KRITIS Insurance: What Operators Pay in 2026 and Why

Industrial insurers fundamentally restructured the calculation of KRITIS risks starting with the 2024 reporting year. Operators renewing a property policy for an industrial site in 2026 no longer negotiate fire and natural hazard cover alone. The negotiation now turns on detection times, patrol evidence and audit-grade logs. This article explains the levers risk managers need to know and where robotic patrol enters the premium logic as a technical evidence supplier.

Insurance Requirements for KRITIS Operators in 2026

Reinsurers have pulled KRITIS risks out of standard portfolios since 2024 and price them in separate tranches. The consequence: primary insurers pass the tougher tariffs through to operators and demand detailed risk audits before every renewal.

The audits follow a fixed sequence. First perimeter protection (fence, gates, single-person interlocks), then detection time on the site boundary, then the escalation chain through to police callout. Fire protection and IT security come after that. This sequence is new and reflects the sector logic of the BSI-KritisV.

Specifically, several industrial insurers require documented detection times below 60 seconds across the entire site boundary, not only at gates. Fence-plus-patrol concepts rarely meet this requirement and trigger deductible surcharges of 20 to 40 percent versus the standard tariff. [Source to add]

Without registration with the BBK under the KRITIS Umbrella Act (KRITIS-Dachgesetz), several industrial insurers will refuse cover extensions to consequential damage and business interruption from 2026. The KRITIS-Dachgesetz itself defines the physical protection duties and registration requirements (Bundestag-Drucksache 20/9262).

Next step: KRITIS requirements overview.

Premium Structure: The Operator's Three Levers

The property premium for critical assets consists of three components: base tariff (based on sum insured and sector), risk surcharge (asset-specific) and compliance discount (for documented loss prevention).

The operator cannot influence the base tariff. It results from sector, sum insured and reinsurance market conditions. Risk surcharge and compliance discount are negotiable, and this is where the annual premium burden is decided.

Documented 24/7 perimeter detection lowers the risk surcharge by 8 to 15 percent. [Source to add] The condition is that detection is logged without gaps and that the loss adjuster can inspect the logs. On-demand patrol does not qualify.

Drone detection has become a separate premium-relevant item for power utilities and waterworks. The 2025 sector queries show: operators without drone detection pay more for transformer stations and clean water tanks.

Audit-grade patrol logs count as loss prevention evidence under most policy wordings. That is the legal basis for the discount. Without this evidence the clause does not apply, even if the technology is installed.

Next step: Guard service TCO comparison.

QR-2 and QR-3: Sensor Data Accepted for Insurance Evidence

Insurers do not accept any and every recording. What counts is tamper-proof storage, unambiguous timestamps and classification data the loss adjuster can interpret.

QR-2 delivers thermal recording and person classification with a timestamp per patrol point. Each detection contains position, classification result and confidence value. That suffices for standard perimeters in the energy, water and logistics sectors.

QR-3 with LiDAR and drone detection adds ground-level LiDAR tracks and detection of airborne objects. Both data streams are stored as a tamper-proof audit log. For power transmission and water supply, this combination is effectively required for the compliance discount from 2026 onward.

Insurers require audit-proof storage of detections for at least 90 days. [Source to add] Quarero logs are exported in WORM format (Write Once, Read Many) and align with BSI guidance on evidence preservation. In a claim case, the data can be handed to the loss adjuster directly, not via the operator. That shortens review and avoids the accusation of subsequent editing.

For clarity: Quarero is not an insurance partner. Quarero delivers the technical evidence; the operator remains the sole contracting party with the insurer.

Cost Analysis: Premium Savings Against the RaaS Fee

The business case can be calculated on a mid-sized KRITIS site. Example assumption: sum insured between 80 and 150 million euro, energy or water sector, site with 1.5 to 3 kilometres of perimeter, three-year contract term.

Such a site typically pays between 180,000 and 320,000 euro property premium per year. [Source to add] The range depends on sum insured, claims history and sector.

A premium reduction of 10 percent equals 18,000 to 32,000 euro savings per year. Over the usual three-year term that is 54,000 to 96,000 euro.

QR-2 under the Robotics-as-a-Service model costs 3,500 euro per month, i.e. 42,000 euro per year. No CapEx, no personnel risk, no employer-side wage costs, no sick leave.

A conventional 24/7 guard post costs between 15,000 and 25,000 euro per month according to BDSW sector statistics, including shift model, allowances and substitution. The personnel cost per post is therefore 180,000 to 300,000 euro per year. The premium does not fall as a result. A human guard produces no machine-readable, audit-proof logs. Insurers do not accept such records as loss prevention evidence.

The gap between guard cost and robotic cost finances the solution twice over: once via the premium saving, once via the personnel cost differential. What remains: a guard post is not eliminated, it is relocated. To the access control point, to the control room, into the escalation chain. Plain fence-line patrols are handled by QR-2 and QR-3.

Limits of the calculation: for very small sites with perimeters below 800 metres and low sums insured, robotic patrol does not pay for itself via the premium alone. Here the regulatory obligation (BBK registration, state of the art) carries the second half of the argument.

NIS-2 and Insurability of the Management Board

The NIS-2 directive anchors personal liability of the management board for the implementation of technical and organisational security measures in Articles 20 and 21 (EUR-Lex Directive 2022/2555). This liability cannot be delegated.

D&O insurers have, since 2024, reviewed before every renewal whether the security concept matches the state of the art. This applies not only to cyber but also to physical protection of supply-relevant assets.

Missing technical measures on the perimeter qualify as a breach of duty within the meaning of D&O conditions. In a claim, the insurer can invoke the breach of obligation, which in extreme cases excludes payment.

Documented robotic patrol with an audit-proof log is a core building block for maintaining D&O cover. The logs demonstrate that the duty of care has been implemented operationally. Concept papers alone are not enough.

Board resolutions on procurement should name the contribution to insurability explicitly. A board paper that mentions only the security benefit is weaker in a dispute. Property and D&O policies should be cited concretely.

Deep dive: NIS-2 and management board liability.

Approach for the Next Contract Renewal

Request the insurer's risk audit eight to twelve weeks before contract renewal. Shorter lead times do not allow detection evidence to be consolidated and compliance discounts to be agreed in writing.

Export detection times, patrol intervals and escalation matrix from the Quarero dashboard. The export runs in WORM format. The evidence is tamper-proof and directly usable by the loss adjuster.

Agree with the loss adjuster on a pilot period of at least 90 days as the evidence base. Most insurers do not accept shorter pilot phases as statistically meaningful. 90 days matches the minimum retention period and produces a clean log coverage.

Have the compliance discount written into the policy itself, not only into the risk assessment. The risk assessment is an annex; the clause in the policy is the enforceable basis.

For multi-site contracts, calculate site profiles separately and itemise the robotic coverage per site. A group contract with a flat discount levels out the differences between protected and unprotected sites. That disadvantages every site that has already invested.

Checklist before the audit meeting: KRITIS-Dachgesetz checklist 2026.

Claim Case: What Happens After an Incident

The property insurer's first request after an incident is always the complete detection log for the 72 hours before and after the event. This window has become the standard in 2024 and 2025 claims practice.

If logs are missing or not audit-proof, payment reductions of up to half the claim amount are likely. [Source to add] On seven-figure claims that is an existential gap on the balance sheet. The reduction is grounded in the duty of loss prevention, not in a contractual breach in the narrow sense.

Quarero provides logs within four hours of the insurer's request. The export runs directly to the address named by the loss adjuster. The operator is copied on the transmission. The data cannot be altered after the fact. That is the regulatory intent.

For drone incidents, the LiDAR track from QR-3 is often the only usable technical evidence. Camera recordings fail in poor visibility. Radar systems do not cover the lower altitude bands. The LiDAR track documents flight path, altitude profile and time window with evidentiary weight.

The operator remains the contracting party with the insurer in every case. Quarero supplies the technical evidence and acts as an information source to the loss adjuster, but assumes no liability under the insurance contract. This separation of roles is legally clean and required by the policy.

Next Step

The 2026 premium logic can no longer be served with concept papers. What is required are detection times, logs and proof that loss prevention runs operationally. Operators preparing the 2026 or 2027 renewal should set up the 90-day pilot now, so that the data is on the table at the audit meeting.

Start the 90-day pilot: in 30 minutes we clarify site size, sector, contract date and the right robot deployment for the premium negotiation.