The Federal Council approved the Kritis umbrella law, which is intended to better protect critical infrastructure. On Friday, the chamber of states opted not to call for the mediation committee and, in a resolution, simply asked the federal government to revise the law in the future.
The law obliges companies in ten strategically important sectors-including energy, food, water, health, transport and traffic-to strengthen the physical protection of their facilities. It specifies which infrastructure assets are considered indispensable for delivering services to the population and sustaining the economy. A regulatory ordinance from the Federal Ministry of the Interior will set out the concrete criteria. In general, facilities that serve more than 500,000 people are covered. The states have an opening clause and may classify plants overseen by a state authority as critical according to their own criteria.
State authorities are required to produce risk analyses for each critical service. These analyses form the basis for regular risk assessments and for operators’ resilience plans. All conceivable risks-from natural disasters to sabotage, terrorist attacks and human error-must be considered, and operators must report incidents.
The statute establishes minimum requirements for all sectors, including emergency measures, redundancy, and stronger site protection. It does not prescribe detailed rules for operators, but instead obligates them to adopt appropriate and proportionate measures. What those measures are can differ from sector to sector and from company to company: for example, flood‑prone areas require different safeguards than other locations, and a hospital must be protected differently than the power grid.
In its detailed statement last November, the Federal Council criticized the draft. It argued that the required increase in resilience would fall short of the states’ expectations and could fail to be achieved uniformly across Germany. The states had also called for lowering the threshold from 500,000 serviced residents to 150,000. The Council further warned that regulatory ordinances regulating detailed matters could be issued without its approval, imposing significant effort and costs on the states.