The European institutions have formally adopted the CER Directive (Directive 2022/2557 on the resilience of critical entities) which has now entered into force on 16 January 2023. The CER Directive aims to protect critical infrastructure in these sectors from a wide range of natural and man-made threats, including natural hazards, terrorist attacks, insider threats, or sabotage, as well as public health emergencies.

Key provisions:

It will cover 11 sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Entities in this sectors, once identified by Member States as critical, will be required to conduct risk assessments; take technical and organisational resilience enhancing measures; and notify disruptive incidents without undue delay to the relevant national authorities. They will also be able to request background checks on personnel holding sensitive roles.

Member States will need to adopt a national strategy and carry out regular risk assessments to identify entities that are considered critical or vital for the society and the economy. Member States will also be required to support critical entities through the provision of guidance material, while the Commission will be developing a Union-level overview of cross-border and cross-sectoral risks, best practices, methodologies, cross-border training activities and exercises to test the resilience of critical entities, among others.

The CER directive also establishes rules for the identification of critical entities of particular European significance, that is, entities that provide an essential service to six or more member states.

A Critical Entities Resilience Group will facilitate cooperation among Member States and the exchange of information and good practices.

Next steps:

As a Directive, it will be applied by each Member State individually after being transposed in national law. Member States have until 17 October 2024 to adopt such laws and begin applying the new provisions from 18 October 2024. Until then, the existing framework continues apply (Council ECI Directive, as transposed in national law).