Overview

• Operators in designated sectors must register by July 17, 2026, prepare resilience plans, ensure physical site protection and report disruptions via a joint BBK/BSI online portal.
• The framework targets large facilities serving more than 500,000 people across sectors such as energy, transport, health, finance, IT/telecoms, water, food, waste, social security and space.
• Non‑compliance would carry fines of €50,000 to €500,000, which expert groups and industry associations criticize as too low to drive investment.
• Stakeholders warn of gaps and overlaps, citing exclusions for much of federal and all state administration and potential double regulation with Germany’s NIS2 implementation.
• Ministers point to the recent arson on Berlin high‑voltage masts that caused hours‑long outages as evidence of urgency, while critics argue key obligations may land late and call timelines inadequate.