EU Critical Entities Resilience Directive Guide: Risk Assessments, Resilience Plans and 24 Hour Reporting

The EU Critical Entities Resilience (CER) Directive, Directive (EU) 2022/2557, makes operators of essential services across eleven sectors legally responsible for withstanding and recovering from any disruption, from cyber attacks to floods, sabotage and pandemics. It is the physical and all-hazards counterpart to NIS2: NIS2 governs network and information system security, while CER governs the resilience of the entity and the service as a whole. Member States had to identify their critical entities by 17 July 2026, and each entity then has nine months to complete its own risk assessment and ten months before the resilience duties apply. This guide covers scope, the obligations in Articles 12 to 15, the timeline and transposition status, supervision and penalties, and where machine identities and automated systems fit. It is written for security, resilience and compliance leads at entities that have been, or expect to be, notified as critical.

Status line (checked 27 October 2026): the Directive has applied since 18 October 2024, when the 2008 European Critical Infrastructure Directive was repealed. The deadline for Member States to identify critical entities was 17 July 2026. Transposition is uneven: on 29 April 2026 the Commission referred Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain and Sweden to the Court of Justice for failing to transpose and notify their measures. Germany's transposing KRITIS-Dachgesetz entered into force on 17 March 2026. Always check your national law, which sets the competent authority, procedures and penalties.

Key takeaways

• All hazards, not only cyber. Entities must assess natural hazards, accidents, terrorism, insider threats, sabotage and public health emergencies, and take technical, security and organisational measures against all of them.
• Notification starts the clock. After a Member State notifies an entity that it is critical, the entity has nine months for its risk assessment and the Chapter III resilience duties apply ten months after notification.
• 24 hours to report disruption. Incidents that significantly disrupt or could significantly disrupt essential services need an initial notification within 24 hours of awareness and, where relevant, a detailed report within one month.
• NIS2 handles the cyber part. CER does not apply to matters covered by NIS2, and the two must be implemented together, so one incident may need both a CER and a NIS2 report.
• Finance and digital infrastructure are carved out. Most entity duties do not apply to critical entities in banking, financial market infrastructure and digital infrastructure, which rely on DORA and NIS2 instead.

Scope: who and what is covered

CER applies to "critical entities": public or private entities that a Member State has identified because they provide one or more essential services, operate infrastructure in its territory, and an incident would have significant disruptive effects. Identification is a decision by the state, not a self-assessment. Each state must review its list at least every four years.

• Essential services: a Commission Delegated Regulation sets a non-exhaustive list of essential services across the eleven sectors. Member States use it for their national risk assessments, which feed identification.
• Relationship with NIS2: Article 1(2) says CER does not apply to matters covered by NIS2 (Directive (EU) 2022/2555). In practice an entity identified as critical under CER is also brought into NIS2 as an essential entity, so cyber security measures and cyber incident reports follow NIS2 while physical, personnel and continuity resilience follows CER. See the NIS2 Directive Guide.
• Particular European significance: an entity that provides the same or similar essential services to or in six or more Member States can be notified as being of particular European significance, which allows Commission advisory missions to assess its measures.
• National reach: each Member State identifies entities operating in its territory, so a group running water or energy assets in several countries can face several national regimes.

Key obligations

Incident significance

Under Article 15 significance is judged on three parameters: the number and proportion of users affected, the duration of the disruption, and the geographic area affected, including whether it is isolated. If six or more Member States are affected, the competent authorities inform the Commission. The 24 hour initial notification applies "unless operationally unable", which is narrower than many teams assume: plan to send a short notice with known facts rather than waiting for a full picture.

What a resilience plan should contain

• Risk register: the hazards from the Article 12 assessment, including dependencies on other sectors and on suppliers.
• Prevention and protection: perimeter, detection and access control for sites and control rooms, and disaster risk reduction measures.
• Response: crisis management roles, alerting, and the link to the NIS2 cyber incident process.
• Recovery: business continuity, alternative supply chains and restoration priorities for essential services.
• Personnel security: categories of critical roles, access rights to premises and sensitive systems, and training.

The Commission published non-binding guidance on identifying critical entities in September 2025 (published in the Official Journal C series on 12 September 2025), with a reporting template, and separate guidance on resilience-enhancing measures. Use them to structure documents that an authority will recognise. See the Business Continuity and Disaster Recovery Guide.

Timeline and current status

For an entity notified close to the July 2026 deadline, the duties fall due around May 2027. Where a Member State is late, its entities may be notified later, but the national law, once adopted, can still reference these EU deadlines. Track your national competent authority rather than the EU calendar alone.

Enforcement and penalties

• Supervision powers (Article 21): competent authorities can carry out on-site inspections and off-site supervision, conduct or order audits, require information and evidence, including the results of an audit by an independent auditor paid for by the entity, and order necessary and proportionate remedial measures.
• Safeguards: these powers are subject to safeguards including the right to an effective remedy before an independent court.
• Penalties (Article 22): the Directive does not set fine amounts. Member States must lay down penalties that are effective, proportionate and dissuasive, so the actual maximum depends on national law.
• Member State enforcement: the Commission is pursuing infringement proceedings, with seven states referred to the Court of Justice in April 2026.
• Coordination with NIS2: authorities under CER and NIS2 must cooperate and exchange information, so a weakness found in one regime can prompt scrutiny in the other.

What it means for AI agents and non-human identities

CER is written for physical and organisational resilience, but modern essential services are run by control systems, automation and integrations that act through machine identities. Several CER duties cannot be evidenced without them. The rows below are good practice, not wording from the Directive.

AI agents that schedule maintenance, balance loads or triage alarms add a new dependency: if the agent's credentials or upstream model service fail or are abused, the essential service can be disrupted. Record them in the risk assessment as dependencies and give them scoped, revocable identities. See the Critical Infrastructure Identity Security Guide and the OT and ICS Identity and Access Guide.

Compliance steps

1. Confirm status. Check whether you have received a notification under Article 6(3), the date, and whether you were also notified as of particular European significance. Diarise the 9 and 10 month dates.
2. Find the national law and authority. Identify the transposing act and competent authority in each Member State where you operate, and note national additions such as size thresholds or extra sectors.
3. Obtain the Member State risk assessment. Request the relevant parts so your Article 12 assessment builds on it, as the Directive expects.
4. Run the all-hazards risk assessment. Cover natural, accidental, malicious and supply chain risks, cross-sector dependencies and the service's critical assets, including the control systems and their identities.
5. Write the resilience plan. Structure it by the six Article 13(1) measure areas and map existing NIS2, ISO 22301 or ISO/IEC 27001 controls into it to avoid duplication.
6. Appoint the liaison officer. Name a person with authority and a deputy, and give the authority their contact details.
7. Merge the incident process. Build one triage step that decides whether an event needs a CER notification, a NIS2 notification, or both, and rehearse the 24 hour initial report. See the Cyber Incident Reporting Requirements Map.
8. Define sensitive roles. Agree with HR and legal which roles need background checks under national rules, including administrators of control system automation.
9. Exercise and audit. Test the plan with a scenario that combines a physical and a cyber event, then prepare evidence for an authority inspection or independent audit.

Framework mapping

Common failure patterns

• Filing CER under cyber: treating CER as a second NIS2 project misses physical protection, personnel security and non-cyber hazards, which is most of what the authority will test.
• Two incident processes: separate CER and NIS2 workflows produce inconsistent reports and missed deadlines. One triage step should feed both.
• Dependencies stop at the fence: risk assessments that ignore upstream suppliers, cloud services and the credentials connecting them underestimate how a disruption spreads.
• Waiting for national law: where transposition is late, entities delay work, then face the 9 and 10 month deadlines with nothing prepared.
• Background checks without access control: vetting people while leaving shared engineering accounts and vendor logins unmanaged defeats the purpose of Article 14.

Practitioner checklist

• Record notification dates and the resulting 9 and 10 month deadlines.
• Identify the transposing law and competent authority in every relevant Member State.
• Obtain the Member State risk assessment extracts for your sector.
• Complete an all-hazards risk assessment including supplier and identity dependencies.
• Write a resilience plan organised by the six Article 13(1) measure areas.
• Appoint a liaison officer and deputy.
• Run one triage step for CER and NIS2 incident notifications.
• Define sensitive roles for background checks, including automation administrators.
• Exercise a combined physical and cyber disruption scenario.
• Keep inspection-ready evidence of measures and testing.

Standards and references

• EUR-Lex: Directive (EU) 2022/2557 on the resilience of critical entities
• EUR-Lex: Directive (EU) 2022/2557, Official Journal record
• European Commission Migration and Home Affairs: Critical infrastructure resilience
• European Commission: Referral of seven Member States over the CER Directive
• Bundesregierung: KRITIS-Dachgesetz
• Water News Europe: Seven EU countries taken to court over critical entities

Related NHI Mgmt Group resources: Critical Infrastructure Regulation Map · NIS2 Directive Guide · DORA and NIS2 Overlap Mapping Guide · Germany NIS2 Implementation Guide. This guide summarises the EU Critical Entities Resilience Directive (EU) 2022/2557 as at 27 October 2026 and is not legal advice.