On January 29, 2026, the German Bundestag enacted a comprehensive law to protect critical infrastructure better, prompted by recent attacks including sabotage on Berlin's power grid. The law mandates that operators of key sectors such as energy, water, telecommunications, and transport must register facilities, conduct regular risk analyses, and implement resilience plans including physical security and supply chain protections. It sets a 500,000-population threshold for defining critical infrastructure but allows federal states to lower this bar. The legislation supplements existing cybersecurity frameworks by focusing on non-digital protective measures like fences, alarms, and backup power supplies. The law also restricts publicly available information on sensitive sites to prevent attackers from gathering intelligence. The legislation implements the EU's CER Directive, responding to increased hybrid and physical threats associated with Russia and China. Criticism from municipalities and political parties highlights concerns about threshold levels, bureaucratic complexity, and insufficient unification of security standards across ministries. The law imposes fines for violations and requires incident reporting to the Federal Office for Civil Protection and Disaster Assistance (BBK).

On January 29, 2026, the German Bundestag enacted a comprehensive law to protect critical infrastructure better, prompted by recent attacks including sabotage on Berlin's power grid. The law mandates that operators of key sectors such as energy, water, telecommunications, and transport must register facilities, conduct regular risk analyses, and implement resilience plans including physical security and supply chain protections. It sets a 500,000-population threshold for defining critical infrastructure but allows federal states to lower this bar. The legislation supplements existing cybersecurity frameworks by focusing on non-digital protective measures like fences, alarms, and backup power supplies. The law also restricts publicly available information on sensitive sites to prevent attackers from gathering intelligence. The legislation implements the EU's CER Directive, responding to increased hybrid and physical threats associated with Russia and China. Criticism from municipalities and political parties highlights concerns about threshold levels, bureaucratic complexity, and insufficient unification of security standards across ministries. The law imposes fines for violations and requires incident reporting to the Federal Office for Civil Protection and Disaster Assistance (BBK).