Commission Delegated Regulation (EU) 2023/2450 establishes list of essential services under CER Directive

Original title: Commission Delegated Regulation (EU) 2023/2450 of 25 July 2023 supplementing Directive (EU) 2022/2557 of the European Parliament and of the Council by establishing a list of essential services

Commission Delegated Regulation (EU) 2023/2450 entered into force on 19 November 2023, establishing the list of essential services covered by the Critical Infrastructure Resilience (CER) Directive. This regulation defines which service operators must comply with the resilience requirements, risk management obligations, and incident reporting procedures set out in Directive (EU) 2022/2557. Organizations providing services on the established list will need to implement the mandatory cybersecurity and physical resilience measures required under the CER framework.

What changed

• The list of essential services subject to CER Directive requirements has been formally established through this delegated regulation, clarifying which service providers must comply with critical infrastructure resilience obligations.

Who is affected

Operators of essential services designated under Directive (EU) 2022/2557 across the EU, including providers in energy, transport, water, health, digital infrastructure, and other critical sectors identified in the regulation.

Summary generated by a language model; the official text prevails. Not legal advice.