KRITIS-DachG — in force 17 March 2026; July 17 registration deadline approaching; threshold ordinance still pending

Germany's Critical Installations Resilience Act (KRITIS-DachG, implementing EU CER Directive 2022/2557) entered into force 17 March 2026. Registration deadline: 17 July 2026 (60 days). Significant open question: the Schwellenwertverordnung (threshold ordinance defining exactly which facilities meet the "critical facility" threshold) has not yet been published by the German BMI. Swiss cross-border critical-infrastructure operators (energy, transport, water in border regions with German operations) should track the BMI threshold ordinance publication — once the ordinance is published, qualification timelines will accelerate.

Registration requires: entity name, legal form, 24/7 contact point, facility details, critical service, sector category, supply/service metrics, geolocation. Post-registration: 9-month deadline for risk assessment, 10-month deadline for implementing resilience measures, written resilience plan mandatory. Incident reporting: 24 hours from awareness to the joint BSI-BBK reporting portal.