GERMANY Trends and Developments Contributed by: Bettina Mertgen, Felix Siebler, Michael Herold and Ricarda Schelzke, GvW Graf von Westphalen
information, but also whether their activities fall within cybersecurity, critical-infrastructure, procurement or foreign-investment regimes. Cybersecurity and NIS-2 Cybersecurity obligations have expanded significantly. The German legislation implementing the NIS-2 Direc - tive entered into force in December 2025, extending risk-management, governance and incident-reporting duties to a substantially larger group of companies. Defence suppliers may be covered because of their size or activities in manufacturing, digital infrastruc - ture or managed services, even if they do not process classified information. Management bodies conse - quently face greater responsibility for cybersecurity governance, while supply chain risk, business conti - nuity, vulnerability management and incident report - ing are becoming central compliance issues. Despite this expansion, Germany continues to lack a universal defence-contractor certification equivalent to the US Cybersecurity Maturity Model Certification; contract- specific standards and approvals for classified sys - tems therefore remain decisive. Physical resilience and critical infrastructure Physical resilience is becoming an additional regu - latory layer. The KRITIS-Dachgesetz, published on 16 March 2026 and in force since 17 March 2026, establishes a cross-sector framework for identify - ing critical operators, conducting risk assessments, implementing resilience measures and reporting sig - nificant incidents. Although defence manufacturing is not automatically classified as critical infrastructure, contractors may fall within scope if they operate a qualifying critical facility in one of the covered sectors, subject to the applicable thresholds, implementing rules and transitional provisions. Companies should therefore integrate physical security, sabotage protec - tion, crisis management and recovery planning with their cybersecurity systems. Personnel security and counter-espionage Personnel security and counter-espionage remain immediate operational concerns. The Security Clear - ance Act was most recently amended in January 2026 and covers access to classified information as well as sensitive positions in defence-critical facilities. Com - panies should expect greater scrutiny of continuous
vetting, changes in employees’ circumstances and insider-risk reporting, rather than treating clearance as a one-off exercise. This is particularly important because the Federal Office for the Protection of the Constitution warned in July 2026 that the defence industry is increasingly targeted by espionage, cov - ert technology acquisition, cyber-attacks, influence Defence businesses should prepare for overlapping supervision rather than a single consolidated regime. Effective compliance will require co-ordinated respon - sibility for classified information, cybersecurity, per - sonnel, facilities, subcontractors and ownership structures, supported by auditable controls and rapid internal escalation procedures. IV. Procurement and European Sovereignty Procurement policy is increasingly prioritising resil - ience and European sovereignty. Defence procure - ment is increasingly characterised by highly concen - trated markets with only a limited number of European suppliers. Against this backdrop, contracting authori - ties face the challenge of designing procurement pro - cedures that preserve effective competition while fos - tering innovation, safeguarding security of supply and accelerating procurement. The new Bundeswehr Pro - curement Acceleration Act facilitates accelerated and innovative procurement procedures and adjustments to existing contracts. At the same time, ensuring val - ue for money and the efficient use of public funds has become a key objective. As a result, public pric - ing law is gaining practical importance as an instru - ment for establishing transparent and economically sound pricing where competition is inherently limited. Reflecting these developments, Germany has initiated a modernisation of its public pricing framework to bet - ter address current procurement challenges, simplify pricing mechanisms and support faster and more effective defence acquisitions. V. Increased Criminal Law and Administrative Fine Enforcement operations and sabotage. Compliance implications Violations against EU sanctions regularly lead to com - plex and long-lasting criminal investigations against the representatives of the companies involved as well as to penalty payments against these companies and/
80 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook