In short
The Critical Entities Resilience (CER) Directive — Directive (EU) 2022/2557 — replaced the 2008 rules on European critical infrastructure. It entered into force on 16 January 2023 and had to be transposed by 17 October 2024. Where NIS2 deals with cyber security, CER covers everything else that can stop an essential service: sabotage, terrorism, natural disasters, accidents and hybrid threats — in the Directive’s words, risks “natural or man-made, accidental or intentional”.
Member States had to identify their critical entities by 17 July 2026 and notify them within a month. From notification, the clock runs: 9 months for a risk assessment, 10 months until the resilience measures apply.
For an operator notified in August 2026, that means a risk assessment by May 2027 and resilience measures in force from June 2027.
Why now
The threats CER was written for are no longer theoretical. In January 2026 an arson attack on high-voltage cables in Berlin cut power to some 45,000 households and 2,200 businesses — in places for days — and the federal prosecutor is investigating it as suspected sabotage. The Dutch intelligence service AIVD reports a cautious rise in sabotage and its preparation since the summer of 2025, and more drones near vital infrastructure. Belgium’s State Security saw drone reports over airports, military sites and nuclear plants peak in the autumn of 2025.
Who is covered
CER covers eleven sectors. Within them, each Member State designates the entities whose disruption would significantly affect an essential service:
- Energy, transport, health, drinking water and waste water
- Banking, financial market infrastructure and digital infrastructure
- Public administration, space, and the production, processing and distribution of food
Banking, financial market infrastructure and digital infrastructure are exempt from most of the operational duties below, because DORA and NIS2 already cover them (Article 8). And under NIS2, every designated critical entity also counts as an essential entity, whatever its size.
What a critical entity must do
- 01
Risk assessment — within 9 months
Assess every relevant risk to the service: natural, accidental, hybrid and terrorist. Repeat it whenever necessary, and at least every four years (Article 12).
- 02
Resilience measures — from 10 months
Measures to prevent incidents; to ensure physical protection — the Directive names “fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls”; to respond to, resist and mitigate incidents; to recover; to manage employee security; and to raise awareness (Article 13). They are written down in a resilience plan, and a liaison officer is appointed.
- 03
Background checks
For people in sensitive roles, or with access to premises, information or control systems, Member States can provide for background checks — at minimum identity and criminal record (Article 14).
- 04
Incident notification — within 24 hours
Incidents that significantly disrupt the essential service, or could, are notified to the competent authority within 24 hours of becoming aware of them, followed where relevant by a detailed report within one month (Article 15).
- 05
Supervision
Authorities can inspect on site, audit and order remedies. Penalties must be “effective, proportionate and dissuasive”; the amounts are set nationally (Articles 21 and 22).
CER and NIS2: two halves of one duty
| Rule | What it covers |
|---|---|
| NIS2 — Directive (EU) 2022/2555 | Cyber security of networks and information systems: risk management, incident reporting, supply-chain security. |
| CER — Directive (EU) 2022/2557 | Everything else that can stop the service: physical attacks, sabotage, natural hazards, accidents, insiders. CER does not apply where NIS2 already does. |
| In practice | One incident is often both. A cut fibre, a burning substation or a drone over a site can need a CER and a NIS2 notification — each starting within 24 hours. |
Where each country stands
| Country | Status on 2 October 2026 |
|---|---|
| Belgium | Law of 19 December 2025, in force since its publication on 19 January 2026. The National Crisis Centre coordinates; sector authorities designated the entities by 17 July 2026, and operators designated under the 2011 law became critical entities on that date. Administrative fines of up to €100,000, and up to €125,000 for obstructing an inspection. |
| Netherlands | Wet weerbaarheid kritieke entiteiten (Wwke), in force since 15 August 2026 together with the Cyberbeveiligingswet. About 500 organisations, designated by their sector minister. Fines of up to €10 million or 2% of worldwide turnover. The Commission had referred the Netherlands to the EU Court of Justice in April 2026, before the law took effect. |
| Germany | KRITIS-Dachgesetz, in force since 17 March 2026. Standard threshold: a facility serving 500,000 people or more. Operators register with the BBK and report incidents through the joint BSI/BBK reporting office. The regulation that sets the thresholds per sector was, as far as we could verify, still in draft. Fines of up to €1 million. |
| France | Not yet transposed. The “Résilience” bill — NIS2, CER and DORA in one — passed the Senate in March 2025 and is scheduled for the National Assembly on 7 October 2026. The Commission referred France to the EU Court of Justice in April 2026. Until the law passes, the existing regime for operators of vital importance (OIV), coordinated by the SGDSN, applies. |
What it means in the control room
Most of CER is governance: risk assessments, plans, people. But three of its duties land in the control room — and they are the ones operators find hardest to evidence.
- Detect, not just protect. Article 13 asks for detection equipment and perimeter monitoring, not only fences. A sensor nobody looks at is not detection: alarms from fences, cameras, drones and SCADA have to reach someone who can act.
- Know within 24 hours. An initial notification means knowing quickly what happened, where, what is affected and since when. When intrusion alarms, cyber alerts and field reports sit in separate systems, the first day goes to rebuilding the timeline.
- Show your work. Supervisors can audit and inspect. Measures that exist only in a plan are hard to prove; measures that leave a record — alarms, responses, patrol logs, decisions — are not.
| Obligation | What you need in practice |
|---|---|
| Physical protection and detection (Art. 13) | Perimeter alarms, cameras and drone detection on one map, with a clear owner for every alarm. |
| Respond and mitigate (Art. 13) | Dispatch of the nearest guard or patrol from the same picture — with field units visible even in dead zones. |
| Employee security (Art. 13) | Access rights and badge events that can be set against IT and site events — within the limits of privacy law. |
| Incident notification (Art. 15) | A timeline that builds itself during the incident: physical, cyber and field events in order, ready for the 24-hour notification and the one-month report. |
| Supervision and audit (Art. 21) | Replayable records of incidents and exercises, and a log of who accessed which information. |
Software does not make an operator compliant. CER is a management duty: the risk assessment, the plan and the decisions remain yours. What a shared picture changes is whether you can detect, respond and report in time — and prove it.
What Meridian would set up
- Connect
- Perimeter alarms, access control and cameras at every site — whatever the brand
- SCADA and OT alarms, and alerts from the security operations centre (SOC)
- Drone detection, where it is installed
- Positions of guards, patrols and maintenance crews
- The asset register: sites, cable routes and dependencies between them
- Build
- One picture of all sites, with physical, cyber and field events on a shared timeline
- An incident flow: alarm → verification on camera or by drone → dispatch → incident timeline exported for the CER and NIS2 notifications
- An archive of incidents and exercises, replayable for audits and for the four-yearly risk assessment
- Run
- In the control room, the security operations centre and on the phones of field staff
- On the operator’s own servers or a sovereign cloud — fully disconnected operation is on our roadmap
Illustrative set-up — every deployment is designed with the operator. Source systems stay where they are; Meridian’s data layer runs inside the operator’s own environment.
- EUR-Lex — Directive (EU) 2022/2557 on the resilience of critical entities (CER)
- EUR-Lex — Directive (EU) 2022/2555 (NIS2)
- European Commission — Referral to the Court of Justice over CER transposition (IP/26/910, 29.04.2026)
- Nationaal Crisiscentrum — Wet betreffende de weerbaarheid van kritieke entiteiten (BS 19.01.2026)
- Nationaal Crisiscentrum — Nieuwe wet betreffende de weerbaarheid van kritieke entiteiten aangenomen
- Nationaal Crisiscentrum — FAQ CER
- Staatsblad 2026, 188 — Wet weerbaarheid kritieke entiteiten
- Staatsblad 2026, 190 — Besluit weerbaarheid kritieke entiteiten
- Rijksoverheid — Cyberbeveiligingswet en Wwke vanaf 15 augustus 2026 van kracht (07.07.2026)
- BGBl. 2026 I Nr. 66 — KRITIS-Dachgesetz (16.03.2026)
- CMS — KRITIS-Verordnung: was Betreiber kritischer Anlagen jetzt wissen müssen (16.06.2026)
- Assemblée nationale — Projet de loi relatif à la résilience des infrastructures critiques
- SGDSN — Protéger les activités d’importance vitale
- BKA — Zeugenaufruf nach Brandanschlag in Berlin (27.01.2026)
- AIVD — Jaarverslag 2025: Rusland
- VSSE — Inlichtingenrapport 2025 (15.01.2026)
General information, not legal advice. Status as of 2 October 2026.