law
CER Directive
The EU directive on the resilience of critical entities: physical, operational and people risk for the operators a member state names. Identification was due by 17 July 2026, and duties start from the notice each entity receives.
at a glance
- what it is
- Directive (EU) 2022/2557 on the resilience of critical entities. A directive: it reaches you through your national law. It covers physical, operational and people risk to essential services.
- who it covers
- Entities that a member state identifies as critical in the sectors of its annex. Nobody is in by size alone: the state decides and tells you.
- the size line
- None. An entity identified as critical is also covered by NIS2, whatever its size.
- fine ceilings
- No EU figure. Each member state sets penalties that are effective, proportionate and dissuasive.
- dates
- 17 October 2024 national law. 17 July 2026 identification. Then, from your notice: risk assessment within nine months, resilience duties after ten.
- status
- In force since 16 January 2023. It replaced the 2008 directive on European critical infrastructures from 18 October 2024.
basis CER Art. 2(1), 6(1), 6(3), 12(1), 22, 26(1), 27, 28; NIS2 Art. 2(3)
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my rulesare you a critical entity under CER?
- Is your activity one of the categories of entities in the CER annex?yesnoNot a critical entity. You may still supply one, and NIS2 may still apply.
- Has your member state notified you that it has identified you as a critical entity?yesnoNo CER duties for now. The state reviews its list at least every four years.
- Is your sector banking, financial market infrastructure or digital infrastructure?noyesThe CER resilience duties do not apply to you. National law may still add some.
- Risk assessment within nine months of the notice, resilience duties ten months after it. NIS2 applies to you too, at any size.
basis CER Art. 2(1), 6(3), 6(5), 8, 12(1); NIS2 Art. 2(3)
the CER dates, and the one that is yours
- 116 January 2023 the directive enters into force
- 217 October 2024 deadline to write it into national law
- 317 January 2026 national strategy and member state risk assessment due
- 417 July 2026 member states identify their critical entities
basis CER Art. 4(1), 5(1), 6(1), 6(3), 12(1), 26(1), 28
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- confirm your status and your dates
Know whether you are a critical entity, which duties apply and from when, and who speaks for you.
- assess the risks to your essential services
Have a critical entity risk assessment that covers all hazards and your dependencies, done on time and kept current.
- put the resilience measures in place
Take appropriate and proportionate measures for each area the directive lists, and describe them in a resilience plan.
- be able to report an incident
Send the initial notification within 24 hours and the detailed report on time, and keep the CER and NIS2 reports apart.
- be ready for supervision, and pass the duties down
Keep evidence an inspector can check, review on a cycle, and agree with your suppliers what the directive makes you need from them.
the dates
What applies when. The reference sits under each date.
- 16 January 2023the CER Directive enters into forceCER Art. 28applies now
- 17 October 2024deadline for member states to write CER into national law and to notify their penalty rulesCER Art. 22, 26(1)applies now
- 17 January 2026national resilience strategy and member state risk assessment dueCER Art. 4(1), 5(1)applies now
- 17 July 2026member states due to identify their critical entities; each is told within one month its risk assessment is due within nine months and its resilience duties apply ten months after that noticeCER Art. 6(1), 6(3), 12(1)applies now
the fine ceilings
The ceilings each text sets. The reference sits under each.
- CERno EU figure; member states set the penaltiesCER Art. 22
Penalties must be effective, proportionate and dissuasive. Look them up in your national act.
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.