Overview

• The bill requires major operators to register by July 17, 2026, file resilience plans, and report incidents via a joint BBK/BSI online portal.
• The framework targets large facilities serving more than 500,000 people across sectors such as energy, transport, health, water, IT/telecom and space.
• Non‑compliance would carry administrative fines ranging from €50,000 to €500,000, according to the draft text.
• Industry groups and experts, including AG Kritis, argue the proposal leaves gaps for public bodies and sets penalties too low to drive investment.
• The draft now proceeds to Bundestag and Bundesrat review, with the separate NIS2 cybersecurity transposition scheduled for initial Bundestag debate on Thursday after a Berlin power arson attack sharpened political urgency.