Who counts as the operator of a critical installation?

Under § 2 No. 1 KRITISDachG, the operator is whoever exercises decisive influence over the installation, taking legal, economic and factual circumstances into account. A service provider that runs the installation technically is therefore not automatically its operator under the Act. The finance sector has a special rule: there, decisive influence lies with whoever has actual physical control, and legal and economic circumstances are disregarded.

Can an installation below the threshold be critical?

Yes. Under § 5(3) sentence 1 KRITISDachG, the Federal Ministry of the Interior determines in an individual case that an installation is significant even though it does not meet the ordinance's conditions. Conversely, under sentence 2 it can determine that an installation is not significant despite reaching the threshold. The BBK notifies the operator of the determination and, in the first case, calls on it to register (§ 5(5)).

What happens if an operator does not register its installation?

The BBK can register the installation itself after hearing the operator (§ 8(3) KRITISDachG) and, where facts suggest a breach, demand documents and information (§ 8(2)). Failing to submit the § 8(1) details, or submitting them late, is an administrative offence under § 24, with a fine of up to EUR 100,000. Breaching an enforceable order under § 8(2) sentence 1 can cost up to EUR 1 million.

Does the KRITIS-Dachgesetz apply to banks and insurers?

In part. § 4(2) KRITISDachG exempts financial entities under Article 2(2) DORA from the risk analysis, resilience measures, incident reporting and management-body duties. The same applies to companies covered by DORA via § 1a(2a) KWG or § 293(5) VAG. Registration under § 8 remains mandatory. Under § 28(6) BSIG, §§ 30 to 32 and 39 BSIG do not apply to these companies either.

Do the BSIG's NIS2 duties also apply to KRITIS operators in the energy sector?

Not all of them. Under § 28(5) BSIG, §§ 30, 32 and 39, among others, do not apply to operators of energy supply networks, energy installations or digital energy services under the Energy Industry Act (EnWG). The condition is that they are subject to §§ 5c to 5e EnWG. The same applies to operators of public telecommunications networks. The exemption ends where the entity also operates further critical installations; the BSIG covers their IT systems.

Which reporting deadlines apply to KRITIS operators?

Two, and they are counted differently. Under § 18(1) KRITISDachG, operators report an incident no later than 24 hours after becoming aware of it and update that initial report while the incident continues. They submit a detailed report no later than one month after becoming aware. Under § 32(1) BSIG, the 24-hour initial report is followed by a report after 72 hours and a final report one month after that 72-hour report.

Critical Infrastructure (KRITIS) in Germany

What is critical infrastructure (KRITIS)?

In German law, critical infrastructure is not a company but an individual critical installation. § 2 No. 3 KRITISDachG defines it as an installation that is significant for providing a critical service. Under § 2 No. 4, a critical service supplies the general public, and its failure would cause serious supply shortfalls or endanger public safety.

§ 2 No. 22 BSIG, the BSI Act, refers to this definition, so one classification holds for both statutes. How KRITIS fits into the NIS2 duties is set out in the NIS2 guide.

Which sectors count as KRITIS?

Ten sectors count as KRITIS. § 4(1) KRITISDachG names them:

energy
transport and traffic
finance
social insurance benefits and basic security benefits for jobseekers
health
water
food
information technology and telecommunications
space
municipal waste disposal

Until the ordinance under § 5(1) KRITISDachG takes effect, installations are classified under the BSI-Kritisverordnung (BSI Critical Infrastructure Ordinance). Its §§ 2 to 10 cover nine of these sectors; it sets no installation categories for space.

When does an installation count as critical?

An installation counts as critical when it belongs to an installation category and reaches that category's threshold for the degree of supply. Under § 5(1) KRITISDachG, the Federal Ministry of the Interior sets the categories, thresholds and reference dates by statutory ordinance. The same ordinance names categories that count as significant without any threshold.

As of October 2026, that ordinance is not in force. Until it is, the BSI-Kritisverordnung continues to apply: under its own § 12, it only lapses once that ordinance takes effect.

§ 5(2) sentence 2 KRITISDachG sets the yardstick: the standard value for the thresholds is, in principle, 500,000 residents supplied by an installation. This standard value is not a test you can apply directly but the figure the thresholds are calculated from.

How do 500,000 residents become a threshold?

Part 2 of each annex to the BSI-Kritisverordnung converts the standard value into a measure of the installation, using a per-person figure. Three examples:

Sector	Installation category	Measure	Derivation	Threshold
Energy (Annex 1)	generating installation	installed net rated capacity	1,815 kWh per person per year × 500,000 ≈ 908 GWh per year, divided by 8,760 hours	104 MW
Water (Annex 2)	abstraction installation	volume of water abstracted	44 m³ per person per year × 500,000	22 million m³ per year
Finance (Annex 6)	authorisation system for cash withdrawals at cash machines (cash supply)	transactions per year	30 transactions per person per year × 500,000	15 million transactions

Only the right-hand column decides the classification. A generating installation with 104 MW or more of installed net rated capacity is critical, whatever the number of households it supplies.

Part 1 of the annexes sets the reference dates. The operator determines the previous year's degree of supply by 31 March. If an installation reaches the threshold for the first time, it counts as critical from 1 April of the following year. Several installations of the same kind that are closely linked in operation are added together as a joint installation.

Operators of critical installations are essential entities

Under § 28(1) No. 1 BSIG, operators of critical installations count as essential entities (in the BSIG: besonders wichtige Einrichtungen). They therefore carry the NIS2 duties of the BSIG. All other essential and important entities fall under the Act through their type of entity, without operating a critical installation.

A size threshold applies on top. Without one, § 28 BSIG covers trust service providers, TLD registries and DNS service providers ((1) No. 2, (2) No. 1). The same holds for providers of public telecommunications networks and services, which fall under (1) No. 3 or (2) No. 2 whatever their size.

Feature	Operators of critical installations	Other entities under § 28 BSIG
Trigger	threshold of an individual installation	type of entity under § 28(1) No. 2 to 4 or (2) BSIG
Size threshold	none	from 50 employees, or annual turnover and balance sheet total each above EUR 10 million (§ 28(2) No. 3); none for trust service providers, TLD registries, DNS service providers and providers of public telecommunications networks and services (§ 28(1) Nos. 2 and 3, (2) Nos. 1 and 2)
Registration	entity under § 33(1) BSIG, each critical installation under § 8 KRITISDachG (§ 33(2) BSIG)	entity under § 33(1) BSIG
Evidence to the BSI	first date set by the BSI, at the earliest after three years, then every three years (§ 39 BSIG)	no duty under § 39 BSIG
Physical resilience duties	§§ 12, 13, 18 and 20 KRITISDachG	none

For a group, type of entity and size decide whether NIS2 duties apply. The installation test decides whether the KRITIS regime applies on top.

The BSI sets the first evidence date

Under § 39(1) BSIG, operators of critical installations must prove to the BSI that their measures are in place. This covers the measures under § 30(1) sentence 1 in conjunction with § 31(1) and (2) sentence 1 BSIG.

The BSI (Federal Office for Information Security) sets the first date in consultation with the BBK (Federal Office of Civil Protection and Disaster Assistance). That date falls at the earliest three years after the operator first qualifies as such. After that, evidence is due every three years.

The Act names three forms of evidence: security audits, examinations or certifications. Certification is therefore one of three ways to meet the evidence obligation, not a separate KRITIS duty. The results, including any security deficiencies found, go to the BSI, which can demand a remediation plan.

§ 39 BSIG itself settles two special cases. Paragraph 3 covers former operators of critical infrastructures: their next date falls at the earliest three years after their last evidence under the former § 8a(3) BSIG. Operators designated by a federal state (Land) under § 5(7) KRITISDachG are exempt from the evidence duty (paragraph 4).

Physical resilience: duties counted from registration

The KRITIS-Dachgesetz (KRITIS Umbrella Act) transposes Directive (EU) 2022/2557 and governs the physical resilience of critical installations. It has been in force since 17 March 2026; § 14(3) to (5) applies from 1 January 2030. Its duties start in stages after registration with the BBK:

Duty	Deadline	Reference
Registration with the BBK	no later than three months after the installation counts as critical	§ 8(1) KRITISDachG
Risk analysis and risk assessment	first due nine months after registration, then at least every four years	§ 8(7), § 12(1)
Resilience measures and resilience plan	first due ten months after registration	§ 8(7), § 13
Incident reporting	first due ten months after registration	§ 8(7), § 18
Management body's duty to implement and monitor	first due ten months after registration	§ 8(7), § 20

Registration runs through one facility. § 33(2) BSIG refers the registration of critical installations to § 8 KRITISDachG. Both § 8(1) KRITISDachG and § 33(1) BSIG name the registration facility the BSI and the BBK set up jointly.

The BBK sets the procedural details within four weeks of the ordinance under § 4(3) and § 5(1) taking effect (§ 8(8)).

Operators report incidents under § 18 KRITISDachG and, in addition, under § 32 BSIG to the joint BSI and BBK reporting office. The BSIG deadlines are explained on the page on NIS2 incident reporting.

§ 4(2) KRITISDachG exempts four groups from the duties under §§ 12 to 16, 18 and 20. Financial entities covered by Regulation (EU) 2022/2554 (DORA) and operators in the information technology and telecommunications sector are fully exempt. For operators in the municipal waste disposal and social insurance sectors, only the risk analysis under § 12 still applies. Registration under § 8 remains mandatory for all four groups.

Browse all entries Back to top

Critical Infrastructure (KRITIS)