CER Directive compliance

The Critical Entities Resilience Directive applies to providers of essential services that their country identifies as critical entities, in energy, transport, health, drinking and waste water, public administration, space and food. Countries name them by 17 July 2026, and the duties apply ten months after an entity is told. Every critical entity is also an essential entity under NIS2.

  • EU Critical Entities Resilience Directive (CER)
  • 2022/2557
  • Requirements in the catalogue: 26
  • Official text

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Art. 6

    Your country identifies you as a critical entity and tells you which essential services are covered; the duties apply ten months later.

  • Art. 12

    Assess all natural and man-made risks to your essential services, and your dependencies, within nine months of being told and at least every four years.

  • Art. 13(1)

    Take measures to prevent incidents, protect premises physically, respond, recover, manage staff security and raise awareness.

  • Art. 13(2)–(3)

    Describe the measures in a resilience plan, and designate a liaison officer for the authorities.

  • Art. 14

    Where your country allows it, request background checks on people in sensitive roles.

  • Art. 15

    Notify the competent authority of a significant disruption within 24 hours, and send a detailed report within one month.

  • Art. 21

    Allow inspections and audits, provide evidence on request and remedy what the authority orders.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The catalogue's requirements with their article references, linked to your policies, controls and evidence.

  • The risk register for the all-hazards risk assessment, with owners, treatment plans and reviews.

  • Crosswalks from ISO 27001 and from NIS2, so physical security, continuity, people and incident work already done counts.

  • The risk assessment, the resilience plan review and a resilience exercise as recurring activities in the governance calendar, with owners and reminders.

  • Fasttrack asks whether your authority has identified you, in the sectors CER covers, and says whether the directive applies, and why.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • 1 Identification and scope3
  • 2 Risk assessment3
  • 3 Resilience measures6
  • 4 Resilience plan and liaison3
  • 5 Background checks1
  • 6 Incident notification4
  • 7 Particular European significance2
  • 8 Supervision and enforcement4

Related frameworks: NIS2 ISO 27001

Common questions

Who decides whether we are a critical entity?

Your country's competent authority, using its national risk assessment and criteria such as the number of users who rely on the service, market share and the area served. It tells each critical entity within a month of identifying it.

We are already under NIS2. What does CER add?

NIS2 covers cybersecurity. CER covers every other hazard to the service as well, from floods and power cuts to sabotage, with physical protection, staff security and its own incident notice. Work done for NIS2 can be reused where it fits, and the crosswalk shows where.

Does CER apply to banks and digital infrastructure?

Banks, financial market infrastructures and digital infrastructure providers can be identified as critical entities, but they have no CER resilience duties unless national law adds them; DORA and NIS2 cover them.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt CER Directive in a free trial, link the evidence you already have and see what is still missing.

Start a free trial