Germany’s Cities Demand Changes to Critical Infrastructure Security Law (Kritis)

Berlin – Germany’s efforts to bolster the security of its critical infrastructure are facing scrutiny as the proposed “Kritis umbrella law” moves toward a crucial vote in the Bundesrat, the upper house of parliament. The legislation, designed to safeguard essential services against both physical and cyber threats, is encountering resistance, particularly regarding the threshold for classifying facilities as critical. The debate highlights the complex balance between national security concerns and the practical implications for municipalities across the country.

The core of the debate centers on the criteria used to determine which facilities fall under the umbrella of the law. Currently, the proposed legislation sets a population threshold of 500,000 inhabitants for classifying infrastructure like power plants and waterworks as “critical.” However, the German Association of Cities is arguing that this threshold is too high, potentially leaving smaller, yet vital, facilities vulnerable. This pushback underscores a growing awareness of the evolving threat landscape and the need for a more nuanced approach to protecting essential services.

Concerns Over Threshold and Implementation

Burkhard Jung, President of the German Association of Cities and Mayor of Leipzig, voiced these concerns emphatically, stating that facilities serving smaller populations can still be prime targets for attacks. “We appeal to the Federal Council to call the mediation committee for the Kritis umbrella law in order to reduce the planned threshold of 500,000 inhabitants to at least 150,000,” Jung told the Rheinische Post on Thursday, March 5, 2026. He pointed to recent incidents, including arson attacks on power supply and railway lines, as well as cyberattacks on data centers, as evidence of the urgent need for robust preventative measures. These attacks, he argues, demonstrate that even smaller facilities can have a significant impact if disrupted.

The proposed law aims to implement the EU’s CER Directive (EU 2022/2557) and the NIS-2 Directive (EU 2022/2555), both of which seek to strengthen the resilience of critical infrastructure across the European Union. As Jones Day reported in October 2025, these directives necessitate a comprehensive approach to security, encompassing both cybersecurity and physical protection against threats like sabotage and extreme weather events. The Kritis umbrella law is intended to provide a unified framework for addressing these challenges.

However, critics fear that the high population threshold could create a “patchwork quilt” of protection, leaving some vulnerable areas inadequately safeguarded. The German Association of Cities argues that a lower threshold would ensure more consistent and comprehensive protection across the country. The concern is that a fragmented approach could allow attackers to exploit weaknesses in less-protected areas, potentially causing widespread disruption.

The Broader Context of Critical Infrastructure Protection

The debate over the Kritis umbrella law is occurring against a backdrop of heightened geopolitical tensions and an increasing awareness of the vulnerability of critical infrastructure. Germany, like many European nations, has been grappling with the implications of the war in Ukraine and the potential for hybrid warfare tactics, including sabotage and cyberattacks. This has led to a renewed focus on strengthening national security and protecting essential services.

The Kritis Act, as it was previously known, has been under development for some time. According to Heise Online, the initial drafts of the law were criticized for being overly bureaucratic and lacking a clear focus on resilience. The current iteration of the law, the “Kritis umbrella law,” aims to address these concerns by introducing cross-sector regulations for physical protection and integrating cybersecurity measures more holistically. The law mandates that critical operators implement appropriate resilience measures and report significant security incidents.

The Federal Cabinet passed the bill in September 2025, as reported by the German Federal Ministry of the Interior and Community, establishing comprehensive minimum requirements and risk analysis mechanisms. However, the law still requires the approval of the Bundesrat, which is scheduled to discuss it on Friday, March 6, 2026. The responsible committees have already recommended rejecting the law in its current form, signaling a potential impasse.

What is Critical Infrastructure?

Critical infrastructure encompasses the essential services that underpin a functioning society. This includes, but is not limited to, energy production and distribution, telecommunications, transportation, healthcare, and financial systems. Disruptions to these services can have cascading effects, impacting public safety, economic stability, and national security. Protecting critical infrastructure is therefore a paramount concern for governments worldwide.

The Kritis umbrella law specifically targets operators of critical infrastructure, obligating them to conduct risk assessments, implement security measures, and report incidents. These measures are designed to enhance the resilience of these facilities and minimize the potential impact of disruptions. The law likewise emphasizes the importance of national risk analyses to identify and address potential vulnerabilities.

The Bundesrat Vote and Potential Outcomes

The upcoming vote in the Bundesrat is a critical juncture for the Kritis umbrella law. If the Bundesrat rejects the law, it will likely be sent to a mediation committee, where representatives from both the federal government and the states will attempt to reach a compromise. The German Association of Cities is actively lobbying for the mediation committee to be convened and for the population threshold to be lowered to at least 150,000 inhabitants.

A successful compromise will require addressing the concerns of both the federal government and the states. The federal government is likely to prioritize a streamlined and efficient regulatory framework, whereas the states are likely to emphasize the need for localized protection and flexibility. Finding a balance between these competing priorities will be crucial to ensuring the effective implementation of the law.

The outcome of the Bundesrat vote will have significant implications for the security of critical infrastructure in Germany. A strong and comprehensive law is essential to protecting essential services and mitigating the risks posed by both physical and cyber threats. The debate over the Kritis umbrella law underscores the importance of ongoing dialogue and collaboration between all stakeholders to ensure a resilient and secure future.

As the Bundesrat prepares to deliberate, the focus remains on finding a solution that effectively balances national security imperatives with the practical realities of protecting critical infrastructure across Germany’s diverse municipalities. The coming weeks will be pivotal in determining the future of this vital legislation and its impact on the nation’s resilience.

What are your thoughts on the Kritis umbrella law and the debate surrounding it? Share your comments below and let us know what you think. Don’t forget to share this article with your network to keep the conversation going.