Broadened scope of Critical Infrastructure Regulation will increase FDI screening in Germany

On 1 January 2022, the second amendment to the German Regulation for Critical Infrastructure ("Critical Infrastructure Regulation"/BSI-KritisV) entered into force. It will broaden the definition of Critical Infrastructures, particularly in the IT services and energy sectors. As a result, in case of foreign direct investments by non-EU/EFTA investors more transactions will be subject to an FDI screening in Germany.

Legal framework for Critical Infrastructures

• What qualifies as Critical Infrastructure? The definition of Critical Infrastructure in the pertinent German legislation has two limbs:
  • The infrastructure in question must fall within certain categories of the energy, water, food, IT and telecommunication, health, finance and insurance, or transportation and traffic sectors.
  • The infrastructure in question must reach certain thresholds as to the size and importance of the respective infrastructure.

The Critical Infrastructure Regulation sets out the categories and thresholds in detail.

• What are the consequences? When a given infrastructure qualifies as Critical Infrastructure, there are two main consequences:
  • Operators of Critical Infrastructures face a number of obligations. These obligations inter alia include reporting of any disruptions or significant impairments, implementing "state of the art" security, etc.
  • Investments by non-EU/EFTA investors in companies operating a Critical Infrastructure are subject to German FDI screening. Investments of 10% or more in a business considered Critical Infrastructure are subject to mandatory FDI filing as well as a standstill-obligation.

Broadened Scope of FDI Screening

The Critical Infrastructure Regulation broadens the scope for FDI screening in a number of sectors. This adds to previous amendments to the German FDI rules that have already broadened its scope significantly (see also: Foreign direct investment reviews 2021: Germany). The most relevant changes to the Critical Infrastructure Regulation include:

• Software and IT services: So far, only stationary facilities with their respective hardware (machinery and equipment) constituted Critical Infrastructure. Software companies were subject to an FDI screening only if they specifically developed or produced software for the operation of Critical Infrastructures. Under the revised Critical Infrastructure Regulation, companies that merely use software necessary for the operation of Critical Infrastructures may now also be subject to FDI screening. This will be of particular importance for IT service providers who previously did not fall within the scope of FDI screening since they neither develop nor produce such software on their own.
• Energy sector: The general threshold for power generation plants to be qualified Critical Infrastructure will be lowered significantly from 420 to 104 MW installed net capacity which equals the average of all conventional gas-fired power plants in operation in Germany. The threshold for plants that provide Frequency Containment Reserve (Primärregelleistung) is lowered even more to 36 MW installed net capacity which shall reflect the great importance of smaller plants for the stability of the electricity supply system as a whole. Additionally, the thresholds for power trading facilities or systems will be lowered from 200 TWh/year to 3.7 TWh/year. A new category for natural gas trading is established with a threshold of 5,190 GWh/year. The amendment further introduces a new category for facilities or systems active in the centralized commercial control (i.e., distribution) of mineral oil trade including petroleum and (air) fuel.
• IT and telecommunication sector: Thresholds in the IT and telecommunication sector will also be lowered. The threshold for internet exchange points (IXPs) will be lowered from 300 to 100 connected autonomous systems on an annual average. The threshold for data centers (housing) will be lowered from 5 to 3.5 MW (contractually agreed capacity). The threshold for server farms (hosting) will now already commence at 10,000 physical or 15,000 virtual instead of 25,000 total user instances. Lastly, top-level domain name registries which administer or operate over 250,000 domains now qualify as Critical Infrastructure.
• Health sector: The scope of Critical Infrastructures in the health sector will be extended with a newly introduced category of ‘laboratory information networks’, i.e., networks of laboratories in which one laboratory provides IT services for the other laboratories from the same network.
• Finance and insurance sector: The categories for Critical Infrastructures in the finance and insurance sector now include systems for generating and forwarding orders for trading securities and derivatives to a trading venue as well as trading places as defined by Directive (EU) 2014/65.
• Transportation and traffic sector: Due to EU regulations, several categories for Critical Infrastructures will be added to the transportation and traffic sector, including airport and port operation companies as well as so-called intelligent transportation systems.
• Joint infrastructure: The amendment further clarifies the general concept of a joint infrastructure. Several infrastructure facilities are considered to be one if they are necessary for the provision of the same critical service. This can be assumed, for example, if a disturbance of the availability or integrity of one facility could lead to a disturbance of the other facility. If qualified as joint infrastructure, the volume of all joint facilities is aggregated, making it more likely that thresholds are met. While the new provision serves clarification purposes only and is thus not likely to cause major practical changes, it can be seen as a reminder that joint infrastructures, if not alone, might together meet the thresholds and qualify as Critical Infrastructure.

Conclusion and outlook

The Critical Infrastructure Regulation will broaden the scope of FDI screening in Germany. The number of Critical Infrastructures in Germany is expected to increase by approx. 15 % as a consequence of the broadened scope of the Critical Infrastructure Regulation.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2022 White & Case LLP}