Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

Germany's first cross-sector federal statute establishing minimum requirements for the physical protection and resilience of critical infrastructure operators (KRITIS) — sectors covered include energy, transport, water, food, ICT, financial services, health, and federal government infrastructure. Transposes EU Directive 2022/2557 (CER Directive on the resilience of critical entities). Identifies operators of critical facilities with Europe-wide significance, mandates national risk analyses for critical services, requires operator risk-management measures and creates a federal incident-reporting regime. Passed by the Bundestag on 29 January 2026, confirmed by the Bundesrat on 6 March 2026, published in BGBl. 2026 I Nr. 66 on 16 March 2026, in force from 17 March 2026.

Germany's transposition of EU Directive 2022/2555 (NIS2), enacted as the "Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung." Bundestag passage 13 November 2025; Bundesrat approval 21 November 2025; published as BGBl. I 2025 Nr. 301 on 5 December 2025; entered into force 6 December 2025. The statute designates the Bundesamt für Sicherheit in der Informationstechnik (BSI) as the central national supervisory authority over an estimated 29,500 covered entities across 18 critical and important sectors, introduces a mandatory 24h initial / 72h detailed / 1-month final cyber-incident reporting cascade, establishes board-level personal liability for senior management, and applies to SME critical- infrastructure suppliers — with no transitional grace period from entry into force.

Germany's Lieferkettensorgfaltspflichtengesetz (LkSG), promulgated 16 July 2021 (BGBl. I 2021 S. 2959), requires German-headquartered companies to conduct mandatory human-rights and environmental due diligence across their own operations and direct suppliers (with cause-based obligations extending to indirect suppliers). Enforced by BAFA with administrative fines up to EUR 8 million or 2% of global annual turnover for firms with revenue ≥ EUR 400 million. The act applies to ~3,000 German corporates from 1 January 2023 (≥3,000 employees) and was extended to ~5,000 firms from 1 January 2024 (≥1,000 employees). A September 2025 cabinet amendment removed the annual-reporting obligation and narrowed sanctionable omissions to serious violations.

Germany's Außenwirtschaftsgesetz (AWG, Foreign Trade and Payments Act; BGBl. I 2013 S. 1482 of 6 June 2013, replacing the original 1961 Act) is the foundational parent statute of the modern German economic-statecraft toolkit, providing the legislative authority for (i) export licensing of dual-use goods and technology administered by BAFA under the Außenwirtschaftsverordnung (AWV) implementing regulation — the national complement to EU Dual-Use Recast Regulation 2021/821; (ii) inward FDI screening by BMWK under §§ 55–62 AWG covering non-EU/non-EFTA acquisitions of ≥ 25% of voting rights cross-sectorally and ≥ 10%/20% in 27 sensitive-sector activities including defence, semiconductors, AI, quantum, biotech, space, and critical infrastructure; and (iii) German implementation of EU-level and autonomous trade and sanctions restrictions. As the EU's largest economy and a top-tier dual-use exporter, Germany's AWG-based regime is structurally peer-foundational to JP FEFTA 1949, UK NSI Act 2021, US ECRA 2018, CN Export Control Law 2020, and NL Wet Vifo 2022 in the G7+CN economic- statecraft parent-statute cluster.