Survision: Critical Infrastructure & NIS2 in Germany - What ANPR Suppliers Need to Know

The KRITIS umbrella law and the NIS2UmsuCG have been in effect in Germany since 2025 and 2026, respectively. Here's what that means specifically for operators of critical infrastructure and their ANPR camera suppliers.

In short: Since December 2025, the cybersecurity landscape for critical infrastructure in Germany has been restructured. Suppliers to operators in the transportation sector (parking garages, toll systems, airports, public transport) will now face more rigorous scrutiny regarding the security of their hardware and software. We explain what has changed and what this means for the procurement of license plate recognition systems (ANPR or LPR).

Two new laws, one shared claim

Germany has adopted two key sets of regulations that redefine the security level of critical infrastructure:

• The NIS2 Implementation Act (NIS2UmsuCG) , published in the Federal Law Gazette (BGBl. 2025 I No. 301) on December 5, 2025 and in force since December 6, 2025 , transposes the European NIS2 Directive into German law and fundamentally reforms the BSI Act without a transition period.
• The KRITIS umbrella law , in force since March 17, 2026 , regulates the physical resilience of critical facilities (implementation of the European CER Directive).

Together, the two laws affect an estimated 29,500 companies in Germany, spread across 18 sectors. Crucially, for understanding the system: KRITIS operators are a subset of "critical infrastructure" operators, which in turn are a subset of all NIS2 facilities. Those classified as KRITIS operators are automatically subject to the stricter NIS2 obligations and, additionally, to the overarching KRITIS law.

Does this also affect hardware manufacturers like Survision?

The clear answer: Not directly, but certainly indirectly. And that's precisely the crucial point.

KRITIS and NIS2UmsuCG are aimed at operators of critical infrastructure, such as airport operators, highway and toll companies, public transport companies, and energy suppliers. A camera manufacturer like Survision is not itself subject to the registration, reporting, or liability obligations of these laws.

However, these very operators are our customers or the customers of our customers. And one of the central components of NIS2 is supply chain security (Article 21 of the NIS2 Directive). Operators will have to demonstrate that they actively assess and manage the cyber risks of their suppliers, including camera systems, firmware, and software. Specifically, this means:

• Safety questionnaires are increasingly becoming part of German tenders in the transport sector.
• Evidence of firmware update processes, vulnerability management and data processing will be a prerequisite for awarding the contract.
• Contract clauses regarding the obligation to report security incidents are passed on by operators to their hardware suppliers.
• The KRITIS umbrella law also introduces requirements for the physical robustness of systems, relevant for example for camera housings at toll booths or in parking garages.

Why the transport sector is a particular focus

Road traffic, public transport, and airports are among the most important NIS2 sectors. Survision is active in these areas with license plate recognition systems: toll systems, airport parking garages, municipal parking management, and public transport access control. German operators in these sectors are highly likely to be among the approximately 29,500 regulated entities and will need to secure their supplier base accordingly.

What this means in practice for the procurement of ANPR systems

Decision-makers in procurement and IT security at German infrastructure operators will find it worthwhile to take a closer look at:

1. Origin and manufacturing of the hardware: Transparency across the supply chain reduces risks and simplifies your own NIS2 documentation.
2. Update and patch management: How is a security vulnerability in the camera firmware detected, reported, and closed?
3. Data sovereignty: Where is collected license plate data processed and stored? European hosting solutions facilitate compliance with GDPR and national security requirements alike.
4. Cooperation capability in an incident: In an emergency, can the supplier cooperate quickly and in a structured manner with the operator and the BSI?

Why choosing Survision is a security gain from a critical infrastructure perspective

This is precisely where the supplier itself becomes either a risk factor or an advantage. Four features of Survision directly address the requirements that operators must place on their supply chains under NIS2 and KRITIS regulations:

1. European manufacturing, fully traceable.

Our hardware is developed and manufactured in Europe, with our own facilities in France (Paris, Angers, Bordeaux, Lyon); several of our suppliers are also located in Germany (e.g., Regensburg, LED manufacturing). For an operator who must document their supply chain and assess risks under NIS2, this means a short, transparent, and auditable chain instead of an opaque global supplier network.

2. Already NDAA Section 889 compliant.

Survision has already fully implemented the requirements of the US NDAA Section 889 (one of the strictest procurement regimes worldwide for security-related hardware): with partial in-house manufacturing in the USA and the complete avoidance of components from companies explicitly named by the NDAA (Hikvision, Dahua, Huawei, ZTE, Hytera). A supplier that already meets such a stringent non-European procurement regime brings a significant advantage in terms of trustworthiness when it comes to European critical infrastructure (KRITIS) requirements.

3. Sovereign cloud infrastructure.

Our systems rely on European cloud infrastructure (OVHcloud) instead of US hyperscalers. This reduces the attack surface from extraterritorial access regimes such as the US CLOUD Act and makes it easier for operators to simultaneously comply with GDPR and national security requirements. This point is directly relevant when assessing data processing under NIS2.

4. Everything in-house: hardware, software and AI from a single source.

Unlike many competitors who source camera hardware, image recognition software, and AI models from various, sometimes non-European, suppliers, Survision develops its hardware, firmware, recognition software, and AI algorithms entirely in-house. This means no unknown third-party components, no hidden dependencies, and no unclear responsibilities in vulnerability management. When a security vulnerability needs to be reported, there is a single, directly responsible contact person, not a chain of sub-suppliers.

In summary, this means that anyone working with Survision is working with a supplier who doesn't have to answer the key questions of a NIS2 security questionnaire (origin, control over the supply chain, data sovereignty, incident response capability), but is set up from the ground up so that the answers are correct.

We have been closely monitoring this issue at the European level since the NIS2 Directive, in the same spirit as our previous contributions to digital sovereignty and regulatory requirements such as NDAA Section 889 in the USA.

About SURVISION 

SURVISION Cameras and Cloud Applications are specifically designed for vehicle control and identification solutions such as Ticketless Parking, Traditional Parking, Parking Enforcement, Access Control, Security, and more. Survision is a global leader in license plate recognition and vehicle identification with over 60,000 cameras installed worldwide.