A rider inside a paternity bill
On July 28, 2026, the German government published Bundesgesetzblatt No. 221 — the "Gesetz zur besseren Verhinderung missbräuchlicher Anerkennungen der Vaterschaft," a law aimed at stopping sham paternity claims used to secure residency rights. Buried in Article 8 and Article 9 of that same statute, however, are amendments to the KRITIS-Dachgesetz and the BSI-Gesetz — Germany's framework laws for protecting energy grids, water utilities, hospitals, and other critical infrastructure. Nothing in the bill's title, its committee history as an immigration measure, or its public debate signaled that it would rewrite critical-infrastructure law. It did.
What actually changed
The KRITIS-Dachgesetz, in force since March 11, 2026 (BGBl. 2026 I Nr. 66), had set a hard deadline: operators of critical facilities had to register with the BBK and BSI via a joint portal by July 17, 2026 — not coincidentally the same date the EU's Critical Entities Resilience (CER) Directive, 2022/2557, requires member states to have identified their critical entities. Article 8 of the new law rewrites Section 4(1) of the KRITIS-Dachgesetz: registration is no longer due by a fixed calendar date but "at the latest three months after a facility qualifies as critical" — a trigger that depends on the CRITIS-Verordnung, the implementing regulation that defines what counts as a critical facility in the first place. That regulation still does not exist. The July 17 deadline was not extended; it was deleted, with no replacement date on the calendar.
Article 8 also amends Section 13(5): the BBK's obligation to publish templates and sample resilience plans, previously due by January 17, 2026, now falls due "at the latest eight months after" the same unissued regulation takes effect. The BBK's own FAQ page confirms operators currently "need not yet take action" and that resilience-plan templates are "currently being created" with no firm publication date.
The steelman: you can't register for a category that doesn't exist
There is a real administrative-law problem here, and it deserves to be stated plainly rather than waved away. The CRITIS-Verordnung that defines "critical facility" has not been issued. Forcing thousands of operators — hospitals, water utilities, regional energy firms — to register against a fixed July 17 deadline when they had no legally binding way to know whether they even qualified as "critical" would have been arbitrary, inviting legal challenges and wasted compliance spend on facilities later excluded. Tying the registration clock to the regulation's actual entry into force, rather than a date picked before the regulation existed, is defensible policy. Sequencing obligations to the availability of the rules that define them is exactly the kind of proportionate, evidence-based adjustment this publication generally favors over rigid deadlines that outrun the underlying legal architecture.
Why the process still fails the proportionality test
The substance is close to defensible. The method is not. Germany was already roughly seventeen months late transposing the CER Directive — the EU deadline was October 17, 2024, and the KRITIS-Dachgesetz did not enter force until March 11, 2026. Rather than legislate the fix through a dedicated, debated amendment to critical-infrastructure law — which would have let the Bundestag's interior committee, industry associations, and the public weigh in on how long operators of hospitals and power grids should wait for clarity — the government routed it through a bill about immigration fraud, decided in committee rather than in a standalone reading. That denies operators, regulators, and the public the chance to scrutinize a decision that materially affects Germany's exposure under an EU security directive.
The compounding effect is what makes this more than a technicality: an already-delayed transposition now pushes concrete resilience guidance for hospitals, water systems, and energy operators toward mid-to-late 2027 — nearly three years past the CER Directive's original 2024 deadline — with no enforceable milestone forcing the missing regulation to appear on any particular date. A KRITIS-Verordnung with no deadline of its own can slip indefinitely, and each slip now cascades automatically through the three-month registration clock and the eight-month guidance clock Article 8 just created.
The proportionate fix was available
None of this required abandoning the sequencing logic. A transparent amendment could have set an outside deadline for the CRITIS-Verordnung itself — say, a fixed date by which the regulation must issue, with the registration and guidance clocks running from whichever comes first, the regulation's issuance or that backstop date. That would have preserved the legitimate fix (don't force registration against an undefined category) while avoiding indefinite drift. Predictability is not the enemy of proportionate regulation; it is what lets operators actually plan investment in physical security and IT resilience instead of waiting on a portal that may not open until 2027. Germany had the tools to fix a real defect in its own law without hiding the fix inside a bill about someone else's family law problem.