KRITIS Solar Park: Duties and Protection from 104 MW

With the amendment to the KritisV and the entry into force of the KRITIS-Dachgesetz (KRITIS Umbrella Act), the duty profile for ground-mounted photovoltaic plants shifts significantly. Many asset managers are operators of Critical Infrastructure for the first time without knowing it. This article sets out the threshold, the duty catalogue, the operational loss picture and a defensible cost comparison between classic Wachschutz and autonomous perimeter surveillance.

KRITIS Solar Park: When a Ground-Mounted Plant Falls Under the Umbrella Act

The relevant threshold for energy generation plants is 104 MW of installed net capacity under KritisV Annex 1 sector Energy. Anyone reaching this figure is an operator within the meaning of the regulation. The previously circulating figure of 420 MW is no longer applicable. The source is the BSI-Kritisverordnung in its current version.

Several partial fields of one operator are aggregated as soon as they are connected by grid technology or contract. A portfolio of four 30-MW fields at a shared substation therefore exceeds the threshold. The aggregation rule applies regardless of whether the fields are legally held in separate project companies, as long as economic control and grid connection are linked.

Direct marketers and PPA off-takers are not operators within the meaning of the KritisV. The duty falls on the plant operator, the company that is technically responsible for the generation plant. Leasing constructions do not change this.

With the entry into force of the KRITIS-Dachgesetz, the physical protection duty catalogue under §11 also applies. The Bundestag set out the duties on resilience plan, physical protection and 24-hour notification in Drucksache 20/9262. The registration obligation with the BBK takes effect within three months of crossing the threshold. Details on the sector logic of the KritisV help with the initial classification.

Loss Picture: Copper, Inverters, Module Theft

Inverters worth 8,000 to 25,000 euros each are the primary target of organised gangs. A single intrusion typically removes 10 to 20 units in one night. The replacement value quickly exceeds the 200,000-euro mark, before yield loss and insurance deductible are factored in.

Earthing cables and DC strings contain copper with a market value of 8 to 9 euros per kilogram as of 2025. A 50-MW field carries several tonnes of copper in the ground and in the string connections. Offenders dig along the module rows and cut cables in sections; restoration costs many times the scrap value.

Module damage from vegetation, storms and vandalism produces yield losses of 400 to 1,200 euros per MWp and day. For a 150-MW plant with 10 percent of the area affected, the weekly loss quickly reaches six figures.

Insurers require documented guarding from 50 MW, otherwise a deductible above 50,000 euros per claim applies. Without proof of effective detection, the reimbursement ratio drops further. Fires from arc faults remain undetected in unguarded plants for an average of 47 minutes. In that time they spread to adjacent strings and lead to total loss of a transformer station section.

Duty Catalogue Under KRITIS-Dachgesetz for PV Operators

The resilience plan with risk analysis must be prepared every 24 months and submitted to the BBK on request. It must name physical and cyber-related threats, dependencies and recovery times. ISO 27001 documentation alone is not sufficient, because the physical protection part has to be evidenced separately.

Physical protective measures against intrusion, sabotage and tampering at the perimeter are mandatory. This applies at the outer fence, at transformer stations and at inverter stations. A door contact alarm on the container is not perimeter protection.

The reporting obligation for significant incidents takes effect within 24 hours to the BSI, with the full report due within 30 days. Coordination of reporting routes runs through the BBK. Operators name a responsible person with 24/7 availability and a documented deputy arrangement.

Proof of effective detection at the outer fence is mandatory, not only at the container building or transformer station. A full overview of the duties is available at Requirements under KRITIS-Dachgesetz and in our 12-duty checklist 2026.

Why Classic Wachschutz Does Not Work in a Solar Park

A 200-hectare plant has 6 to 8 kilometres of fence line. A foot patrol takes 90 minutes, with a vehicle 35 to 45 minutes. In the gaps between two patrols the perimeter is unobserved. Offenders know this frequency and plan accordingly.

A stationary 24/7 Posten costs 15,000 to 25,000 euros per month and covers only one sight line. A mid-sized solar park needs two or three Posten, and even then the full fence is not visible. The TCO comparison with classic Wachschutz shows the full calculation.

The labour shortage tightens the picture. According to BDSW industry figures around 50,000 security personnel are missing in Germany in 2025. Available staff concentrate on urban contracts with better pay; rural solar parks often get only partial staffing.

Camera chains without verification produce up to 95 percent false alarms from wildlife and vegetation. Control rooms turn down sensitivity and then miss real incidents. Police response times in rural regions are 18 to 35 minutes. A professional theft is completed in that window, with offenders leaving via the nearest field-track network.

Autonomous Perimeter Protection with QR-3 for Ground-Mounted Plants

QR-3 with LiDAR and drone detection patrols autonomously on predefined routes. The sensor suite combines LiDAR, thermal camera and acoustic detection. Routes follow the fence line and critical points such as transformer station, inverter container and gate entries.

Drone detection via RF sensing matters because organised gangs run reconnaissance flights before breaking in. Detecting a drone 48 hours before the actual intrusion gives the control room time to escalate to police and intervention forces.

The thermal image detects persons at zero lux at 80 metres and vehicles at 200 metres. Vegetation and animals are classified algorithmically, so the alarm rate drops to a verifiable level. Live verification is performed by the control room. The alarm only goes to police or intervention forces on a confirmed event, not on every motion trigger.

Operation runs in the Robotics-as-a-Service model for 3,800 euros per month. No CapEx arises. Delivery time is 48 hours, minimum term 24 months. QR-3 operates at minus 20 to plus 50 degrees. Between patrols the robot charges at an inductive charging station on site.

Economics: TCO Comparison for a 150-MW Plant

Variant A: two 24/7 Posten plus Streife. Cost 38,000 to 48,000 euros per month including shift premiums under the Manteltarifvertrag and holiday cover. Coverage is patchy, perimeter detection at the fence is absent.

Variant B: two QR-3 plus a verifying control room. Cost 9,500 to 11,000 euros per month under the RaaS model. Coverage is 24/7 along the defined routes, verification in under 30 seconds.

Annual saving: 320,000 to 440,000 euros at full shift coverage. The insurance premium typically falls by 12 to 18 percent through documented detection ratio and demonstrable response time. Amortisation against a hybrid solution of Posten and cameras occurs within 4 to 7 months of commissioning. With a portfolio-wide rollout across 5 to 10 plants the contract term extends; the unit price does not fall linearly because control room integration runs once per site.

Implementation: From Site Walk to Regular Operation in 14 Days

Day 1 to 3: site walk with mapping of routes, obstacles and charging positions. Fence condition, gates, transformer stations, containers, vegetation and lighting are recorded. The result is a digital site model with candidate patrol routes.

Day 4 to 7: mapping with SLAM, definition of patrol patterns and escalation rules. The rules set out which sensor input triggers which response: wildlife ignored, person verified, vehicle escalated.

Day 8 to 11: connection to the operator's existing control room or to the Quarero control room. Interface testing covers alarm forwarding, video verification, acknowledgement and audit log per NIS-2 requirement.

Day 12 to 14: parallel operation with the incumbent Wachschutz. In this phase the incident ratio of both systems is compared and false alarms are recalibrated. Handover to regular operation follows.

In regular operation, route optimisation runs quarterly based on incident data and vegetation changes. Growth along the fence changes sight lines and acoustic reflections; the configuration is adjusted accordingly.

What Operators Need to Decide Now

Check the threshold: add up the installed capacity of all partial plants of one operator. Aggregation runs via grid-technical and contractual links, not only via legal structure. Anyone at 92 MW with another field under construction should prepare the duties now.

If the threshold is exceeded, the BBK registration deadline goes in the calendar. Three months are short, especially when resilience plan and reporting process have to be built in parallel.

Existing guarding must be audited on perimeter detection effectiveness, not on presence. A Posten at the gate does not meet the §11 requirement if the fence is not detected. The audit covers shift logs, patrol records and actual alarm forwarding from the past twelve months.

Before rolling out across the full portfolio, a pilot installation on a single field is advisable. This validates routes, false-alarm rate and interfaces under real conditions. The findings feed into the standard package for the remaining sites.

The board resolution on resilience strategy must be documented. Management is personally liable under NIS-2 for the implementation of security measures, as Article 21 of the NIS-2 Directive sets out. Details on board liability under NIS-2 show the reach of this responsibility.

Anyone who has crossed the 104-MW threshold or will cross it in the current financial year should evaluate perimeter protection concretely. A technical site walk with QR-3 on a pilot field takes two weeks and delivers defensible data for the board resolution. Appointment and specification can be requested directly via the QR-3 product page.