f97.beERIK SCHMIDT’S WORKSHOP
← All terms

Glossary · Energy industry & energy transition

CER Directive

CER Directive Critical entities resilience critical infrastructure resilience EU safety

The CER Directive is Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities. CER stands for Critical Entities Resilience. It concerns entities that provide services essential for vital societal functions, economic activities, public health and safety, or the environment. An incident affecting them would have significant disruptive effects on those services. The Directive creates an overarching framework against all types of hazards, whether natural or man-made, accidental or intentional. It repeals the older Directive 2008/114/EC on European critical infrastructures, which was essentially limited to protecting selected infrastructures in the energy and transport sectors.

Legal status and deadlines

The Directive entered into force in January 2023. Member States had to transpose it into national law by 17 October 2024. Since 18 October 2024 it has applied in place of the old directive. By 17 January 2026, Member States had to adopt a national resilience strategy and carry out a risk assessment at Member State level. On that basis, they had to identify the critical entities for the sectors and subsectors listed in the Annex by 17 July 2026. Operators' obligations therefore do not begin automatically with the Directive. They begin only once an operator is notified that it has been designated as a critical entity. After that, it generally has nine months to carry out its own risk assessment. The resilience obligations apply from ten months after the notification.

Scope: eleven sectors

The Directive covers eleven sectors: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, public administration, space, and the production, processing and distribution of food. In the energy sector, the subsectors are electricity, district heating and cooling, oil, gas and hydrogen. Hydrogen was missing from earlier versions of this entry. The Commission has published a non-exhaustive list of essential services. National authorities rely on this list for risk assessment and designation.

An important special rule applies to the banking, financial market infrastructures and digital infrastructure sectors. Entities in these areas can be designated as critical. However, the operator obligations on resilience measures and supervision do not in principle apply to them, because other EU rules apply there. The energy sector is not exempted.

An entity is not critical merely because it is large, expensive or politically visible. What matters is whether it provides an essential service, operates in the Member State, and whether an incident would significantly disrupt that service. In doing so, authorities consider, for example, the number of dependent users, dependencies between sectors, market shares, geographical reach and whether alternatives exist. Member States may set thresholds, but are not required to. A substation, a control room or a transmission system operator may therefore be relevant for very different reasons. Whether a particular facility is covered is determined only by national law.

Obligations of states and operators

Member States designate competent authorities and a single point of contact. They support critical entities, for example with guidance, methodologies, exercises, advice and training for staff. The Commission supplements this with best practices and cross-border exercises. It also provides information on EU funding.

  • Risk assessment: Critical entities assess all relevant risks to their essential services, including dependencies on other sectors. This is done for the first time within nine months of the notification of designation and thereafter as needed, but at least every four years.

  • Resilience measures: They take technical, security-related and organisational measures. These are intended to prevent incidents, protect against them, respond, limit consequences and restore operations. The measures are described in a resilience plan or an equivalent document.

  • Notification obligation: Incidents that significantly disrupt or could significantly disrupt essential services are reported to the competent authority. The initial notification is made no later than 24 hours after becoming aware of the incident, where operationally feasible. A detailed report follows, where necessary, no later than one month afterwards.

  • Supervision: Authorities may verify compliance, issue orders and impose penalties. National law determines precisely how penalties and competences are structured.

For entities that provide services to six or more Member States, the Directive provides for a separate category: critical entities of particular European significance. For these, the Commission may organise advisory missions.

Distinction from NIS2 and KRITIS

The CER Directive belongs to the same legislative package as the NIS2 Directive (EU) 2022/2555, but has a different focus. NIS2 governs the cybersecurity of network and information systems. CER is aimed mainly at physical resilience and overall operational capability. This includes natural events and climate impacts, sabotage, terrorism, public health emergencies, staff outages, disrupted supply chains, failed auxiliary systems and hybrid threats. The authorities under both sets of rules must coordinate. For example, the NIS2 authorities are informed which entities have been designated under CER. Critical infrastructure denotes the asset to be protected. The CER Directive, by contrast, is the legal framework that governs who is responsible, how the procedure works and which obligations apply.

Implementation in Germany

Germany transposed the Directive after the EU deadline had expired, through the KRITIS-Dachgesetz (KRITIS Umbrella Act). It was promulgated in the Federal Law Gazette on 16 March 2026 and entered into force, for the most part, on 17 March 2026. The Act alone does not yet give rise to specific operator obligations. A statutory ordinance is to determine which facilities are critical. The first obligation will be the registration of critical facilities, at the earliest from 17 July 2026. Operators should therefore check the current status of the ordinance and the deadlines rather than relying solely on the text of the Directive. For cybersecurity, the rules transposing NIS2 apply in parallel.

What resilience means here

Resilience is more than robustness. A robust facility withstands certain stresses. A resilient entity identifies risks, prevents or limits incidents, continues to operate under difficult conditions, becomes functional again after a disruption and learns organisationally from the incident. The Directive does not demand absolute security. It demands traceable and proportionate precautions that are guided by risk.

In the power system, this technically means, for example: physically securing sites, designing control systems and communications redundantly, keeping emergency power available, planning spare parts for large transformers, ensuring black start capability, drawing up restoration plans and practising them regularly. Organisationally, it concerns clear responsibilities, reporting channels, crisis teams, supplier management and cooperation with authorities. An outage need not be caused by a hacker attack. Flooding in a switchgear installation, a fire in a control room, blocked access roads or missing key personnel can also trigger one.

Significance for the power system

Almost all other sectors depend on electricity: waterworks, hospitals, telecommunications, payment systems and administration. The power system is therefore itself critical and at the same time a prerequisite for other critical entities. The CER Directive makes such dependencies visible. A transmission system operator may be technically well prepared and still depend on communication services, software suppliers, transport routes or special transformers. A power plant may depend on fuel logistics, cooling water or service providers.

CER touches on security of supply but does not cover it completely. Security of supply also includes generation capacity, grid expansion, market rules, reserves and operational management. CER, by contrast, concerns the resilience of the entities that support these functions.

Common misunderstandings

  • CER does not mean only fences and cameras. A well-secured site remains vulnerable if restart plans are missing or spare parts come from a single, fragile supply chain.

  • CER is not primarily a notification obligation. Its main effect comes from risk assessment and precautionary measures. Notifications mainly help to build up a situational picture.

  • Resilience is not the same as redundancy. Duplicated technology may depend on the same sites, suppliers or control systems. Different service providers, spatial separation, exercises and rapid recovery also contribute to resilience.

  • CER does not resolve funding questions. Market prices reflect rarely used security precautions only to a limited extent. In the regulated grid sector, it must be clarified how costs are recognised through network charges. This is governed not by the Directive but by national energy and regulatory law.

Assessment

The CER Directive is not a technical standard. It is a regulatory framework with minimum requirements that Member States may specify and tighten. For operators in the energy sector, three levels are therefore always important: the European text, the national implementing act with its ordinances, and the supervision for the respective sector.

Sources

Related glossary entries

Edited by eCMS on 11.11.2026 17:09

© 2026 Erik Schmidt. All rights reserved. Quotations with a link to the source are welcome.