The Federal Council has approved the Kritis roof law, which aims to better protect critical infrastructure. On Friday, the council declined to summon the mediation committee and, in a resolution, only urged the federal government to refine the law in the future.
The legislation requires companies in ten strategically important sectors-energy, food, water, health, transport, and others-to strengthen the physical protection of their facilities. It defines which infrastructure assets are essential for providing for the population and sustaining the economy. The Federal Ministry of the Interior will issue a regulation that sets out the specific criteria. In general, an asset is considered critical if it serves more than 500,000 people. States retain an opening clause: they may classify assets overseen by a state authority as critical based on their own criteria.
Private operators of critical services will be required to produce risk analyses. These analyses serve as the basis for regular risk assessments and for creating resilience plans by the operators. All conceivable risks-including natural disasters, sabotage, terrorist attacks, and human error-must be taken into account, and operators must report incidents.
The law establishes minimum requirements for all sectors, including measures for emergencies, fault tolerance, and enhanced physical protection. It does not prescribe specific rules for operators; instead, it obliges them to take appropriate and proportionate measures, which may differ from sector to sector and from company to company. For example, strategies for flood‑prone areas will differ from those in other locales, and a hospital will need different protection measures than the power grid.
In November, the Federal Council had criticized the draft in a detailed commentary. It argued that the proposed increase in resilience was far below the expectations of the states and risked failing to be achieved at the national level. The states also called for lowering the threshold of 500,000 served residents to 150,000 people. The council noted that regulations to address detail questions could be issued without its consent, which would impose significant effort and costs on the states.
