Resilience is no longer just a contingency plan. It is an ongoing management responsibility.

Pandemics, cyberattacks, hybrid warfare, infrastructure failures and disruptions to payment systems are no longer remote possibilities. What was once treated as low-probability scenario planning has become part of the daily reality of running a business. And yet, when organisations are asked whether they have a framework in place that addresses how they will operate under crisis conditions, most still draw a blank. 

Germany has begun to address this gap, not only through new legislation, but also through a concept that may have wider relevance: the idea of the Resilienzfall, or ‘resilience scenario’. Understanding how German law frames this concept, and what it demands from employers and employee representatives alike, offers useful lessons for organisations grappling with similar challenges. 

In this article, we explore the concept of the resilience scenario, examine how Germany’s KRITIS framework and codetermination rules shape workplace resilience, and identify practical lessons for employers in other jurisdictions.  

Most legal systems recognise two operational states: normal business operations and declared emergencies (or states of exception). In emergencies, special rules may apply, meaning that management authority is expanded, procedural requirements are relaxed, and speed of action takes precedence. 

The resilience scenario sits between these two states. It is not a declared emergency. Constitutional thresholds have not been crossed. But a significant external event may have disrupted normal operations. This could include a cyberattack that takes down IT infrastructure, a regional infrastructure collapse or a hybrid threat that unfolds gradually and unevenly across locations. Decisions must be made quickly and key personnel may be unreachable. Normal procedures cannot be followed in the usual way. 

This is often where organisations discover they are unprepared, not because they lack emergency plans, but because they assumed that anything short of a declared emergency would be handled through normal processes. In a resilience scenario, normal processes are exactly what breaks down first. 

Germany’s Critical Infrastructure Protection Act (KRITIS-Dachgesetz, KRITISDachG), which entered into force in March 2026, establishes for the first time a statutory resilience obligation for operators of critical infrastructure across eleven sectors. Operators are required to implement proportionate technical, security-related and organisational measures to ensure their resilience. These measures must also be documented in a regularly updated resilience plan. 

The KRITISDachG defines resilience as the ability to prevent, protect against, resist, respond to, limit the consequences of, absorb, and recover from incidents that significantly impair the delivery of critical services.  

The statutory obligations apply specifically to operators of critical infrastructure. Broadly speaking, this includes entities essential to national supply serving more than 500,000 people. However, the standard it sets is already influencing expectations more widely, through supply chains, insurance requirements, and regulatory dialogue. 

For employers, the significance of the KRITISDachG lies less in its direct scope than in the signal it sends: resilience is no longer a discretionary investment. It is an organisational and legal imperative, and one that has explicit personnel and employment law implications. 

What makes Germany particularly interesting from an international perspective is the interaction between resilience planning and codetermination.  

Codetermination describes the statutory right of works councils to participate in a wide range of operational decisions. Under German law, works councils hold mandatory participation rights in areas including working time arrangements, shift planning, health and safety measures, and the introduction of technical monitoring systems. These rights do not pause in a crisis. A resilience scenario, even one in which management must act quickly, remains an Eilfall (an urgent case), not a Notfall (a genuine emergency). In an emergency, management may act unilaterally and notify the works council afterwards. In an urgent case, the works council’s participation rights continue to apply. 

This creates a practical challenge. In a crisis, works council members may be unreachable. A quorum may be impossible to assemble. Proper notice of meetings may not be achievable. Yet, under German law, the obligation to involve the works council continues. 

The solution under German law, reinforced by the KRITISDachG, is advance preparation. Section 2(1) of the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG) explicitly requires both parties to make provisions for urgent cases. This is done through a ‘framework works agreement’ (known as a Rahmenbetriebsvereinbarung). 

A framework works agreement for resilience scenarios is not a crisis manual. It is a standing agreement, negotiated in advance between management and the works council, that pre-structures decision-making authority, procedures and criteria for a defined range of crisis situations. It does not attempt to resolve every possible scenario in advance. 

German practitioners increasingly describe it as a lernendes dokument, a living document designed to be reviewed and updated regularly. This mirrors the KRITISDachG’s own requirement that resilience plans be updated following risk assessments. 

The scope of such an agreement can be broad, but key common areas include: 

• the establishment and decision-making authority of a crisis management team; 

• alternative communication channels for scenarios where IT infrastructure is unavailable; 

• criteria for shift and staffing decisions when normal schedules are no longer viable; 

• health, safety and welfare obligations under crisis conditions, including psychological support and provisions for critical personnel; 

• arrangements for wage payment in scenarios where normal banking infrastructure is disrupted; and 

• the processing of employee data relevant to a crisis response. 

Data processing must be subject to careful data protection analysis. Following the European Court of Justice’s December 2024 ruling, the bar has been significantly raised for when a works agreement will constitute a valid legal basis for data processing under the GDPR. 

The German framework reflects the country’s distinctive system of employee representation and codetermination.  

However, and while it may be true that most jurisdictions do not have works councils, the underlying challenge is universal. 

Every organisation faces the same structural gap: the procedures and decision-making structures designed for normal operations are exactly what becomes unreliable in a resilience scenario. The people and institutions whose cooperation is needed, whether statutory employee representatives, trade unions, regulators, or simply key personnel, may be unavailable, unreachable, or operating under their own constraints. 

The German approach offers three transferable lessons across jurisdictions: 

• First, recognise resilience scenarios as a distinct category. A resilience scenario is not an emergency and treating it as one creates legal and operational risk. Defining it explicitly, in policy, in agreements, in governance frameworks, is itself a form of preparation. 

• Second, involve employee representatives early and structurally, not reactively. In any jurisdiction where employees have collective voice, the resilience framework will be more durable and more effective if it is built with that voice, not around it. 

• Third, design for learning. A resilience framework that is fixed is a framework that will be overtaken by events. Build in review cycles, update obligations, and mechanisms for joint evaluation. 

Resilience, properly understood, is not a contingency plan that sits in a drawer. It is an ongoing governance commitment, one that organisations in every jurisdiction are likely to face with increasing frequency.