KRITIS and NIS2 in Germany: Why This Also Matters to ANPR Camera Suppliers
In short: Germany's cybersecurity framework for critical infrastructure has been redefined. Suppliers to operators in the transport sector (car parks, tolling systems, airports, public transit) will increasingly be asked how secure their hardware and software really are. Here's what changed, and what it means for procuring automatic number plate recognition (ANPR or LPR) systems.
Two New Laws, One Shared Standard
Germany has adopted two central pieces of legislation that redefine the security bar for critical infrastructure:
- The NIS2 Implementation Act (NIS2UmsuCG), published in the Federal Law Gazette (BGBl. 2025 I No. 301) on 5 December 2025 and in force since 6 December 2025. It transposes the EU's NIS2 Directive into German law and substantially overhauls the BSI Act, with no transition period.
- The KRITIS-Dachgesetz, in force since 17 March 2026, which governs the physical resilience of critical facilities (transposing the EU's CER Directive).
Together, the two laws cover an estimated 29,500 companies in Germany across 18 sectors. One key point to understand the framework: KRITIS operators are a subset of "important entities," which are themselves a subset of all NIS2 entities. Being classified as a KRITIS operator automatically triggers the stricter NIS2 obligations, plus the KRITIS-Dachgesetz.
Does This Also Affect Hardware Manufacturers Like Survision?
The clear answer: not directly, but very much indirectly, and that's the point that matters.
KRITIS and NIS2UmsuCG target operators of critical infrastructure: airport operators, motorway and toll companies, public transport operators, energy providers. A camera manufacturer like Survision doesn't itself fall under the registration, reporting, or liability obligations of these laws.
But these operators are precisely our customers, or the customers of our customers. And one of the central pillars of NIS2 is supply chain security (Article 21 of the NIS2 Directive). Operators will need to demonstrate that they actively assess and manage the cyber risks posed by their suppliers, including camera systems, firmware, and software. In practice, this means:
KRITIS and NIS2UmsuCG target operators of critical infrastructure: airport operators, motorway and toll companies, public transport operators, energy providers. A camera manufacturer like Survision doesn't itself fall under the registration, reporting, or liability obligations of these laws.
But these operators are precisely our customers, or the customers of our customers. And one of the central pillars of NIS2 is supply chain security (Article 21 of the NIS2 Directive). Operators will need to demonstrate that they actively assess and manage the cyber risks posed by their suppliers, including camera systems, firmware, and software. In practice, this means:
- Security questionnaires are becoming a standard part of German transport-sector tenders.
- Evidence of firmware update processes, vulnerability management, and data handling is becoming a prerequisite for contract award.
- Contractual incident-reporting clauses are being passed down from operators to their hardware suppliers.
- The KRITIS-Dachgesetz adds requirements around the physical robustness of installations relevant, for instance, to camera enclosures at toll stations or in car parks.
Why the Transport Sector Is a Particular Focus
Road transport, public transport, and airports are among the highly critical NIS2 sectors. This is exactly where Survision operates with its number plate recognition systems: toll installations, airport car parks, urban parking management, public transit access control. German operators in these areas are very likely part of the roughly 29,500 regulated entities, and will need to secure their supplier base accordingly.
What This Means in Practice for ANPR Procurement
For procurement and IT security decision-makers at German infrastructure operators, it's worth taking a closer look at:
- Hardware origin and manufacturing: Supply chain transparency reduces risk and simplifies the operator's own NIS2 documentation.
- Update and patch management: How is a vulnerability in camera firmware detected, reported, and fixed?
- Data sovereignty: Where is captured license plate data processed and stored? European hosting simplifies compliance with both GDPR and national security requirements at once.
- Incident cooperation capability: Can the supplier work quickly and in a structured way with the operator and the BSI if something goes wrong?
Why Choosing Survision Is a Security Guarantee From a KRITIS Standpoint
This is exactly where the supplier itself becomes either a risk factor or an asset. Four characteristics of Survision map directly onto the requirements NIS2 and KRITIS place on operators' supply chains:
- European manufacturing, fully traceable.
- Our hardware is designed and manufactured in Europe, with our own sites in France (Paris, Angers, Bordeaux, Lyon), and several of our subcontractors are based in Germany (Regensburg, LED manufacturing, for example). For an operator who needs to document their supply chain and assess risk under NIS2, this means a short, transparent, auditable chain instead of an opaque global network of subcontractors.
- Already NDAA Section 889 compliant.
- Survision has already fully implemented the requirements of the US NDAA Section 889 (one of the strictest procurement regimes in the world for sensitive hardware), with partial in-house manufacturing in the United States and the complete absence of components from companies explicitly named under the US NDAA (Hikvision, Dahua, Huawei, ZTE, Hytera). A supplier that already meets such a demanding non-European procurement regime brings an immediate trust advantage against European KRITIS-type requirements.
- Sovereign cloud infrastructure.
- Our systems run on European cloud infrastructure (OVHcloud) rather than US hyperscalers. This reduces exposure to extraterritorial access regimes such as the US CLOUD Act and helps operators comply with GDPR and national security requirements simultaneously. That point is directly relevant to how data processing is assessed under NIS2.
- Everything in-house: hardware, software, and AI.
- Unlike many competitors who assemble camera hardware, recognition software, and AI models from separate, sometimes non-European suppliers, Survision develops hardware, firmware, recognition software, and AI algorithms entirely in-house. In practice, this means no unknown third-party components, no hidden dependencies, and no ambiguity over responsibility for vulnerability management. If a flaw needs to be reported, there is a single, directly accountable point of contact, not a chain of subcontractors.
- Put together: working with Survision means working with a supplier that doesn't need to prepare its answers to a NIS2 security questionnaire (origin, control over the supply chain, data sovereignty, incident response capability), because it's been structured from the ground up to already have the right answers.
- We've been following this topic closely since the NIS2 Directive was adopted at EU level, in the same spirit as our previous posts on digital sovereignty and regulatory requirements such as NDAA Section 889 in the US.
Frequently Asked Questions
Is Survision itself a KRITIS entity?
No. Survision is a manufacturer, not a critical infrastructure operator. The direct obligations under NIS2UmsuCG and the KRITIS-Dachgesetz apply to our customers, not to us.
How is the parking industry affected by this?
Very directly, because many parking facilities are themselves part of critical installations, or secure access to them. Airport car parks fall under the transport sector, one of NIS2's highly critical areas. Parking areas and access control at power plants, substations, or other energy production sites fall under the energy sector. The same goes for parking at hospitals, water treatment plants, or administrative buildings with KRITIS status. Wherever an ANPR camera controls access to a critical site, it becomes part of the security perimeter, and therefore part of the supply chain review operators must carry out under NIS2.
As an operator, do I need to replace my existing ANPR cameras?
If they are Survision cameras, no: the criteria KRITIS focuses on (traceable manufacturing, control over the supply chain, absence of sensitive components, data sovereignty) have always been built into Survision by design. If they are other equipment, the supply chain and associated risks of the installed hardware should be assessed.
Since when do these obligations apply?
NIS2UmsuCG obligations have applied since 6 December 2025, with no transition period. The KRITIS-Dachgesetz has been in force since 17 March 2026.
Which authority is responsible?
The Federal Office for Information Security (BSI) is the competent authority for NIS2 implementation in Germany.
Why is Survision a safe choice from a KRITIS standpoint?
Fully traceable European manufacturing, already-demonstrated compliance with the strict US NDAA Section 889, a sovereign European cloud infrastructure, and fully in-house development of hardware, software, and AI, with no unknown third-party components or hidden dependencies.
This post is part of our series on digital sovereignty and regulatory compliance, following our previous posts on NDAA Section 889 and European data sovereignty.
Very directly, because many parking facilities are themselves part of critical installations, or secure access to them. Airport car parks fall under the transport sector, one of NIS2's highly critical areas. Parking areas and access control at power plants, substations, or other energy production sites fall under the energy sector. The same goes for parking at hospitals, water treatment plants, or administrative buildings with KRITIS status. Wherever an ANPR camera controls access to a critical site, it becomes part of the security perimeter, and therefore part of the supply chain review operators must carry out under NIS2.
As an operator, do I need to replace my existing ANPR cameras?
If they are Survision cameras, no: the criteria KRITIS focuses on (traceable manufacturing, control over the supply chain, absence of sensitive components, data sovereignty) have always been built into Survision by design. If they are other equipment, the supply chain and associated risks of the installed hardware should be assessed.
Since when do these obligations apply?
NIS2UmsuCG obligations have applied since 6 December 2025, with no transition period. The KRITIS-Dachgesetz has been in force since 17 March 2026.
Which authority is responsible?
The Federal Office for Information Security (BSI) is the competent authority for NIS2 implementation in Germany.
Why is Survision a safe choice from a KRITIS standpoint?
Fully traceable European manufacturing, already-demonstrated compliance with the strict US NDAA Section 889, a sovereign European cloud infrastructure, and fully in-house development of hardware, software, and AI, with no unknown third-party components or hidden dependencies.
This post is part of our series on digital sovereignty and regulatory compliance, following our previous posts on NDAA Section 889 and European data sovereignty.