CER Directive

Directive (EU) 2022/2557 was adopted on 14 December 2022 alongside NIS2 (Directive (EU) 2022/2555) and repeals Directive 2008/114/EC, the old European Critical Infrastructure directive that covered only energy and transport assets and was widely seen as ineffective because it protected installations rather than the entities operating them. CER shifts the unit of regulation from the asset to the operator: a "critical entity" is an entity in one of the eleven Annex sectors (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, food production, distribution and processing) that provides an essential service, operates on the member state's territory and for which an incident would have a significant disruptive effect under the Article 7 criteria (number of users, dependency of other sectors, market share, geographic spread, availability of alternatives).

The obligations cascade in a fixed order. Each member state had to adopt a national resilience strategy (Art. 4) and carry out a national risk assessment (Art. 5), and then identify its critical entities by 17 July 2026 (Art. 6) and notify them within one month. From notification, the entity has nine months to perform its own all-hazards risk assessment (Art. 12), repeated when necessary and at least every four years, and ten months to implement resilience measures under Art. 13(1)(a)-(f): prevention including disaster risk reduction and climate adaptation, physical protection of premises (fencing, barriers, perimeter monitoring), response and crisis management, recovery through business continuity and alternative supply chains, personnel security management, and awareness and training. These measures must be documented in a resilience plan. Art. 14 lets member states provide for background checks on staff in sensitive roles, and Art. 15 requires notification of significant incidents within 24 hours of awareness, followed where relevant by a detailed report within one month.

The boundary with NIS2 is explicit and often misread. Under Art. 8, entities identified in the banking, financial market infrastructure and digital infrastructure sectors are exempt from Art. 11 and Chapters III, IV and VI, because DORA and NIS2 already cover their resilience; conversely, every CER critical entity is treated as an essential entity under NIS2, so its cyber measures follow NIS2 Art. 21 while its physical and organisational resilience follows CER. Entities that provide the same or similar essential services to or in six or more member states can be designated as of particular European significance (Art. 17) and may receive Commission advisory missions (Art. 18).

In Denmark the directive is transposed by the CER-loven (lov om kritiske enheders modstandsdygtighed), in force since 1 July 2025, with Styrelsen for Samfundssikkerhed coordinating and sector authorities identifying and supervising entities. A practical failure mode is treating CER as a security-guard exercise: auditors look for a risk assessment that traces from hazard scenarios (flood, sabotage, supply-chain loss, pandemic absenteeism) to specific measures and tested continuity plans, not just fences and cameras.