Enhancing EU resilience: A step forward to identify critical entities for key sectors

Critical entities provide essential services in upholding key societal functions, supporting the economy, ensuring public health and safety, and preserving the environment.

Member States will have to identify the critical entities for the sectors set out in the CER Directive by 17 July 2026. They will use this list of essential services to carry out risk assessments and to then identify the critical entities. Once identified, the critical entities will have to take measures to enhance their resilience.

List of essential services

The Commission has proposed a non-exhaustive list of services that are crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment, for the eleven sectors and subsectors covered by the Directive, as follows:

1. Energy sector, with services such as the electricity production and energy storage;
2. Transport sector, with services such as management and maintenance of airport or railways infrastructure;
3. Banking sector, with essential services such as taking deposits and lending;
4. Financial market infrastructure sector, with services such as the operation of trading venue and of clearing systems; 
5. Health sector, with distribution, manufacturing, provision of healthcare, and medical services;
6. Drinking water sector, with drinking water supply and drinking water distribution; 
7. Waste water sector, with waste water collection, treatment and disposal services;
8. Digital infrastructure sector, with services such as the provision and operation of internet exchange point service, domain name system, top-level domain, cloud computing and data centre; 
9. Public administration sector services;
10. Space sector, with the operation of ground-based infrastructure services;
11. Production, processing and distribution of food sector, with the large-scale industrial food production and processing, food supply chain services and food wholesale distribution services. 

Next steps

The delegated act adopted by the Commission will enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of its notification or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period can be extended by two months at the initiative of the European Parliament or of the Council.

Background

In 2020 the Commission proposed a significant upgrade to the EU's rules on the resilience of critical entities and the security of network and information systems. On 16 January, two key directives on critical and digital infrastructure entered into force with the purpose of strengthening the EU's resilience against online and offline threats, from cyberattacks to crime, risks to public health or natural disasters – the Directive on the resilience of critical entities (CER Directive) and the Directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), which entered into force on 16 January 2023.

For More Information

Commission Delegated Regulation

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities

Quote(s)

The sabotage last autumn of the Nord Stream pipelines underlined how essential sectors such as energy, digital infrastructure, transport and space depend on resilient critical infrastructure and how interlinked the external and internal dimensions of our security are. Our new rules on critical entities resilience we are now rolling out, are providing a strong framework to build up our collective protection against all threats.

Margaritis Schinas, Vice-President for Promoting our European Way of Life - 25/07/2023

We face increasing hybrid attacks and climate change impacts. Being prepared and resilient requires collective action. With today’s adoption we are taking another step to ensure that our societies and industries are prepared to face security challenges and disruptions in the provision of essential services.

Ylva Johansson, Commissioner for Home Affairs - 25/07/2023