Loading...
Critical Entities Resilience Directive
Establishes physical and operational resilience requirements for critical entities across 11 sectors. Complements NIS2 (cyber) with physical security, business continuity, and supply chain resilience obligations. Member States must identify critical entities by July 2026.
11
Sectors Covered
26
Articles
24h
Incident Reporting
10mo
Compliance Window
16 January 2023
CER Directive enters into force
17 October 2024
Member State transposition deadline
17 January 2026
National resilience strategies adopted
17 July 2026
Member States identify critical entities
17 May 2027
Identified entities must comply with resilience measures
Critical entities must adopt resilience measures covering physical security of premises and infrastructure, personnel screening, business continuity planning, and supply chain security.
Report incidents that significantly disrupt or could disrupt essential service provision to the competent authority within 24 hours.
Conduct comprehensive risk assessments covering natural hazards, man-made threats, accidents, pandemics, and cross-border or cross-sector dependencies.
Background verification checks for personnel in sensitive roles within critical entities, subject to national law and EU data protection rules.
Member States ensure entities can demonstrate compliance. Competent authorities have supervisory powers including on-site inspections and audits.
Set by Member States
Must be ‘effective, proportionate and dissuasive.’ Each Member State defines specific penalty amounts in their national transposition legislation.
We provide structured preparation and compliance support for CER Directive.
Schedule a consultation with our regulatory experts to assess your CER Directive compliance posture and build a practical roadmap.