Knowledge · Law and deadlines
KRITIS umbrella act: duties and deadlines.
Since March 2026 the KRITIS umbrella act (KRITIS-Dachgesetz) has governed the physical resilience of critical facilities in Germany. This page summarises who is affected, which deadlines run and what is still missing.
What does the KRITIS umbrella act require?
The KRITIS umbrella act has applied since 17 March 2026. Operators of critical facilities must register with the BBK no later than three months after being classified, then carry out a risk analysis, implement a resilience plan and report significant disruptions within 24 hours. Which facilities count as critical is set by an ordinance. The federal interior ministry presented a draft in May 2026; no adoption was known as of this page.
As of · SAFETEE editorial team · responsible: Marc Riegel
Since when has the act applied?
The Act to Strengthen the Physical Resilience of Critical Facilities was signed on 11 March 2026 (Federal Law Gazette 2026 I No. 66) and has applied since 17 March 2026. With effect from 29 July 2026 it was amended by Article 8 of an amending act of 21 July 2026 (Federal Law Gazette 2026 I No. 221).
It covers physical protection: prevention, structural protection, response to incidents and recovery. Cyber security for the same operators remains governed by the BSI Act as amended by the NIS2 implementation act.
Who is affected?
The act covers operators of critical facilities in ten sectors: energy, transport, finance, social security and basic income support, health, water, food, information technology and telecommunications, space, and municipal waste disposal. Some duties do not apply to finance, IT and telecommunications, waste and social security.
The standard threshold is 500,000 people supplied. The exact thresholds per facility type are set by an ordinance. According to an analysis by the law firm CMS, the interior ministry's draft of May 2026 names 104 MW net rated output for energy storage and 36 MW for prequalified primary control reserve. These are draft values, not thresholds in force.
Which duties and deadlines apply?
| Duty | Deadline | Provision |
|---|---|---|
| Registration with the BBK (joint procedure with the BSI) | no later than 3 months after the facility counts as critical | Section 8 (1) |
| Report changes | without delay, within 2 weeks at the latest; supply figures once a year | Section 8 (6) |
| Risk analysis and risk assessment | first 9 months after registration, then at least every 4 years | Section 8 (7), section 12 |
| Resilience measures and resilience plan | 10 months after registration | Section 8 (7), section 13 |
| Reporting of significant disruptions | initial report within 24 hours of becoming aware, full report within one month; applies from 10 months after registration | Section 8 (7), section 18 |
| Implementation and oversight by management | from 10 months after registration | Section 8 (7), section 20 |
All deadlines run from classification or registration, not from a calendar date. The wording in the Federal Law Gazette is authoritative.
Is there a fixed date for registration?
No. In the version of 29 July 2026, section 8 sets only relative deadlines: three months from classification as a critical facility. A date in July 2026 mentioned earlier no longer appears in the act in that form. The BBK sets the details of the registration procedure in agreement with the BSI within four weeks after the ordinances enter into force and publishes them on its website (section 8 (8)).
In practice the clock therefore starts with the ordinance. Anyone above the thresholds in the draft can prepare responsibilities, the facility list and contact persons now.
Which fines apply?
Section 24 sets four tiers: up to 100,000 euros, up to 200,000 euros, up to 500,000 euros and up to 1 million euros, depending on the breach. Management must implement the resilience measures and oversee their implementation (section 20); its liability is governed by general company law.
How does the act relate to NIS2?
Both frameworks often affect the same operators but different risks. The KRITIS umbrella act governs physical resilience, the BSI Act as amended by the NIS2 implementation act governs cyber security. According to the law firm Advant Beiten, the NIS2 implementation act has applied since 6 December 2025; security incidents must be reported in stages after 24 hours, 72 hours and one month.
The central point of contact for the KRITIS umbrella act is the BBK (section 3). The Federal Network Agency, the BSI and BaFin, among others, are also responsible for their sectors. Registration and reporting are to run through joint channels of the BBK and the BSI.
What the Critical Radar adds
The Critical Radar tracks the ordinance, the start of registration and deadlines in its law and deadlines section, using data from the Bundestag documentation system. The editorial team keeps forecasts with probability and due date on when the next steps will come.
Forecasts with probability and deadline How forecasts are made
Questions and answers
Frequently asked.
When do I have to register with the BBK?
No later than three months after your facility counts as a critical facility. That depends on the thresholds in the ordinance. The act, in the version of 29 July 2026, does not name a fixed calendar date.
Does the act apply below 500,000 people supplied?
The standard value is 500,000 people supplied; the exact thresholds per facility type are set by the ordinance. Specialist sources point out that federal states can additionally designate facilities below that value.
Does the KRITIS umbrella act replace NIS2?
No. It complements NIS2: the KRITIS umbrella act governs physical resilience, the BSI Act governs cyber security. Many operators must comply with both.
How quickly must a disruption be reported?
A significant disruption must be reported without delay, no later than 24 hours after becoming aware of it; a full report follows within one month at the latest. The duty applies from ten months after registration.
Sources
- Act to Strengthen the Physical Resilience of Critical Facilities (KRITISDachG), Bundesamt für Justiz, gesetze-im-internet.de, abgerufen 26.10.2026
- Section 8 KRITISDachG, registration, Bundesamt für Justiz, gesetze-im-internet.de, abgerufen 26.10.2026
- Section 8 KRITISDachG with amendment history, buzer.de, abgerufen 26.10.2026
- KRITIS ordinance: what operators of critical facilities need to know, CMS Hasche Sigle, 16.06.2026
- KRITIS umbrella act: new legal framework for the physical protection of critical infrastructure, GÖRG, 09.03.2026
- KRITIS umbrella act: what companies need to know and do now, IHK Köln, abgerufen 26.10.2026
- NIS2 implementation act in force, Advant Beiten, abgerufen 26.10.2026
All sources were accessed on the date shown. Figures are reproduced unchanged; our own calculations are marked as such. This page is a situation summary, not legal advice.