CER Directive

Nothing changed in the last 90 days. Sign in to read further back.

1. 2026-11-23 in 14 days Indicative European Parliament plenary date for the small mid-caps omnibus, COM(2025) 502, which amends the CER Directive - a forecast, not a fixed date
2. 2028-07-17 in 616 days Single points of contact submit their first summary report on incident notifications, then every two years (Article 9(3))
3. 2026-07-17 Member States must have identified their critical entities (Article 6(1))
4. 2026-04-29 Commission refers Bulgaria, Spain, France, Luxembourg, the Netherlands, Poland and Sweden to the Court of Justice for not transposing the Directive
5. 2026-01-17 Member States must have adopted their resilience strategies and carried out their risk assessments (Articles 4(1) and 5(1))
6. 2024-10-18 Member States apply their national CER measures; Directive 2008/114/EC is repealed

1. 2025-11-19
   Digital Omnibus proposal, COM(2025) 837 Draft

   Commission proposal whose Article 9 would have critical entities notify incidents through the single-entry point that ENISA would run under NIS2. source

   More

   • Not adopted; the European Parliament lists procedure 2025/0360(COD) as awaiting a committee decision.
2. 2025-05-21
   Small mid-caps omnibus proposal, COM(2025) 502 Draft

   Commission proposal amending Article 4(2)(h) so national strategies also describe support measures for small mid-cap enterprises identified as critical entities. source

   More

   • The European Parliament committee approved the text agreed with the Council on 2 July 2026; the indicative plenary date is 23 November 2026. Not yet adopted.
3. 2022-12-14
   Directive (EU) 2022/2557 Major versionCurrent text

   The Critical Entities Resilience Directive, published in OJ L 333 of 27 December 2022. source

   More

   • It repealed Directive 2008/114/EC with effect from 18 October 2024.

CER applies to the entities each Member State identifies as critical, not to whole sectors automatically.

Sectors

Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, and production, processing and distribution of food (Annex). source

Identification

An entity is critical when it provides an essential service, operates on that Member State's territory, and an incident would have significant disruptive effects (Article 6(2)); it is notified within one month of identification (Article 6(3)). source

When duties start

Chapter III resilience duties apply 10 months after the entity is notified (Article 6(3)). source

Finance and digital

For critical entities in banking, financial market infrastructure and digital infrastructure, Article 11 and Chapters III, IV and VI do not apply (Article 8). source

European significance

Critical entities providing essential services to or in six or more Member States can be of particular European significance and get Commission advisory missions (Articles 17 and 18). source

Link to NIS2

Every entity identified as critical under CER also falls under NIS2 regardless of its size (NIS2 Article 2(3)). source

No certificate: the critical entity assesses its own risks and takes resilience measures, and authorities can inspect and audit it.

Risk assessment

Within nine months of being notified, then when necessary and at least every four years (Article 12(1)). source

Resilience measures

Technical, security and organisational measures to prevent, protect against, respond to and recover from incidents, set out in a resilience plan (Article 13). source

Background checks

Member States set when a critical entity may request background checks on people in sensitive roles (Article 14). source

Incident notification

Initial notification no later than 24 hours after becoming aware of a significant incident, then a detailed report within one month where relevant (Article 15(1)). source

Inspections and audits

Competent authorities can inspect critical infrastructure on site, supervise off site, and conduct or order audits (Article 21(1)). source

Penalties are set by each Member State's transposing law; the Directive fixes no fine amounts.

Penalties

Member States lay down effective, proportionate and dissuasive penalties and had to notify them by 17 October 2024 (Article 22). source

Transposition cases

On 29 April 2026 the Commission referred seven Member States to the Court of Justice for not transposing any measures, asking for financial sanctions. source

1. Law text Directive (EU) 2022/2557 (Critical Entities Resilience Directive)
2. Law text Delegated Regulation (EU) 2023/2450 - list of essential services
3. Law text Small mid-caps omnibus proposal COM(2025) 502 (amends CER Article 4; not adopted)
4. Law text Digital Omnibus proposal COM(2025) 837 (amends CER Article 15; not adopted)

1. NIS2

   Adopted the same day for the cybersecurity of networks and information systems, while CER covers physical and all-hazard resilience of the entity.

2. SOCI Act

   Australia's national critical infrastructure law, outside the EU framework.

3. UA Critical Infrastructure Law

   Ukraine's national critical infrastructure law, outside the EU framework.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to CER Directive (RSS)