critical entities resilience directive

You do not decide this yourself. A critical entity is a public or private entity that a member state has identified, under the directive’s procedure, as belonging to one of the categories of entities in its annex. The state works from its own risk assessment and its strategy, and from a list of essential services the Commission set in Delegated Regulation (EU) 2023/2450. That list is not exhaustive.

To be identified, an entity has to meet three tests at once. It provides one or more essential services. It operates in that member state, and its critical infrastructure is located there. And an incident would have significant disruptive effects on that service or on other essential services that depend on it. To judge “significant”, the state looks at the number of users, how much other sectors depend on the service, the impact by degree and duration, the entity’s market share, the geographic area that could be affected and whether alternatives exist.

The state then puts you on a list and tells you within one month. The notice states your duties and the date from which they apply. It reviews the list at least every four years and tells entities that drop off.

The annex names eleven sectors: energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road, public transport), banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, central government administration, space, and the production, processing and distribution of food. Within each sector it names the kinds of entity, for example distribution system operators, airports, healthcare providers, pharmaceutical manufacturers, cloud and data centre providers, and food businesses in logistics, wholesale and large-scale industrial production.

Three sectors are treated differently. Critical entities in banking, financial market infrastructure and digital infrastructure are identified like the rest, but the resilience duties, the European significance chapter and the supervision chapter do not apply to them. Their states tell them so, unless national measures add duties. Where a sector-specific EU law already requires resilience measures that the state recognises as at least equivalent, the matching CER provisions do not apply either. Public bodies in national security, defence and law enforcement are out.

A risk assessment. Within nine months of the notice, and at least every four years after that, you assess every relevant risk that could disrupt your essential services. The directive means all hazards: natural and man-made risks, accidents, natural disasters, public health emergencies, hybrid and other antagonistic threats, including terrorism. You also look at dependencies both ways: which other sectors depend on your service, and which services you depend on, including across borders. The state shares the relevant parts of its own assessment to help. You may reuse risk assessments made under other laws, and the authority may accept an existing one as compliant, in whole or in part.

Resilience measures. You take appropriate and proportionate technical, security and organisational measures, based on both risk assessments. The directive lists what they must cover:

• preventing incidents, with disaster risk reduction and climate adaptation in mind
• physical protection of premises and critical infrastructure, for example fencing, barriers, perimeter monitoring, detection equipment and access controls
• responding to, resisting and limiting incidents, with risk and crisis management procedures and alert routines
• recovering from incidents, with business continuity measures and alternative supply chains
• employee security management: who holds critical functions, access rights to premises, infrastructure and sensitive information, background checks, training and qualifications
• awareness of all of this among the relevant staff, through training, information and exercises

When you set the categories of staff with critical functions, you count the staff of your external service providers.

A resilience plan, or equivalent documents, that describes these measures, and a liaison officer or equivalent as your point of contact with the authorities. The state sets the conditions under which you may ask for background checks on people in sensitive roles, on people with direct or remote access to your premises, information or control systems, and on candidates for those roles. A check at least confirms identity and looks at criminal records relevant to the position, and it is limited to what is necessary.

An incident, in this directive, is an event that significantly disrupts, or could significantly disrupt, the provision of an essential service. You notify the competent authority without undue delay. Unless you are operationally unable to, you send an initial notification no later than 24 hours after becoming aware, followed where relevant by a detailed report no later than one month after. The parameters for “significant” are the number and share of users affected, the duration and the geographic area, with attention to isolated areas.

The notification carries what the authority needs to understand the nature, cause and possible consequences, including any cross-border impact. The directive says notifying does not increase your liability. The authority sends you follow-up information that can help your response, and informs other affected member states through its single point of contact.

The CER report and the NIS2 report are separate duties. A cyber incident that disrupts an essential service can trigger both, each on its own clock and possibly to different authorities. Under NIS2, the incident response teams pass reports from critical entities on to the CER authorities, and the texts do not say that this replaces your CER report. Ask your authorities how they want the two handled.

The directive entered into force on 16 January 2023. Member states had to adopt their national measures by 17 October 2024 and apply them from 18 October 2024. They were due to adopt a national strategy and carry out their own risk assessment by 17 January 2026, and to identify their critical entities by 17 July 2026.

Your own clock starts with the notice. If your state identified you on time, the notice came within a month of that. The risk assessment is due within nine months of the notice, and the resilience duties apply ten months after it. Each state moves at its own pace, so read the date in your notice.

The competent authority can inspect your premises and critical infrastructure on site, supervise your measures remotely, and run or order audits. For a critical entity that is also under NIS2, the authority can require the information it needs to assess your measures, and evidence that they work, including the results of an audit by a qualified outside auditor that you select and pay for. It can order you to remedy an infringement within a time limit it sets. These powers come with safeguards: objectivity, protection of business secrets, the right to be heard and to go to court.

The directive sets no fine amounts. Each member state lays down the penalties for breaking its national rules, and they must be effective, proportionate and dissuasive. States were due to notify the Commission of those rules by 17 October 2024. Look them up in your national act.

The two directives were adopted on the same day and refer to each other throughout. CER covers the physical and operational resilience of the services. NIS2 covers the security of network and information systems. CER does not apply to matters NIS2 covers, and states have to implement the two in a coordinated way.

Being identified under CER pulls you into NIS2. NIS2 applies to entities identified as critical entities whatever their size, and counts them as essential entities, the stricter of its two tiers. The two sets of authorities share the list of critical entities, exchange information on risks and incidents, and can ask each other to use their supervisory powers. In practice one risk assessment that covers both cyber and physical hazards, one crisis process and one continuity plan can serve both, as long as each directive’s own elements are in it.

For digital infrastructure, the NIS2 recitals say NIS2 covers the physical security of those systems too, which is why the CER resilience duties do not apply to those entities.

Most companies are not critical entities, and the directive puts no duty on them. It can still reach you in two ways.

You supply a critical entity. Your customer has to count the staff of external service providers when it sets out who holds critical functions. People with direct or remote access to its premises, information or control systems can be subject to background checks under its national rules. Its recovery plans have to consider alternative supply chains, which may mean a second supplier next to you. Expect contract terms on access, vetting, continuity and incident notice.

You might be identified later. If your activity is in the annex and your service matters to many users or to other sectors, check whether your state has a public list or has contacted you. States review the list at least every four years.

A reasonable first step, whether or not you are on the list, is to know which essential services you depend on and what you do if one fails for a week.