Operators of critical infrastructure are essential for the functioning of society and the economy. At the same time, they are exposed to numerous risks such as natural disasters, sabotage, and technical failures. The CER Directive (Critical Entities Resilience Directive) aims to establish uniform resilience requirements. In Germany, this directive is implemented through the KRITIS umbrella law, which sets binding, cross-sectoral rules for critical infrastructure.
Who is affected by the KRITIS umbrella law?
The law defines which sectors constitute critical infrastructure: energy, transport, finance, health, water, waste, IT and telecommunications, food, and space. Facilities that ensure the supply of essential goods and services for approximately 500.000 inhabitants are generally considered critical; above this threshold, they are subject to the new regulations.
What action is needed now?
Affected companies must, among other things, register and report critical facilities and conduct risk analyses. For the first time, the law establishes uniform requirements for strengthening resilience against external threats. Despite the ongoing legislative process, action is already needed: companies should assess whether they are affected, identify critical facilities, and initiate measures to increase resilience early on. These measures can be improved through regular audits.
Current status
The first reading of the draft law took place on November 6, 2025. It is scheduled to come into force at the beginning of 2026.
Your contact person at Arqum: Florian Götz