Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities, published OJ L 333, 27 December 2022, entered into force 16 January 2023, with Member State transposition deadline 17 October 2024 (rules applicable from 18 October 2024). The CER Directive repeals Council Directive 2008/114/EC on European Critical Infrastructures, extending the scope from two sectors (energy, transport) to eleven essential-service sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Member States must adopt national resilience strategies, conduct risk assessments at least every four years, identify "critical entities" providing essential services whose disruption would have significant cross-border impacts, and ensure those entities implement technical, security, and organisational resilience measures, business-continuity plans, incident-reporting obligations, and personnel-security background checks. The CER Directive is the physical and hybrid resilience twin to the NIS2 Directive (2022/2555) — the two instruments form the binding EU critical-infrastructure-protection architecture replacing the 2008/114/EC regime.

Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA) is the EU's first horizontal cyber- and ICT-resilience instrument for the financial sector. Adopted 14 December 2022 and published in the Official Journal on 27 December 2022, it entered into force on 16 January 2023 and applies from 17 January 2025. DORA covers approximately 22,000 EU regulated financial entities across ~20 entity types (credit institutions, insurers, investment firms, CCPs, trading venues, crypto-asset service providers, etc.) under five pillars: ICT risk management, ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing for significant entities), ICT third-party risk management, and information sharing. Structurally novel, DORA establishes the Critical ICT Third-Party Provider (CTPP) oversight regime under which the European Supervisory Authorities (EBA, ESMA, EIOPA) acquire direct supervisory powers over hyperscale cloud providers (AWS, Azure, GCP, Oracle) servicing EU financial entities — the first EU mechanism for ESA direct oversight of non-financial cloud providers.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), published OJ L 333, 27 December 2022, entered into force 16 January 2023. NIS2 repeals and substantially expands the 2016 NIS1 Directive (2016/1148), extending the scope from ~7 sectors to 18 enumerated essential and important sectors, imposing binding cybersecurity risk- management and incident-reporting obligations on covered entities, introducing board-level management accountability, and mandating Member State transposition by 17 October 2024. NIS2 is the structural EU statutory anchor for national cybersecurity frameworks across the bloc, operating alongside DORA (Reg 2022/2554) for financial-sector digital resilience and CRA (Reg 2024/2847) for product cybersecurity.

The Wet veiligheidstoets investeringen, fusies en overnames ("Vifo Act") is the Netherlands' cross-sector statutory FDI screening regime. Adopted by the States-General on 18 May 2022 (Stb. 2022, 215) and entered into force on 1 June 2023 together with two implementing decrees (Stb. 2023, 173 — main implementing decree; Stb. 2023, 172 — decree defining the scope of "sensitive technology"), the Act establishes mandatory pre-closing notification and a security review by the Bureau Toetsing Investeringen (BTI, part of the Ministry of Economic Affairs and Climate) for transactions affecting (i) "vital providers" in critical infrastructure sectors — energy, transport, telecoms, port operators, banking infrastructure — and (ii) Dutch undertakings active in "sensitive technology", defined to include EU Reg 2021/821 Annex I dual-use items, military goods, and additional national-security technologies. The regime applies retrospectively to transactions completed after 8 September 2020. It is the foundational instrument under which the Dutch national export-control measures on ASML DUV immersion lithography (filed: 2023-06-30 and 2024-09-07) operate, and the Dutch peer of US CFIUS, EU Regulation 2019/452, the German AWG §§55-62, the French Décret 2014-479 / R. 151-1 et seq., and the UK NSI Act 2021.

Between 22 and 28 February 2022 — coinciding with Russia's full-scale invasion of Ukraine — OFAC issued a Financial Services Sectoral Determination and four directives under Executive Order 14024 of April 15, 2021. Together they authorise designation of any person operating in Russia's financial sector, prohibit US persons from trading Russian sovereign debt, bar US banks from maintaining correspondent accounts for designated Russian financial institutions (Sberbank, Alfa-Bank and others), prohibit new investment in certain Russia-related entities, and block all transactions involving the Central Bank of the Russian Federation, the National Wealth Fund, and the Ministry of Finance — effectively freezing approximately USD 640 billion in Russian sovereign reserves held in Western financial systems. The package was formally published in the Federal Register on 31 May 2022.