German lawmakers have set clear rules for IT security in waste treatment. Discover how new legislation could shape the future of critical infrastructure and regulatory processes.
Key Takeaways
- German lawmakers approved the NIS-2 directive to enhance IT security in waste treatment facilities, reducing double regulation.
- The ITAD welcomed this decision, advocating for less bureaucracy and highlighting the existing high security standards in their facilities.
- 90 per cent of ITAD facilities already comply with critical infrastructure (KRITIS) regulations for municipal waste disposal.
- The NIS-2 implementation law clarifies obligations for different sectors, with waste disposal under BSI and energy generation under BNetzA.
- The amended law will be discussed again on 21 November 2025, with expectations for it to be enacted by year-end.
The German Bundestag approved the Interior Committee’s recommendation on 13 November 2025 for implementing the NIS-2 directive in Germany. The decision prevents potential double regulation of thermal waste treatment facilities by the Federal Office for Information Security (BSI) and the Federal Network Agency (BNetzA), reducing bureaucracy in the waste management sector.
The association of the Waste-to-Energy plant operator in Germany, the Interessengemeinschaft der Thermischen Abfallbehandlungsanlagen in Deutschland (ITAD), welcomed the parliamentary decision. The association’s advocacy efforts at state and federal levels proved successful after highlighting necessary adjustments to avoid unnecessary bureaucracy in a statement issued in early July.
Existing Security Standards Already in Place
Ninety per cent of ITAD facilities already operate as critical infrastructure (KRITIS) facilities, subject to IT security regulations for their essential service of municipal waste disposal. These facilities already meet high IT security requirements.
“The ITAD facilities are already 90 per cent KRITIS facilities and thus subject to critical infrastructure regulation in the area of IT security regarding their critical service, namely the disposal of municipal waste,” said ITAD managing director Bastian Wens. “They therefore already fulfil very high requirements for their IT security.”
Regulatory Framework Clarification
The NIS-2 implementation law divides companies into sectors with different obligations regulated by different authorities. Municipal waste disposal facilities must comply with BSI requirements, while energy generation facilities fall under BNetzA regulation.
The approved recommendation addresses ambiguous wording in Section 28 of the current draft law. The previous formulation stated that obligations towards BNetzA would not apply if energy generation operations were “negligible in relation to the entire business activity of this entity.”
The amendment replaces this interpretation-dependent language by classifying energy generation as a “secondary activity.” This change provides clearer regulatory guidance for facility operators.
Timeline for Implementation
The amended draft law will undergo a second reading in the Bundesrat on 21 November 2025. The NIS-2 implementation law is expected to be enacted before year-end. The deadline for transposing this European directive into German law expired on 17 October 2024.
Leave a Reply