The new draft KRITIS Regulation (Kritisverordnung, “KritisV”) is intended to replace the current Regulation on the Designation of Critical Infrastructures pursuant to the BSIG (BSI-Kritisverordnung, “BSI-KritisV”). It further specifies the requirements of the March 2026 Umbrella Act for Critical Infrastructure Protection (KRITIS-Dachgesetz, “KRITISDachG”), which imposes binding protection obligations on operators of critical physical facilities (see also: Resilience compliance as a board-level duty: mandatory counter-sabotage and business continuity measures | Gleiss Lutz). The draft has significant practical implications for affected operators because its detailed facility categories and revised thresholds will make it possible to determine more precisely which facilities in the relevant sectors fall within the scope of the KRITISDachG.
Although the draft follows the structure and content of the existing BSI-KritisV, it introduces several changes. For the first time, detailed provisions on services covered, relevant facility categories and applicable thresholds establish a workable regulatory framework for the “space” sector, designated as a separate sector under section 4, no. 9 KRITISDachG. In addition, sectors such as energy are defined in more detail, with control, coordination, management and logistics functions now included.
Another key aspect is the draft’s interaction with the Act on the Federal Office for Information Security (Gesetz über das Bundesamt für Sicherheit in der Informationstechnik, “BSIG”). Under the draft, once the KritisV enters into force, the KRITISDachG and the KritisV will provide the sole basis for identifying operators of critical facilities, including for the purposes of cybersecurity obligations under the BSIG. The KritisV is therefore intended to serve as a single legal regulation covering both physical resilience under the KRITISDachG and cybersecurity under the BSIG.
Basic structure of BSI-KritisV retained
The structure of the draft KritisV essentially follows that of the current BSI-KritisV. The identification of critical facilities follows a three-stage process, with the KritisV text setting out the critical services in each sector. The annexes to the draft KritisV specify the categories of facilities required to provide these services and define the applicable thresholds. As a general benchmark, the draft retains the standard threshold of 500,000 people served, which already underpins the current BSI-KritisV and forms the basis for calculating the sector-specific thresholds. A facility is to be classified as critical from 1 April of the calendar year following the year in which the applicable threshold is first met or exceeded (see, for example, Annex 1, Part 1, no. 3 draft KritisV).
New rules for the space sector
Section 11 of the draft KritisV is a key development, establishing a workable regulatory framework for the space sector for the first time through detailed provisions on services covered, relevant facility categories and applicable thresholds. Critical services for the space sector include the provision to the general public of positioning, navigation and timing (PNT) services, Earth observation services, transport capacity and geodetic data. For PNT services, Earth observation services and transport capacity provided to the general public, the draft KritisV designates antenna systems and ground stations as critical facilities. It also classifies infrastructure used for the launch or landing of launch vehicles for space systems, as well as ground stations providing geodetic data to the general public, as potentially critical facilities (see Annex 10, Part 1, no. 1 draft KritisV).
While the classification of critical facilities in other sectors is generally based on supply, production, transaction or capacity metrics, the relevant criterion for PNT and Earth observation services is the number of missions connected to the respective ground infrastructure. For transport capacity, the threshold is based on the number of launch and/or landing operations involving launch vehicles per year. For ground stations providing geodetic data to the general public, the threshold is determined by the geodetic observation and evaluation methods used. Classification as a critical facility therefore depends less on traditional supply levels than on the functional importance of the relevant space infrastructure. Notably, the threshold for all categories of facilities covered is “1”, meaning that a single connected mission, a single launch or landing operation per year, or a single geodetic observation and evaluation method is sufficient (see Annex 10, Part 2 draft KritisV).
Refinement of categories, terminology and threshold criteria
For the remaining sectors already covered by the BSI-KritisV, the draft KritisV builds on the existing framework, while introducing a much more granular classification of facilities in certain areas.
While the current BSI-KritisV focuses primarily on traditional physical infrastructure and individual process stages, the draft increasingly recognises digital, organisational and operational control and support functions as separate categories of facilities. This reflects the Federal Ministry of the Interior’s recognition of the growing importance of these functions in maintaining critical services.
This trend is particularly evident in the energy sector. Alongside traditional generation, transmission and distribution facilities, the draft KritisV newly or expressly covers infrastructure connecting generation facilities, control and aggregation facilities, energy storage facilities and power-to-gas installations. District cooling is also included as a separate element of the KritisV framework for the first time (see Annex 1, Part 1, no. 2 draft KritisV). This extension may particularly affect operators of infrastructure whose functionality depends heavily on uninterrupted cooling, such as data centres, hospitals and industrial facilities.
The transport sector is also undergoing extensive structural changes: In aviation, separate categories for passenger and cargo handling at airports have been abolished, leaving only airport infrastructure operation as the relevant category in this regard. Computer reservation services and global distribution systems, by contrast, have been added. In the rail sector, service facilities for long-distance travel are to be included within the scope of application for the first time. For maritime and inland waterway transport, the thresholds applicable to federal waterways have been revised. In future, the applicable threshold will be determined by inland waterway classification rather than freight traffic density. Federal motorways have also been included as a separate category for the first time (see Annex 7, Part 1, no. 1 draft KritisV).
The draft expands the scope of critical services in selected sectors. In healthcare, critical services are now to include research and development relating to potentially supply-relevant active ingredients and the medicinal products derived from them. The draft also identifies relevant facility types, including investigational medicinal product development and manufacturing facilities, EU reference laboratories, and systems for managing blood and plasma donations (see Annex 5, Part 1 draft KritisV). Critical services in the financial sector have been expanded to include deposit-taking and lending.
The existing framework remains largely unchanged in other sectors, however. The draft does not propose any amendments to the critical services, facility categories or thresholds of the current BSI-KritisV for the water, food, ICT, social insurance and basic income support or waste management sectors (see pp. 74, 82 draft KritisV). The threshold methodology is also broadly preserved.
Self-assessment and transitional rules
Under the draft KritisV, operators must determine their facility’s supply level annually by 31 March. If the threshold is exceeded, the facility will generally be classified as critical, from 1 April of the following year. In addition, several facilities of the same type may be treated as a single facility if they are located in close proximity and their operations are closely linked.
Transitional rules are to apply across all sectors to facilities that have already met or exceeded the respective thresholds for the 2025 calendar year. Under the draft, these facilities will be classified as critical facilities as soon as the regulation enters into force. This is to ensure that facilities that are already considered critical can be brought within the scope of the KritisV without delay.
Conclusion and outlook
The draft KritisV broadly retains the BSI-KritisV’s current methodology, while developing it further in several key respects. Importantly, it now regulates the space sector, introducing case-specific rules on critical services, facility categories and thresholds. For sectors already covered by the BSI-KritisV, the draft expands certain critical services and introduces a more granular classification of numerous facility categories. This is particularly evident in the energy sector, where the draft places a greater emphasis on control, coordination and digital support functions, which the regulatory framework has increasingly recognised as crucial to the maintenance of critical services.
For facility operators, these changes mean that assessments of whether they fall within scope of the KritisV must extend beyond traditional physical infrastructure. Companies should instead assess at an early stage whether new facility categories, revised thresholds or an expanded sectoral scope could bring their activities within the scope of the KRITIS regime for the first time. The proposed transitional rules highlight the Federal Ministry of the Interior’s goal of incorporating existing critical facilities into the new regulatory framework directly and without delay.
During the legislative process for the KRITISDachG, the Bundesrat had already criticised the continued use of the standard threshold of 500,000 people served. It warned that this could leave numerous facilities relevant to security of supply outside the scope of the legislation. The new draft largely retains this standard threshold while modifying its application in certain cases. In the newly regulated space sector, for instance, the draft KritisV departs from the traditional supply-based approach and instead applies functional criteria such as the number of connected missions or launch and landing operations, with noticeably low thresholds. Overall, however, it remains to be seen whether and to what extent the threshold and the methodology for identifying critical facilities will be revised or made more flexible, as the legislative procedure progresses.
Forward
