What changed
Germany has enacted an overarching framework law (Dachgesetz) strengthening the physical resilience of critical infrastructure, implementing the EU CER Directive. It establishes risk assessment obligations for critical infrastructure operators, resilience plans, incident reporting requirements, and a supervisory framework coordinated by the Federal Office for Civil Protection (BBK), covering sectors including energy, water, transport, healthcare, and digital infrastructure.
Who is affected
Operators of critical infrastructure — power grids, water utilities, hospitals, airports, ports, financial market infrastructures, and large digital service providers — face new compliance obligations including mandatory risk assessments, resilience plans, and incident reporting. Authorities gain new supervisory and enforcement powers.
What to look out for
→ Ordinary residents are not directly affected. Businesses operating infrastructure in the designated critical sectors should assess whether they meet the thresholds and engage compliance advisors.
⚠️ This explanation was created with AI assistance and may be inaccurate or incomplete. It is not legal advice. Before taking action, check the official text and consult a qualified lawyer.
Original law: KRITISDACHG — Check the official text before relying on this explanation.