities. The Bundestag passed the law on 29 January 2026, the Bundesrat approved it on 6 March 2026; it was promulgated on 16 March 2026 in the Federal Law Gazette^[3], and has been in force since 17 March 2026. It pursues the political goal: uniform minimum requirements, a joint reporting office with the BSI and close integration with cybersecurity law (BSIG^[4]/NIS-2^[5]).

The CER Directive obliges member states, among other things, to conduct national risk analyses, identify critical entities, establish minimum operator obligations, and set up supervisory and reporting arrangements; it was to be transposed into national law by 17 October 2024 – Germany has significantly exceeded this deadline.

Status 2026

What has changed compared to the draft

This article originally described the government draft. In the meantime, the KRITIS-Dachgesetz is in force. Three points are crucial for operators:

• Effective since 17 March 2026. Enacted on 11 March 2026, announced on 16 March 2026 in the Federal Law Gazette. The paragraph numbering of the draft has been retained, and all § references in this article remain unchanged.
• The deadline of 17 July 2026 for registration has been removed from the law. The KRITIS-Dachgesetz was amended by Article 8 of the law of 21 July 2026 (BGBl. 2026 I No. 221). The current § 8 no longer mentions a calendar date: Paragraph 1 refers to the point in time from which a facility is considered a critical facility, Paragraph 8 ties the design of the registration procedure to the entry into force of the ordinance pursuant to § 4 Paragraph 3 and § 5 Paragraph 1. The three-month period only begins with its announcement. The BBK explicitly clarifies that there is currently no registration obligation based on the KRITIS-Dachgesetz, as the ordinance is still being developed and coordinated^[6].
• The entire schedule depends on this ordinance. Only after registration do the deadlines of the law begin: Risk analysis after nine months, resilience measures, evidence, and reporting after ten months.

What this practically means: Those who had planned for 17 July 2026 have not missed a legal deadline – but have also not gained planning certainty, as the starting point now depends on an ordinance without a set date. The advantage lies in the additional preparation time gained: Impact assessment, contact point, and risk analysis can be set up without time pressure, so that with the ordinance, only the registration itself remains.

The path from draft to applicable law

• 17 October 2024 – Deadline of the CER Directive for implementation into national law; Germany exceeds it.
• 10 September 2025 – The Federal Cabinet approves the government draft.
• 6 November 2025 – First reading in the Bundestag.
• 29 January 2026 – Second and third readings; the Bundestag passes the law (Bundestag documents 21/2510 and 21/3855).
• 6 March 2026 – The Bundesrat approves.
• 11 March 2026 – Enactment, announcement on 16 March 2026 in the Federal Law Gazette.
• 17 March 2026 – The law comes into force.
• 21 July 2026 – Amendment by Article 8 of the law of 21 July 2026 (BGBl. 2026 I No. 221): The calendar date for registration is omitted.
• still pending – The ordinance determining critical facilities. Only its announcement triggers the registration obligation and thus sets all further deadlines in motion. A draft is available since May 2026; the status and deadlines are summarized in the article KRITIS Resilience Plan according to § 13 KRITISDachG.
• 1 January 2030 – § 14 Paragraphs 3 to 5 come into force (Article 11 Paragraph 2 of the law of 11 March 2026).

Classification, Terms, Scope of Application, Duties & Supervision

1. Legal Order

EU framework, national law, relation to NIS-2

The announced law (Bundestag documents 21/2510 and 21/3855) anchors the physical resilience framework (“all-hazards approach”) alongside existing IT security law (BSIG, NIS-2 implementation). The aim is coherence, not double regulation, among other things through a joint reporting point and a joint ordinance to determine the target groups (critical facilities vs. NIS-2 “important/particularly important facilities”).

The CER Directive mentions sectors such as energy, transport, finance, health, drinking/wastewater, food, digital infrastructure, among others, and provides the minimum framework that the Dachgesetz fills nationally.

2. Definitions (Excerpt from § 2 KRITISDachG)

The law uses, among others, the following terms central to application and supervision:

• Critical Service: a service for the supply of the general public, whose failure/impairment can have significant consequences for supply security/public safety (conceptual framework § 2; specific identification via statutory regulation).
• Critical Facility / Operator of Critical Facilities: facilities through which a critical service is provided and are essential for this purpose; the addressee is the operator.
• Risk/Risk Analysis/Risk Assessment, Resilience, Incidents, Management: methodological and organisational cornerstones for obligations, evidence and supervision. These definitions are further specified in regulations and, if applicable, industry-specific standards.

3. Scope

Origin from EU law, material framework, sectors

EU Origin: The KRITIS-DachG is the national implementation of the CER Directive and addresses the physical resilience (not cyber) of critical facilities.

Material Scope: The law sets nationwide, cross-sector minimum requirements for operators of critical facilities (identification, registration, risk analyses, resilience plans, reporting obligations) and assigns a supervisory architecture.

Sectors: The law follows the CER systematics (Energy; Transport; Financial/Insurance; Health; Drinking/Wastewater; Food; Information Technology/Telecommunications; Space and other nationally determined areas). The specific determination of addressees (which facility/service in detail) is made by statutory regulation.

Note on Culture/Media/School/Daycare: These areas are not explicitly regulated as separate KRITIS sectors in the law. Their special constitutional relevance, especially media for opinion formation (Art. 5 GG), is highlighted by the BVerfG (ZDF ruling)^[7] and can play a role in political/strategic resilience planning; however, this does not change the current legal sector classification.

4. Application Area

Sector affiliation, thresholds, individual case

Sector Allocation & Thresholds: The law provides for quantitative and qualitative criteria. As a general threshold (for guidance), the provision of services to at least 500,000 inhabitants is used; in addition, qualitative criteria apply (interdependencies, market position, geographical location, impact on security/supply). Below the general threshold, individual case classification is possible if significant impacts are expected. Detailed determination is made by statutory regulation.

„Facility“/Levels: The term facility is object- and impact-oriented; classification is based on the importance of the facility for the respective critical service (not every object in a sector is automatically critical).

5. Responsibilities & Supervision

Who controls, who monitors?

According to § 3 KRITISDachG, the structure of responsibilities for implementation, supervision, and coordination is uniformly defined nationwide.

The central contact point and coordinating authority is the Federal Office of Civil Protection and Disaster Assistance (BBK), which acts as the national contact point in accordance with the CER Directive (EU) 2022/2557. It receives reports of significant incidents together with the BSI, coordinates communication with other authorities, and establishes the connection to the European Commission.

Current Contact and Liaison Offices are provided by the BBK on its official site.

Political Objective (BMI): Uniform minimum standards, avoidance of duplicate structures, clear responsibilities, confirmed in the BMI theme portal „Protection of Critical Infrastructures“^[8].

In addition to the BBK, the law names in § 3 para. 2 KRITISDachG a number of other responsible authorities for specific sectors or sub-areas. These responsibilities are aligned with the existing specialist supervision and departmental distributions within the federal administration.

These include, among others:

• the Federal Network Agency (BNetzA) for electricity, natural gas, and telecommunications infrastructures,
• the Federal Office for Information Security (BSI) for information and cyber security matters,
• the Federal Financial Supervisory Authority (BaFin) for the financial and insurance sector,
• the Federal Office for Economic Affairs and Export Control (BAFA) and the Federal Ministry for Economic Affairs and Climate Action (BMWK) for energy and raw material issues,
• the Federal Ministry of Health (BMG) or subordinately the Robert Koch Institute (RKI) for the health sector,
• and other specialist authorities, such as for nutrition, transport, or water management.

This creates an integrated supervision system in which the BBK assumes the coordination role, while sector-specific supervision remains with the respective responsible federal authorities.

This system is intended to avoid duplicate structures while ensuring cooperation between physical resilience requirements (KRITIS-DachG) and cyber-related requirements (BSIG / NIS-2).

In the future, it is planned that this matrix of responsibilities will be further specified in a joint regulation to create a uniform understanding of sectors, operators, and reporting channels.

6. Overview of Operator Obligations

6.1 Registration & Contact Point

§ 8 KRITISDachG

Note on status: The registration obligation has not yet been triggered – it will only commence with the statutory regulation determining critical facilities. See above, section „Status“.

Operators of critical facilities must register (digital platform) and designate a constantly accessible contact point. Certain information must be kept up to date (including timely/bound changes). The law aims for „once-only“ solutions and a unified technical platform (together with BSIG processes).

6.2 National Risk Analysis

§ 11 KRITISDachG

The Federal Government (led by BMI; with the involvement of departments/states) regularly prepares national risk analyses/assessments for critical services. These form the reference framework for operator obligations and sector-specific specifications.

6.3 Operator Risk Analysis & Assessment

§ 12 KRITISDachG

Operators conduct a risk analysis/assessment at least every four years (and on an ad hoc basis) — including interdependencies within/between sectors and, if applicable, cross-border. The federal government can stipulate methodological requirements/templates by regulation to ensure uniformity and comparability. How the assessments of individual resources can be consolidated into an overall picture across processes and locations is shown in the article on risk aggregation.

6.4 Resilience Obligations & Resilience Plan

§ 13 i. V. m. § 14/§ 15 KRITISDachG

Based on the operator risk assessment, appropriate, proportionate measures must be defined and recorded in a resilience plan (technical, organisational, personnel; including prevention, response, recovery). The law includes resilience goals and authorises minimum requirements by regulation; industry-specific standards can be recognised. What the resilience plan must contain, the deadlines that apply, and how it can be structured is described in the article KRITIS Resilience Plan according to § 13 KRITISDachG.

6.5 Proof, Audit and Order Powers

§ 16 KRITISDachG

The competent authority can request proof/audits, demand access and documents, and order remedial measures in case of deficiencies (including a deficiency remediation plan).

6.6 Reporting System

§ 18 KRITISDachG

Significant incidents must be reported immediately via the joint reporting office (BBK/BSI); the law provides for a multi-stage procedure (initial report, follow-up information, final report). The aim is uniformity with BSIG processes (a single point of contact).

6.7 Management Obligations

§ 20 KRITISDachG

The management is responsible for the organisation, resources, and processes to fulfil the resilience obligations; in the event of culpable breaches of duty, the general corporate/liability standards apply.

6.8 Reports to the EU

§ 21 KRITISDachG

The Federal Government regularly reports to the EU, among other things, on national risk analyses, identified operator numbers, thresholds, and incident statistics (transparency in relation to the CER Directive).

7. Sanctions & Legal Consequences

§ 24 KRITISDachG

Administrative offences include, among others, violations of registration and reporting obligations or non-compliance with official orders. Fines are tiered (up to the high six-figure range, depending on the offence); in addition, the authority can order substitute performance and impose the costs.

8. Excursus

Media, culture, school and daycare with constitutional relevance, but no separate sector

Freedom of broadcasting particularly protects public opinion formation. The BVerfG (ZDF ruling) emphasises the constitutional significance of media-related structures; nevertheless, media/culture/school/daycare are not normed as independent KRITIS sectors in the government draft. Subsequent political integration through strategies/regulations remains unaffected but requires clear demarcation from press/broadcasting law.

9. Practical Checklist for Operators

1. Check for impact (sector/threshold, individual case option) → § 4, § 5;
2. Create/update registration & contact point → § 8;
3. Observe national risk analysis (§ 11) and conduct own risk analysis at least every 4 years (§ 12);
4. Create/implement resilience plan; if necessary, apply minimum requirements/standards (§ 13–15);
5. Evidence/audits: cooperation, remedy of deficiencies (§ 16);
6. Report significant incidents via the joint reporting point (§ 18);
7. Organisationally anchor management duties (§ 20);
8. Know sanctions (administrative offences, fines/substitute performance, § 24).

The KRITIS-Dachgesetz closes the previously missing federal legislative gap for the physical protection of cross-sector critical facilities and consistently links them to EU requirements (CER) and national IT security law (BSIG/NIS-2). For operators, this means: clear identification, binding processes (risk/resilience/reporting) and uniform supervision, with noticeable but manageable compliance obligations and the opportunity to credit existing measures.

Resilience Sectors in Comparison

The KRITIS-Dachgesetz (physical protection/resilience) implements the EU-CER directive into German law and creates a nationwide framework for operators of critical facilities; the sectoral fine selection is to be carried out by regulation.

The BSI-Kritisverordnung (BSI-KritisV), on the other hand, has been specifying IT-KRITIS according to BSIG for years through sector-specific thresholds (e.g. energy, water/wastewater, health, nutrition, IT/telecommunications, transport/traffic, finance/insurance, municipal waste disposal).

The NIS2UmsuCG (cybersecurity) assigns facilities in Annex 1 (sectors of particularly important and important facilities) and Annex 2 (sectors of important facilities) to the EU-NIS-2 Annexes I/II.

• KRITIS-DachG (Framework + Regulation): Sectors are oriented towards the CER grid (including energy, transport, health, drinking/wastewater, nutrition, digital infrastructure, space). Which facilities/services are ultimately addressed is determined by a regulation to the framework law.
• BSI-KritisV (BSIG-KRITIS): Sets sector-specific thresholds and facility categories (e.g. generation/transmission facilities in the energy sector, facilities and thresholds for nutrition, etc.).
• NIS2UmsuCG Annex 1: Adopts the high-criticality sectors according to NIS-2 (e.g. energy, transport, banking/financial market infrastructure, health, drinking water, digital infrastructure, space); these are regularly considered particularly important facilities.
• NIS2UmsuCG Annex 2: Covers the other critical sectors of NIS-2 (e.g. postal/courier, waste management, chemicals, food production, research, etc.) and classifies them as important facilities.

The Key Differences

1. Protection Objective & Subject Matter

• KRITIS-DachG: Focus on physical resilience of critical facilities/services (all-hazards approach; risk, resilience, and reporting obligations; central contact point BBK).
• BSI-KritisV/BSIG: Cybersecurity regime for KRITIS operators with fixed thresholds per sector and sector-specific standards (B3S).
• NIS2UmsuCG: Cybersecurity for facilities (not „installations“) according to Annex 1/2; size/type and sector determine „particularly important“ vs. „important“.

2. Trigger/Delimitation

• KRITIS-DachG: Combination of qualitative criteria and a regulatory threshold (orientation: impact on ≥ 500,000 inhabitants) plus individual case classification; details via regulation.
• BSI-KritisV: hard thresholds (e.g., performance, capacity) per installation category.
• NIS2UmsuCG: Sectoral allocation according to Annex 1/2; in addition, size criteria and special conditions (deviating from purely installation-related thresholds).

3. Terms & Systematics

• KRITIS-DachG refers to critical service / critical facility / operator (physical).
• NIS2UmsuCG works with facilities (organisational units), structured according to Annex 1/2 (cyber).
• BSI-KritisV specifies KRITIS operators via installation categories per sector.

Planned Harmonisation

The Joint Regulation

The government draft makes it clear in the justification that for clarity and coherence, a joint regulation is planned to determine the operators, in order to harmonise sector/target groups between KRITIS-DachG and BSIG/NIS-2 („unified view“ on sectors/target groups).

Conclusion

The result shows that with KRITIS-DachG, BSI-KritisV, and NIS2UmsuCG, no completely new „parallel universe“ is created for companies, but rather a three-part regulatory framework that overlaps significantly in content but sets different priorities.

• The KRITIS-DachG primarily addresses the physical resilience of facilities and services, i.e., the ability to maintain essential supply services even under disruptions. The specific sectors, thresholds, and obligations are further defined in regulations (VO).
  
  
• The BSI-KritisV remains relevant as the existing basis for IT-KRITIS and primarily defines installation-related thresholds per sector – with a strong focus on large, critical technical systems.
  
  
• The NIS2UmsuCG (with its Annexes 1 and 2) focuses instead on facilities and companies in NIS-2 sectors and primarily addresses cyber and information security („particularly important“ and „important“ facilities).

What does this mean for companies specifically?

From a company perspective, several key conclusions can be drawn from this conclusion:

1. Check early which regimes apply
   Companies should systematically clarify:
   
   
   • Do we fall under the KRITIS-DachG (physical/supply-related relevance)?
   • Are we classified under NIS2UmsuCG as a „significant“ or „particularly significant“ entity or likely to be affected?
   • Do existing regulations of the BSI-KritisV (IT-KRITIS) still play a role for us? This classification is the basis for any further implementation planning.
     
     
2. Avoid creating isolated solutions
   It is important not to establish three separate projects (KRITIS-DachG, NIS2, IT-KRITIS) side by side, but to build an integrated resilience and security management:
   
   
   • joint risk management,
   • coordinated ISMS/Information Security Management,
   • binding Business Continuity Management,
   • harmonised processes for incident and crisis management.
     
     
3. Use BCM and resilience as a unifying framework
   Especially since the KRITIS-DachG emphasises physical resilience and NIS2 demands cyber resilience, a holistic BCM (including BIA, recovery strategies, emergency operations, crisis communication) offers itself as a common link. Companies that are already well-positioned here can systematically „dock“ many legal requirements instead of reinventing everything.
   
   
4. Clearly anchor governance & responsibility
   All three regimes emphasise, explicitly or implicitly, the responsibility of:
   
   
   • Management / Top Management,
   • designated roles (e.g. CISO, BCM responsible, KRITIS officers),
   • and a clear governance structure. A robust role and committee model is therefore not a „nice-to-have“ but a prerequisite to demonstrably meet requirements.
     
     
5. Consider interfaces in the supply chain
   Both KRITIS-DachG and NIS2 consider dependencies on service providers and suppliers. Companies should identify their critical service providers and supply chains and contractually and organisationally anchor appropriate requirements (e.g. security and BC clauses, evidence, audit rights).
   
   
6. Be prepared for harmonisation
   A future joint sector/recipient regulation will provide more clarity, but it will not roll back the requirements, rather consolidate and sharpen them. Companies that now:
   
   
   • know their criticalities,
   • have clarified responsibilities,
   • and have established fundamental security and continuity processes, are significantly better prepared when harmonisation comes.

Sources

The information in this article is based on the following sources. Paid standards are not quoted verbatim; their contents are reproduced in essence.

1. Framework Act to Strengthen the Physical Resilience of Critical Facilities (KRITIS-Dachgesetz – KRITISDachG). Freely available at gesetze-im-internet.de. ↑
2. Directive (EU) 2022/2557 on the Resilience of Critical Entities (CER Directive). Freely available at EUR-Lex. ↑
3. Act to Implement Directive (EU) 2022/2557 and to Strengthen the Resilience of Critical Facilities of 11 March 2026 (BGBl. 2026 I No. 66), amended by Article 8 of the Act of 21 July 2026 (BGBl. 2026 I No. 221). Freely available at recht.bund.de. ↑
4. Act on the Federal Office for Information Security and on the Security of Information Technology Systems (BSIG). Freely available at gesetze-im-internet.de. ↑
5. Directive (EU) 2022/2555 on Measures for a High Common Level of Cybersecurity Across the Union (NIS-2 Directive). Freely available at EUR-Lex. ↑
6. Federal Office of Civil Protection and Disaster Assistance: KRITIS-Dachgesetz – Strengthening the Resilience of Critical Infrastructures, with FAQ on the Status of Registration Obligation. Freely available at BBK. ↑
7. Federal Constitutional Court, Judgment of the First Senate of 25 March 2014 – 1 BvF 1/11, 1 BvF 4/11 (ZDF State Treaty). Freely available at bundesverfassungsgericht.de. ↑
8. Federal Ministry of the Interior: Thematic Portal „Protection of Critical Infrastructures“. Freely available at bmi.bund.de. ↑