The KRITIS umbrella act makes physical protection mandatory. The record is what counts.

Germany’s KRITIS umbrella act, the KRITIS-Dachgesetz, has been in force since March 2026 and makes appropriate physical protection of critical installations a legal duty. The act names control of entry as one of the measures. An operator who issues and takes back keys should be able to show a complete record of it.

The act is in force, not announced. The NIS-2 implementation act has applied since 6 December 2025 with no transition period, and the registration deadline for the first operators in scope closed on 6 March 2026. The physical side has been governed by the KRITIS umbrella act since 17 March 2026. For an individual operator, the obligations begin on registration. That means setting up the protection and being able to evidence it. What decides the outcome is whether the operator can produce the records straight away or has to go looking for them.

Two acts, one platform

NIS-2 covers cybersecurity, the umbrella act covers physical protection. Both run through a shared registration platform operated by the BSI and the BBK. They remain two separate regimes. For an operator who has already completed NIS-2 registration, the umbrella act is the physical half of the same programme.

What section 13 asks for

The substance sits in section 13 KRITISDachG. What is mandatory is the outcome, appropriate physical protection of premises and installations. The act names the methods only as examples, not as a fixed specification. Among them is “access controls”, meaning control of physical entry. It prescribes no particular technology and does not require locking hardware to be replaced. What it requires is a documented, proportionate decision that suits the installation. The act also names security management for employees and external contractors. Who is allowed to open which door, and whether the key came back when they left.

The moment of inspection

When the regulator arrives, the operator has to grant entry to the premises and access to systems and records (section 16). Enforcement runs through the inspection, not through a fine for the plan itself. A clean issuing and return history is available the moment it is asked for.

The clock starts at registration

No registration duty has started yet. An operator registers within three months of an installation counting as a critical installation (section 8). Which installations count is set by an ordinance the ministry has not issued (section 5). Once an installation is registered, the periods run:

• Nine months to the first risk analysis (section 12)
• Ten months to an applied resilience plan (section 13)

Company leadership carries a duty too. It has to implement the measures under section 13 and make sure they are applied through suitable organisational arrangements; where it culpably breaches that duty, it is liable to its own organisation under the rules of company law (section 20). A documented, inspectable access system is exactly that kind of evidence.

What this means in daily operation

This is where portier comes in. portier Vision 5 runs the mechanical key inventory so that the record forms as a by-product: every key movement captured, issue and return with a receipt, who holds which key and which door it opens, signed handovers, recoverable after a failure. Not an extra compliance exercise, the daily work itself. An operator who keeps the inventory clean anyway holds the evidence when the inspection comes.

The umbrella act makes physical protection a duty and makes the record the real task. The act already applies, and the clock starts at registration. The question is how cleanly the evidence forms. An operator who keeps a complete record of keys and entry answers it before the regulator asks.