The German federal government is apparently backing away from amending the constitution to strengthen the Federal Office for Information Security (BSI). The Federal Ministry of the Interior (BMI) plans to rely on the existing constitutional framework instead. "The federal government will make full use of the existing constitutional framework to deepen cooperation between the federal government and the states," the German Press Agency quotes from a ministry response to Green party deputy floor leader Konstantin von Notz.
A different course than promised in the coalition agreement
The coalition agreement between the CDU, CSU, and SPD had envisioned a different path: it announced strengthening the BSI and expanding it into a central authority for information and cybersecurity matters. That would have given the agency broader options for supporting the states. Just a few months earlier, the government had stated that this would require amending the constitution. Bundestag document 21/5842 from May 7, 2026, states that expanding the BSI into a central authority in the constitutional sense would require a corresponding constitutional amendment. At the same time, the government already pointed back then to existing options for cooperating with the states.
BMI relies on existing cooperation
The interior ministry now apparently intends to pursue that same approach. It points, among other things, to 14 cooperation agreements between the BSI and the states, meaning such agreements don't exist with all 16 federal states. The ministry also cites the BSI's expanded powers resulting from the NIS2 implementation, along with additional staff and funding. None of that changes the federal division of responsibilities, though. Under Section 3 of the BSI Act, the BSI can still only support the states in securing their IT and defending against threats when the states request it. The planned central authority function was meant to give the federal government additional options to act here.
Criticism from Bitkom and the Greens
Dropping the central authority function contradicts demands from the IT industry. The digital industry association Bitkom has long pushed for more consolidated responsibilities in cyber defense and explicitly welcomed the planned expansion of the BSI into a central authority back in 2025. Sustained support for states and municipalities hasn't been possible so far, the association argues, and cybercrime doesn't stop at federal jurisdictional boundaries.
Konstantin von Notz called the course reversal "simply devastating for Germany's IT security." The Green party politician also questions the government's public commitments to higher IT security in light of the decision. He further accuses the CDU/CSU-SPD coalition of putting party-political tactics above national security and calls on the government to reconsider.