KRITIS Umbrella Act Registration: The 17 July 2026 Deadline Was Deleted — the 3-Month Clock Starts With the KritisV

Short answer: Germany’s KRITIS umbrella act (KRITIS-Dachgesetz) has no registration deadline in force today. Article 8 of BGBl. 2026 I Nr. 221, published on 28 July 2026 and in force since 29 July, struck the “17 July 2026” date out of § 8(1). The three-month registration window now opens only when a facility “counts as” critical, and no facility can do that until the Interior Ministry’s Kritisverordnung (KritisV) is in force. As of 13 October 2026, the BBK’s FAQ for KRITIS operators says it plainly: “Zurzeit besteht noch keine Registrierungspflicht”. There is currently no duty to register.

Several English and German guides still tell operators they had to register with the Federal Office of Civil Protection and Disaster Assistance (BBK) by 17 July 2026. Part of the reason is where the change sits: on pages 8 to 10 of an 11-page statute titled “Act to better prevent abusive acknowledgements of paternity”. We compared the gazette PDF line by line with the consolidated text on gesetze-im-internet.de. This spoke of our NIS2 and CER dual compliance guide shows what changed, how the new clock runs, and what still applies to German KRITIS operators while everyone waits.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

What Article 8 of BGBl. 2026 I Nr. 221 changed

In plain terms: the amendment removed every fixed calendar date from the act’s start-up rules and tied them to the KritisV instead. Legal rule, per Article 8 Nos. 4, 5, 6 and 9 of the amending act:

Provision	Before 29 July 2026	Since 29 July 2026
§ 8(1) registration deadline	Three months after a facility counts as critical, “frühestens jedoch bis einschließlich zum 17. Juli 2026”, via the BSI Act’s § 33(1) registration facility	Three months after a facility counts as critical. No calendar date, no § 33(1) reference
§ 8(1) data to submit	Seven items	Eight items. New item 3: “the name or a referenceable designation of the critical facility”
§ 8(5) BBK confirmation	Competent authority named within two weeks; the first notices not required before 17 August 2026	Completion and competent authority confirmed, which “should” happen within four weeks
§ 8(8) registration procedure	BBK sets the details, no deadline	BBK publishes the details within four weeks after the KritisV enters into force
§ 13(5) resilience-plan templates	BBK to publish them by 17 January 2026	No later than eight months after the KritisV enters into force
§ 26 transitional rule	Parts of § 8(1) applied only once the KritisV applied	Deleted
§ 9(3) operators of European significance	Commission notice forwarded to the operator	§§ 12 and 13 duties apply from the day the operator receives the Commission’s notice

The pre-amendment wording is preserved in the buzer.de synopsis of § 8. The templates row shows why fixed dates had to go: the act entered into force on 17 March 2026, two months after the date by which it told the BBK to publish resilience-plan templates. The BBK’s FAQ says those templates are still “zurzeit in Erstellung”, in preparation.

For CISOs, the most practical change sits in Article 8 No. 1, which rewrote the definition of “facility” in § 2 No. 2. Software and IT services that don’t directly control, monitor or support the physical processes of a critical service are now governed “ausschließlich” by the BSI Act. Our reading: an ERP or HR platform stays a BSI Act matter, while a control system that steers the physical process can form part of a critical facility under both laws (Interpretation).

How the new registration clock runs

In plain terms: nothing starts until the KritisV is in force. After that, two clocks run. The first counts from the KritisV date. The second counts from the day you actually register.

Trigger	What happens	Legal basis (KRITIS-Dachgesetz)
KritisV enters into force (T)	Facilities meeting its thresholds count as critical, subject to any reference dates (Stichtage) it sets	§ 5(1) Nos. 2–3
T + 4 weeks	BBK publishes the registration procedure on its website	§ 8(8)
T + 3 months	Registration deadline for facilities that are critical from day T	§ 8(1)
T + 8 months	BBK publishes resilience-plan templates	§ 13(5)
Registration (R)	BBK confirms completion and names your competent authority, normally within four weeks	§ 8(5)
R + 9 months	First operator risk analysis and assessment	§§ 8(7), 12
R + 10 months	Resilience measures and resilience plan, incident reporting within 24 hours, management’s implementation duty	§§ 8(7), 13, 18, 20

A worked example, with an invented date because none has been set: if the KritisV took effect on 1 March 2027, a water utility above the threshold would, on a plain reading, have until 1 June 2027 to register. If it registers on 15 May 2027, its first risk analysis is due by 15 February 2028. Its resilience plan, incident reporting and the board’s § 20 duty then apply from 15 March 2028.

Notice what the example shows. The nine- and ten-month periods in § 8(7) run from the registration date, not from the registration deadline. Plan your runway from the day you file (Interpretation of § 8(7); the BBK’s FAQ describes the periods the same way).

Once the window closes, staying silent is the expensive option. Under § 24 KRITIS-Dachgesetz, failing to submit the registration data, or submitting it late or incompletely, can be fined up to €100,000. The BBK can also demand records to check whether a facility is critical (§ 8(2)), and ignoring an enforceable order of that kind can cost up to €1 million. It can then register the operator itself after a hearing (§ 8(3)). These are maximum amounts. The fining authority decides the actual sum.

Where the 17 July 2026 date came from, and why it was misread

In plain terms: 17 July 2026 is an EU deadline for governments, not a German deadline for companies.

The CER Directive (EU) 2022/2557 required member states to identify their critical entities by 17 July 2026, as the European Commission’s CER overview confirms. Germany wrote that date into § 8(1) as a floor: registration was due three months after a facility counted as critical, “but at the earliest by 17 July 2026 inclusive”. The legislative reasoning, as quoted by IHK Köln, says the date was inserted “at a time when an earlier entry into force of the KRITIS-Dachgesetz could be expected”. Because registration depends on the determination of critical facilities, the three months now run from the regulation.

Under § 2 No. 3, a facility is critical if it is significant (“erheblich”) for providing a critical service. § 5(1) leaves the facility categories, thresholds and reference dates to a ministerial regulation. With the act in force since 17 March 2026 and no regulation, no facility could “count as” critical. The 17 July date had nothing to attach to (Interpretation, consistent with the BBK’s FAQ).

Commentary written before the amendment still circulates. A law-firm briefing republished on JD Supra in April 2026 told readers that “the registration requirement takes effect on July 17, 2026”. That was a fair reading of the text in force at the time, but it has been superseded. Even the IHK Köln page, which explains the deletion, still quotes the old wording in its own checklist. Where 17 July 2026 is used correctly, it is the member-state identification date, as in our guide to NIS2 Article 3(1)(f).

What did not pause: the BSI Act side

In plain terms: if you already operate a KRITIS facility under the current BSI-KritisV, your cybersecurity duties never waited for the KritisV.

Article 9 of the same amending act replaced § 66 BSIG. Until the KritisV is in force, the BSI Act keeps using its pre-17 March 2026 definitions of “critical facility” and “critical service” and the old § 33(2) registration content. Under those definitions, critical facilities are those determined by the regulation under § 56(4) BSIG, which is the BSI-KritisV. Their operators count as particularly important entities (“besonders wichtige Einrichtungen”) under § 28(1) No. 1 BSIG. For electricity generation, that line sits at 104 MW of installed net capacity, as our German energy threshold guide explains.

Question	Cybersecurity track (BSI Act)	Physical resilience track (KRITIS-Dachgesetz)
Who is in scope in October 2026?	Operators above BSI-KritisV thresholds, plus NIS2 entities by sector and size	Nobody yet. Scope depends on the KritisV
Where do they register?	BSI, with the old § 33(2) data: critical service, component types, public IP ranges, facility category and supply figures, location, contact point	BBK, via the joint BSI/BBK registration facility (§ 8(1))
Status today	Duties apply	No registration duty (BBK FAQ)
On the day the KritisV takes effect	New definitions apply; under § 33(2) BSIG, critical facilities then register “gemäß § 8 des KRITIS-Dachgesetzes”	The three-month registration window opens

Two practical consequences follow (Interpretation). First, being registered with the BSI doesn’t register you with the BBK. § 33(2) BSIG simply points to § 8 KRITIS-Dachgesetz, although most facility data you already hold for the BSI can be reused. Second, the KritisV can start two clocks on the same day for a facility it brings into scope for the first time. The operator then has to register the facility with the BBK, and it may also become a particularly important entity that has to register, or update its registration, with the BSI under § 33(1) and (5) BSIG. NIS2 points the same way at EU level: Article 3(1)(f) classes entities identified as critical under the CER Directive as essential entities. The BSI-side duties are covered in our guide to NIS2 in Germany.

Who is waiting for the KritisV

In plain terms: the KritisV decides who is in scope, and the draft suggests the group will get bigger.

• Ten sectors (§ 4(1)): energy, transport, finance, social insurance and basic income support for jobseekers, health, water, food, IT and telecoms, space, and municipal waste disposal.
• Baseline threshold (§ 5(2)): the standard value (“Regelwert”) is 500,000 inhabitants served by a facility. The KritisV sets the actual values per category.
• The draft: the Interior Ministry presented a draft KritisV on 26 May 2026, with comments due by 16 June 2026, according to Vergabeblog. The same report says it largely follows the BSI-KritisV, adds the space sector and would repeal the BSI-KritisV when it takes effect. The DIHK notes that lowered thresholds and new facility categories widen the circle. Neither source gives an adoption date.
• Partial exemptions (§ 4(2)): DORA financial entities and IT/telecoms operators are exempt from §§ 9, 10, 12–16, 18 and 20, among others. Waste and social-insurance operators are exempt from the same list except the § 12 risk analysis. § 8 is not on the exemption list, so on the text these operators still register (Interpretation).
• Municipal operators: § 2 No. 1 covers legally dependent units of local authorities, so a municipal utility run in-house is caught through its facility, whatever its legal form.
• Case-by-case designation (§ 5(3) and (5)): the Interior Ministry can decide that a facility below the thresholds is critical. The BBK then tells the operator and asks it to register.

What to do before the clock starts

In plain terms: the BBK says operators don’t need to act yet, but it also recommends working on resilience now. The tasks below are recommended internal practice, not legal deadlines.

Role	Action now	Effort
Compliance / legal	Monitor the Bundesgesetzblatt and the BBK website. The KritisV date starts the three-month window, and the BBK’s procedure follows within four weeks	Low
Compliance / legal	Pre-fill the eight § 8(1) data items for each candidate facility, including member states served and a contact point that is reachable at all times for BSI Act measures	Medium
CISO / IT	List public IP ranges and critical-component types per facility (items 5 and 8). Separate systems that steer physical processes from pure IT under the new § 2 No. 2	Medium
Operations / site security	Outline the § 12 all-hazards risk analysis, which must be repeated “at least every four years” under § 12(1). Draft the resilience plan against the § 13(3) measures: physical site protection, access control, emergency power, alternative supply chains and personnel security	High
Board / management	Note that the § 20 implementation and oversight duty starts ten months after registration. Budget physical measures for the 2027–2028 cycle	Low

One input you can’t prepare yet is the government’s own risk picture. The BBK says key elements of the national risk analyses go to operators only after successful registration and will not be published generally.

Frequently asked questions

Is there a KRITIS-Dachgesetz registration deadline right now?

No. Since 29 July 2026, § 8(1) sets no calendar date. The three months start when a facility counts as critical under the KritisV, which was still in preparation as of 13 October 2026.

Does the 17 July 2026 date still matter?

Only at EU level. It was the CER Directive’s deadline for member states to identify their critical entities. It no longer appears in the German act.

We registered with the BSI under NIS2. Does that cover the BBK?

No. BSI registration under § 33(1) BSIG covers your entity. Facility registration under § 8 KRITIS-Dachgesetz is a separate filing with the BBK that opens with the KritisV, although you can reuse much of the same data.

What is the fine for registering late?

Up to €100,000 under § 24(1) No. 1 and § 24(2), imposed by the BBK. Ignoring an enforceable BBK order for records under § 8(2) can reach €1 million.

Sources

1. Gesetz zur besseren Verhinderung missbräuchlicher Anerkennungen der Vaterschaft und zur Änderung weiterer Vorschriften, BGBl. 2026 I Nr. 221 of 28 July 2026. Articles 8, 9 and 12. recht.bund.de (linked above).
2. KRITIS-Dachgesetz (KRITISDachG), Article 1 of the Act of 11 March 2026, BGBl. 2026 I Nr. 66, as amended. § 8 on gesetze-im-internet.de; §§ 2, 4, 5, 12, 13 and 24 linked above.
3. KRITISDachG § 8, old and new wording (synopsis). buzer.de (linked above).
4. BSI-Gesetz of 2 December 2025, BGBl. 2025 I Nr. 301, as amended. §§ 28, 33 and 66 (linked above).
5. Verordnung zur Bestimmung Kritischer Infrastrukturen nach dem BSI-Gesetz (BSI-KritisV). gesetze-im-internet.de (linked above).
6. FAQ für KRITIS-Betreiber zum KRITIS-Dachgesetz. Bundesamt für Bevölkerungsschutz und Katastrophenhilfe (BBK), accessed 13 October 2026 (linked above).
7. Critical infrastructure resilience at EU level. European Commission, DG Migration and Home Affairs (linked above).
8. Directive (EU) 2022/2555 (NIS2), Article 3(1)(f) (linked above).
9. KRITIS-Dachgesetz: Was Unternehmen jetzt wissen und tun müssen. IHK Köln (linked above).
10. BMI legt Entwurf der neuen KRITIS-Verordnung vor. Vergabeblog, 28 May 2026 (linked above).
11. Bundesministerium des Innern legt Verordnung zur Identifikation von KRITIS-Betreibern vor. DIHK (linked above).
12. KRITIS Umbrella Act Now in Effect: What Critical Infrastructure Operators Need to Know and Do. JD Supra, April 2026 (linked above, cited as an example of pre-amendment commentary).