High-risk AI depends on KRITIS status, and the ordinance is still missing

The second condition sits with the operator

Whether AI in grid operations is high-risk turns, under the Commission's draft guidelines, on two conditions: what the system does, and who runs it. You can check the first one in-house. Not the second.

It's a short path. Annex III point 2 of the AI Act covers AI "intended to be used as safety components in the management and operation of" water, gas, heating or electricity supply. For "critical infrastructure", Article 3(62) points to the CER Directive (EU) 2022/2557. Paragraph 190 of the draft of 19 May 2026 reads that reference to mean a system is high-risk "only if used by an entity identified as a critical entity by a Member State under the CER Directive".

Paragraph 200 repeats this for gas, 202 for heating, 204 for electricity. On the electricity side the list is long: suppliers, distribution and transmission system operators, producers, nominated electricity market operators, and market participants offering demand response, aggregation or storage.

A narrow reading, then. It relieves everyone who hasn't been identified and turns KRITIS status into the switch.

Which systems meet the first condition, the safety-component test, we went through with the draft's nine examples in which AI at a utility is really high-risk under Annex III. This piece deals only with the second. The draft is not final; the Commission has announced the final version for the end of 2026, and paragraph 6 concedes that only the Court of Justice of the European Union can interpret the AI Act authoritatively. Related questions on AI at utilities are collected in our topic area AI in the energy industry.

Who counts as critical in Germany

Germany doesn't identify critical entities by individual decision. It uses thresholds per facility. The KRITIS umbrella act (KRITIS-Dachgesetz) speaks of operators of critical facilities, and a facility is critical once its level of supply reaches the threshold in the KRITIS ordinance.

That second sentence matters for AI. A control system that switches pumps, breakers or networks can itself be part of the critical facility. Section 5(2) sets the reference value: as a rule, 500,000 inhabitants to be supplied by one facility. From it, the draft KRITIS ordinance of 26 May 2026 derives a threshold for each category.

In the energy sector, only the 3,700 GWh come without the arithmetic. Part 2 point 10 of the draft still holds a placeholder there, and the BSI-KritisV in force states the value without a derivation either. Spread over 500,000 inhabitants it works out at 7,400 kWh per head and year, a little over four times the 1,815 kWh the draft assumes for generation plants. For a mid-sized municipal utility, 3,700 GWh is far off. For the grid company of a large city, or a regional supplier with district heating, it isn't.

Heat suppliers face two particularities. Central cross-site control of district heating is a category of its own, which is exactly where AI for network control would run. And the Bundesnetzagentur isn't in charge: under Section 3(2) no. 2 it covers electricity, natural gas and hydrogen only. For district heating the federal states designate the authority, no later than three months after the ordinance enters into force (Section 3(6)). How district heating itself is using AI is covered in our piece on AI network optimisation in district heating.

There are two release valves. Under Section 5(3) the Federal Ministry of the Interior can declare a facility critical in an individual case even below the threshold, or the reverse. Under Section 5(7) the states may get criteria of their own. Sitting just under 3,700 GWh is no guarantee of being out.

One more reason for care: according to the draft's explanatory memorandum, the same ordinance also decides who is an operator of critical facilities under the BSI Act. One threshold then governs physical protection, IT security and, if you follow the Commission, AI obligations too. How NIS2 and the umbrella act fit together otherwise is set out in NIS2 and the KRITIS umbrella act 2026.

The chain of deadlines, and where it breaks

KRITIS status comes out of a chain: ordinance, cut-off date, registration, follow-on duties. The first link is missing. Under the umbrella act no facility has been designated critical so far. The old BSI KRITIS ordinance still applies, but only to IT security under the BSI Act, and the Commission's draft doesn't refer to it.

The CER Directive gave Member States until 17 July 2026 to identify their critical entities (Article 6(1)). That date has passed. In its FAQ, retrieved on 17 October 2026, the Federal Office of Civil Protection and Disaster Assistance (BBK) says there is "currently no registration duty on the basis of the KRITISDachG" because the ordinance is "still being drafted and coordinated" (our translation).

What happens once it's in force, the draft spells out precisely. A facility that reached its threshold in calendar year 2025 counts as critical from the day of entry into force. After that an annual cycle runs: operators determine the previous year's level of supply by 31 March, and a facility becomes critical from 1 April of the year after it first crosses the line. Registration follows no later than three months after a facility counts as critical (Section 8(1)). The risk assessment is due nine months after registration, resilience measures and incident reporting ten months after it (Section 8(7)).

A worked example shows how tight this gets. Suppose the ordinance applies from 1 March 2027: registration closes on 1 June 2027 and the resilience duties start around April 2028. If it only arrives on 1 October 2027, registration is due on 1 January 2028, and 2 December 2027 falls right inside the registration window.

Is an operator critical on that day or not yet? The act ties status to the threshold, not to registration. Whether the Commission reads the word "identified" the same way, its draft doesn't say.

If the classification is open on 2 December 2027

Four situations are conceivable on the cut-off date. Only the first is clear-cut. What follows is a reading for roles, not an assessment of any individual company.

Scenario 1: ordinance in force, facility above the threshold

AI running there as a safety component is high-risk from 2 December 2027. Most obligations fall on the provider under Article 16; the grid operator, as deployer, carries Article 26: use according to the instructions, human oversight, monitoring, keeping the logs. The full catalogue is in our piece on high-risk AI in energy infrastructure.

Scenario 2: ordinance not yet in force

On paragraph 190, no German energy company has then been identified under the CER Directive, and Annex III point 2 doesn't apply. Sounds comfortable. But it rests on a draft that binds no one and on a reading that neither a market surveillance authority nor a court has to share. We wouldn't build a procurement on it.

Scenario 3: status arrives later

The ordinance comes into force in 2028, a facility crosses the threshold, or the Interior Ministry makes an individual determination. For systems placed on the market or put into service before the application date, Article 111(2) as amended by Regulation (EU) 2026/1744 applies: the AI Act covers them only if their design is significantly changed afterwards. Recital 39 ties this to the first placing on the market of the type and model, not to the individual installation.

One case stays open. A system goes live after 2 December 2027, and the operator only becomes critical later. Does the running AI turn high-risk after the fact? Neither the regulation nor the draft answers that.

Scenario 4: facility below the threshold

No high-risk via point 2. Annex I remains possible if the AI is part of a regulated product such as a machine. And regardless of status, the BSI Act for important and essential entities still applies, as do the IT security catalogue under Section 5c EnWG, AI literacy under Article 4 and the transparency duties of Article 50 AI Act.

Vendors build without knowing the status

A provider has to decide before placing a system on the market whether it's high-risk. It doesn't know its customers' KRITIS status. So the Commission moves the question into procurement.

Two pieces from summer 2026 sharpen this. The Digital Omnibus rewrote the definition of a safety component in Article 3(14): a component performs a safety function when its intended purpose is to prevent or reduce risks to the health and safety of persons or property. Recital 7 makes clear the provider sets that intended purpose. And Section 20(2) of the KI-MIG, Germany's AI market surveillance act, requires providers to enter Annex III point 2 systems in a non-public register before placing them on the market. The register sits with the Bundesnetzagentur as AI supervisor. Deployers register there only if they are federal public bodies.

Paragraph 191 of the draft describes the way out. The status needn't be disclosed to the provider. Providers may build systems to the high-risk requirements "irrespective of the status of the prospective deployer", and a critical entity can demand those requirements in "procurement procedures, contractual documentation or technical specifications" without saying why. Paragraph 192 points to the confidentiality that already shapes procurement by critical infrastructure operators.

The Commission even writes that entities may want such systems "for a variety of operational, cybersecurity, corporate governance or liability related reasons, irrespective of whether they have formally been identified as critical entities". For buying, then, the question whether a utility is critical matters less than it does for the obligations. Anyone tendering an AI camera for the fence, of the kind described in our piece on drone defence at energy facilities, can request the high-risk requirements as an option and see the price gap.

Counterpoint: 500,000 as the threshold

The threshold the Federal Ministry of the Interior and the Working Group on Critical Infrastructures (AG KRITIS) are arguing over also decides, under the Commission's draft, on AI obligations. Lower it and the circle of operators with potential high-risk AI grows. Keep it and the circle stays small.

In its draft of 26 May 2026 the ministry grounds the reference value in emergency planning: "Since specific protection targets have so far been set only selectively in emergency planning, a threshold has to be based on empirical values." An "exemplary analysis" of emergency capacities shows a limit "in a corridor around 500,000 affected persons" (our translations). One piece of evidence is the Münsterland blackout of 2005, which at its peak hit 250,000 people.

AG KRITIS pushed back on 14 June 2026. Carrying the reference value forward unchanged is, in its words, "by far the most serious design flaw of the KRITIS ordinance". The reasoning rests "on estimates, individual cases and anecdotal evidence". The group's example is the January 2026 attack on the power supply in south-west Berlin: an identical facility a few kilometres away in Potsdam wouldn't be critical. "Same facility, same design, same vulnerability, same attack," the group writes, "but no status as a critical facility, no obligations, no supervision."

It wants the value studied scientifically and "significantly lowered" until then. The ministry has scheduled a first evaluation two years after the act took effect, in March 2028.

What the law provides for non-compliance

For registration, Section 24 of the KRITIS umbrella act provides for a fine: failing to register, or registering incorrectly or late, is an administrative offence punishable by up to EUR 100,000, or up to EUR 1 million for defying an order of the BBK. The resilience duties themselves carry no fine; for electricity, gas and hydrogen the Bundesnetzagentur can order remedies under Section 5f(6) EnWG. Breaches of the obligations of providers and deployers of high-risk AI can be fined under Article 99(4) of the AI Act at up to EUR 15 million or 3 percent of worldwide annual turnover, with the lower amount for SMEs. This describes the legal framework, not the position of any particular company.

What grid and heat operators should settle now

Waiting for the ordinance costs little on classification and a lot on procurement. A control system or perimeter installation tendered today will be running on 2 December 2027.

Until the KRITIS ordinance is issued

1. Calculate the 2025 level of supply per facility

   Not per company, but per network, plant and control system, against the draft thresholds. File the result with date and method, because under the draft 2025 decides the status on day one.

2. Add one column to the AI inventory

   Does the system run in or at a facility that would be critical under the draft? That column belongs next to the safety-component classification. How we set up such a register with utilities is described in our offer on AI governance for utilities.

3. Record go-live date and model version

   Article 111(2) turns the date into a legal question.

4. Tender the high-risk requirements as an option

   Paragraph 191 allows it without disclosing status. Ask for both variants and you know the price of caution before committing. Control-centre AI and perimeter protection come first, because the draft names exactly these as high-risk examples.

5. Heat: watch for the responsible state authority

   It will only be designated after the ordinance. Until then, the district heating control centre is the facility most likely to sit above the threshold.

6. Decide in management who determines the status

   And when the decision is revisited: every year by 31 March, once the previous year's level of supply is known.

The related dates are in the energy transition deadline calendar.

This article sets out drafts and legislation for typical roles at grid operators and heat suppliers. It is not legal advice and not an assessment of your individual case. Whether your company operates critical facilities, and whether a system you run is high-risk, is a question for your legal department or counsel. As of 17 October 2026.

Further reading

Frequently asked questions