EU Critical Entities Resilience Directive — Directive (EU) 2022/2557 (CER Directive)

Mechanism

The CER Directive establishes a two-level resilience architecture across eleven essential-service sectors of the EU economy:

Level 1 — Member State obligations

• Adopt a national critical-entity resilience strategy by 17 January 2026 covering risk assessment,

objectives, governance, measures, and stakeholder consultation.

• Conduct national risk assessments at least every four years covering natural hazards, accidents,

terrorism, sabotage, insider threats, and hostile state actors.

• Identify "critical entities" from entities operating in the eleven sectors by 17 July 2026, applying

cross-border significance thresholds set in delegated acts; notify the Commission.

• Designate a competent authority and a single point of contact per Member State.
• Establish supervisory and enforcement frameworks including inspections, audits, penalties.

Level 2 — Critical entity obligations (Articles 11–16)

• Perform entity-level risk assessments and document resilience plans.
• Implement physical security, ICT security, personnel-security background checks (for staff with

access to critical assets), business-continuity measures, and incident-reporting to authorities within 24 hours of significant disruptions (defined in implementing acts).

• Participate in cross-border exercises and Commission-coordinated support missions.
• Cooperate with national authorities and the Commission's Critical Entities Resilience Group (CERG).

Governance architecture

• Critical Entities Resilience Group (CERG): advisory body of Member State representatives

under Commission chairmanship; develops guidance, shares best practices, coordinates cross-border incidents.

• Union support missions (Article 18): Commission can, at Member State request, dispatch

multidisciplinary advisory teams to assess resilience measures of specific critical entities.

• Classified information exchange: framework for handling EU RESTRICTED-level threat data

between Commission, Europol, ENISA, and Member States.

• Interoperability with NIS2: Article 9 requires that national competent authorities under CER and

NIS2 cooperate and exchange information, avoiding duplicative reporting where a critical entity is also an "essential entity" under NIS2 (e.g. energy transmission operators, large digital infrastructure providers).

Sectoral scope (eleven, vs two under 2008/114/EC) Energy (electricity, district heating/cooling, oil, gas, hydrogen); transport (air, rail, road, water); banking; financial market infrastructures; health; drinking water; wastewater; digital infrastructure (IXPs, DNS, TLD registries, cloud, data centres, CDNs, trust services, electronic communication networks); public administration (central government); space (ground-based infrastructure); food (production, processing, distribution).

Critical-entity threshold (Article 6): a disruption must affect at least six Member States or have significant cross-border impact to trigger the "critical entity of particular European significance" enhanced-cooperation track, which brings additional Commission-level support missions and direct Europol and ENISA engagement.

Repeal architecture

CER explicitly repeals Council Directive 2008/114/EC (the European Critical Infrastructures Directive, which covered only energy and transport across a two-sector taxonomy). The 2008/114/EC taxonomy is superseded in full — Member States had until 17 October 2024 to repeal national transposition measures of the old directive and substitute CER-compliant legislation.

Key implementation milestones

National transpositions filed in the IPTM register include:

• Czech Republic Act No. 266/2025 Sb. (2025-08-04-czechia-act-266-2025-critical-infrastructure-resilience)

Relationship to NIS2 (twin-pillar architecture)

CER (physical/hybrid resilience) and NIS2 (cybersecurity) were adopted on the same day (14 December 2022) and published in the same Official Journal issue (OJ L 333, 27 December 2022). Together they close the regulatory gap left by the 2016–2022 single-pillar NIS1 + 2008/114/EC regime by creating a full-spectrum critical-infrastructure protection architecture. Entities that are both "critical entities" under CER and "essential/important entities" under NIS2 (e.g. energy TSOs, large cloud providers) face coordinated dual-stream obligations but with explicit administrative-cooperation duties to prevent duplicative reporting.

Severity rationale

Severity 4: foundational EU legislative instrument replacing the 2008/114/EC single-pillar regime with an eleven-sector resilience framework binding across 27 Member States, with cross-border significance thresholds, Commission-level enforcement coordination, and a mandatory identification process for entities of particular European significance. Closes the IPTM register's prior zero coverage of EU physical-infrastructure resilience instruments.

Open questions

• Delegated acts defining "significant cross-border disruption" thresholds (Article 5) — Commission

drafts pending as of Q1 2026.

• Critical-entity identification lists (due 17 July 2026) — will reveal which private operators

(energy majors, logistics, food processors) are subject to individual resilience plans and 24-hour incident reporting.

• Interplay with sector-specific directives (Gas Directive 2009/73/EC, Electricity Directive

2019/944) — overlap with CER's energy-sector obligations under active discussion in CERG.