PURPOSE: to ensure that services essential for the maintenance of vital societal functions or economic activities are provided in an unobstructed manner in the internal market and to enhance the resilience of critical entities providing such services.

LEGISLATIVE ACT: Directive (EU) 2022/2557 of the European Parliament and of the Council on the resilience of critical entities and repealing Council Directive 2008/114/EC.

CONTENT: critical entities are entities providing essential services that are crucial for the maintenance of vital societal functions, economic activities, public health and safety, and the environment. They need to be able to prevent, protect against, respond to, cope with and recover from hybrid attacks, natural disasters, terrorist threats and public health emergencies.

This Directive:

- lays down obligations on Member States to take specific measures aimed at ensuring that services which are essential for the maintenance of vital societal functions or economic activities are provided in an unobstructed manner in the internal market, in particular obligations to identify critical entities and to support critical entities in meeting the obligations imposed on them;

- lays down obligations for critical entities aimed at enhancing their resilience and ability to provide essential services in the internal market;

- establishes rules: (i) on the supervision of critical entities; (ii) on enforcement; (iii) for the identification of critical entities of particular European significance and on advisory missions to assess the measures that such entities have put in place to meet their obligations;

- lays down measures with a view to achieving a high level of resilience of critical entities in order to ensure the provision of essential services within the Union and to improve the functioning of the internal market.

Scope

The new legislation strengthens the requirements for conducting risk assessment and reporting of actors considered critical. It covers 11 sectors , namely energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space and food (food production, processing and distribution).

This Directive is without prejudice to the Member States’ responsibility for safeguarding national security and defence and their power to safeguard other essential State functions, including ensuring the territorial integrity of the State and maintaining law and order.

The Directive does not prevent Member States from adopting or maintaining provisions in national law to achieve a higher level of resilience of critical entities.

National strategies

Each Member State will adopt by 17 January 2026 a strategy for enhancing the resilience of critical entities. The Commission is empowered to adopt a delegated act, by 17 November 2023 to supplement this Directive by establishing a non-exhaustive list of essential services in the sectors and subsectors set out in the Annex. The competent authorities shall use that list of essential services for the purpose of carrying out a risk assessment by 17 January 2026, whenever necessary subsequently, and at least every four years.

Single point of contact

In order to facilitate cross-border cooperation and communication and to enable the effective implementation of this Directive, each Member State will designate one single point of contact responsible for coordinating issues related to the resilience of critical entities and cross-border cooperation at Union level, where relevant within a competent authority.

Identification of critical entities

The Directive also establishes rules for the identification of critical entities of particular European significance. A critical entity is considered of particular European significance if it provides an essential service to six or more Member States . In this case, the Commission may be requested by the Member States to organise an advisory mission or the Commission may itself propose, with the agreement of the member state concerned, to assess the measures the entity concerned has put in place to meet the obligations arising from the directive.

Resilience measures for critical entities

Critical entities shall identify relevant risks that could significantly disrupt the provision of essential services, take appropriate measures to ensure their resilience and notify disruptive incidents to the relevant authorities. Unless they are unable to do so for operational reasons, critical entities shall submit an initial notification within 24 hours of becoming aware of an incident, followed, where appropriate, by a detailed report within one month.

Where an incident has or could have a significant impact on the continued provision of essential services to or in six or more Member States, the competent authorities of the Member States affected by the incident will notify the incident to the Commission.

Member States will have to inform the public when they consider that it would be in the public interest to do so.

Critical Entities Resilience Group

The Critical Entities Resilience Group will support the Commission and facilitate cooperation among Member States and the exchange of information on issues relating to this Directive. Where requested by the European Parliament, the Commission may invite experts from the European Parliament to attend meetings of the Critical Entities Resilience Group.

ENTRY INTO FORCE: 16.1.2023

TRANSPOSITION: no later than 17.10.2024. The provisions will apply from 18.10.2024.

The European Parliament adopted by 595 votes to 17, with 24 abstentions, a legislative resolution on the proposal for a directive of the European Parliament and of the Council on the resilience of critical entities.

The European Parliament’s position at first reading under the ordinary legislative procedure amends the Commission proposal as follows:

Subject matter

This Directive sets out a Union framework with the aim of both enhancing the resilience of critical entities in the internal market by laying down harmonised minimum rules and assisting them by means of coherent and dedicated support and supervision measures.

This Directive:

- lays down obligations on Member States to take specific measures aimed at ensuring that services which are essential for the maintenance of vital societal functions or economic activities are provided in an unobstructed manner in the internal market, in particular obligations to identify critical entities and to support critical entities in meeting the obligations imposed on them;

- establishes common procedures for cooperation and reporting on the application of this Directive;

- lays down measures with a view to achieving a high level of resilience of critical entities in order to ensure the provision of essential services within the Union and to improve the functioning of the internal market.

The new rules will harmonise the definition of critical infrastructure, so that it is consistent between the Member States.

Scope

Covering eleven sectors : energy, transport, banking, financial market infrastructure, digital infrastructure, drinking and waste water, food (including production, processing and delivery), health, public administration and space, the legislation tightens the requirements for risk assessments and reporting for actors considered critical.

This Directive is without prejudice to the Member States’ responsibility for safeguarding national security and defence and their power to safeguard other essential State functions, including ensuring the territorial integrity of the State and maintaining law and order.

The obligations laid down in this Directive will not entail the supply of information the disclosure of which would be contrary to the essential interests of Member States’ national security, public security or defence.

Strategy on the resilience of critical entities

Following a consultation that is, to the extent practically possible, open to relevant stakeholders, each Member State will adopt by three years from the date of entry into force of this Directive, a strategy for enhancing the resilience of critical entities.

Member States' risk assessments will take into account relevant natural and man-made risks, including those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid or other antagonistic threats, which include terrorist offences.

No later than three years and six months from the date of entry into force of the Directive, each Member State will identify the critical entities for the sectors covered.

Single point of contact

Each Member State will designate one or more competent authorities responsible for ensuring the correct application of the rules set out in the Directive at national level. It will also have to designate a single contact point to act as a liaison point for cross-border cooperation with the single contact points of other Member States and with the Critical Entity Resilience Group. A Member State may provide that its single point of contact also liaises with the Commission and ensures cooperation with third countries.

Resilience measures for critical entities

Member States will ensure that critical entities take appropriate and proportionate technical, security and organisational measures to ensure their resilience, based on the relevant information provided by Member States on the Member State risk assessment and the outcome of the critical entity risk assessment.

Incident notifications

Member States will ensure that critical entities notify the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services. Member States will ensure that, unless operationally unable to do so, critical entities submit an initial notification no later than 24 hours after becoming aware of an incident , followed, where relevant, by a detailed report no later than one month thereafter.

In order to determine the significance of a disruption, the following parameters should, in particular, be taken into account: (a) the number and proportion of users affected by the disruption; (b) the duration of the disruption; (c) the geographical area affected by the disruption, taking into account whether the area is geographically isolated.

Where an incident has or might have a significant impact on the continuity of the provision of essential services to or in six or more Member States , the competent authorities of the Member States affected by the incident will notify the Commission of that incident. Member States will inform the public where they determine that it would be in the public interest to do so.

Critical Entities Resilience Group

The Critical Entities Resilience Group will support the Commission and facilitate cooperation among Member States and the exchange of information on issues relating to this Directive. Where requested by the European Parliament, the Commission may invite experts from the European Parliament to attend meetings of the Critical Entities Resilience Group.

The Committee on Civil Liberties, Justice and Home Affairs adopted the report by Michal ŠIMEČKA (Renew Europe, SK) on the proposal for a directive of the European Parliament and of the Council on the resilience of critical entities.

The proposed Directive aims to enhance the provision in the internal market of services essential for the maintenance of vital societal functions or economic activities by increasing the resilience of critical entities providing such services. This report seeks to enhance certain aspects of the proposed Directive.

The committee responsible recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the proposal as follows:

Definitions

Members proposed to extend the definition of essential services, so that protecting the environment, public health and safety, and the rule of law are also mentioned.

Risk assessment by Member States

With a view to enhancing cooperation between competent authorities of the Member States, Members proposed setting up single points of contact to exercise a liaison function and coordination with the critical entities with competent authorities and with the Critical Entities Resilience Group. The single point of contact should also simplify and harmonise reporting channels (one-stop-shop principle).

Identification of critical entities

The Commission should, in cooperation with the Member States, develop recommendations and guidelines to support Member States in identifying critical entities.

Member States’ support to critical entities

Members proposed that Member States should support critical entities in enhancing their resilience. That support should include developing guidance materials and methodologies, supporting the organisation of exercises to test their resilience and providing training to personnel of critical entities. Member States may provide financial resources to critical entities, without prejudice to applicable rules on State aid, where necessary and justified by public interest objectives.

Critical Entities Resilience Group

The Critical Entities Resilience Group should be composed of representatives of the Member States and the Commission. Where relevant for the performance of its tasks, the Critical Entities Resilience Group should invite representatives of relevant stakeholders to participate in its work and the European Parliament to participate as an observer .

The Group should, inter alia : (i) prepare a Union strategy on resilience in compliance with the objectives set out in this Directive; (ii) promote and support coordinated risk assessments and joint actions among critical entities.

Notification of incidents

Critical entities should notify, as soon as reasonably possible under the given circumstances and, in any event, no later than 24 hours after becoming aware of the incident in question, Member States’ competent authorities of any incident that significantly disrupts or has the potential to significantly disrupt their operations. The competent authority should inform the public of such an incident where it determines that it would be in the public interest to do so. The competent authority should ensure that the critical entity concerned inform users of its services that might be affected by such an incident of the incident and, where relevant, of any possible safety measures or remedies.

The Commission and the Critical Entities Resilience Group should treat information provided as part of such notifications in a way that respects its confidentiality and protects the security and commercial interests of the critical entity or entities concerned.

In It is proposed that the Commission should keep a Union registry of incidents with the aim of developing and sharing best practices and methodologies.

Review

The Commission should periodically review the functioning of this Directive, and report to the European Parliament and to the Council. The report should assess the impact and added value of this Directive on ensuring the resilience of critical entities and whether the scope of the Directive should be extended to cover other sectors or subsectors. The first report should be submitted by six years after the entry into force of this Directive and should assess in particular whether the scope of the Directive should be extended. For that purpose, the Commission should take into account relevant documents of the Critical Entities Resilience Group.

PURPOSE: to lay down harmonised minimum rules to ensure the provision of essential services in the internal market and enhance the resilience of critical entities.

PROPOSED ACT: Directive of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: the EU established the European Programme for Critical Infrastructure Protection (EPCIP) in 2006 and adopted the European Critical Infrastructure (ECI) Directive in 2008, which applies to the energy and transport sectors. Both the Commission’s EU Security Union Strategy for 2020-2025 and the recently adopted Counter-Terrorism Agenda for the EU stress the importance of ensuring the resilience of critical infrastructure in the face of physical and digital risks.

The livelihoods of European citizens and the good functioning of the internal market depend on different infrastructures for the reliable provision of services needed to maintain critical societal and economic activities. These services, vital under normal circumstances, are all the more important as Europe manages the effects of and looks towards recovering from the COVID-19 pandemic. It follows that entities providing essential services must be resilient, i.e. able to resist, absorb, accommodate to and recover from incidents that can lead to serious, potentially cross-sectoral and cross-border disruptions.

It is apparent that the current framework on critical infrastructure protection is not sufficient to address the current challenges to critical infrastructures and the entities that operate them. The Commission proposes to fundamentally switch the current approach from protecting specific assets towards reinforcing the resilience of the critical entities that operate them.

CONTENT: this proposal aims to enhance the provision in the internal market of services essential for the maintenance of vital societal functions or economic activities by increasing the resilience of critical entities providing such services.

It reflects recent calls for action on the part of the Council and the European Parliament, both of which have encouraged the Commission to revise the current approach to better reflect the increased challenges to critical entities, and to ensure closer alignment with the Network and Information Systems (NIS) Directive.

The proposed directive:

- extends the scope of the 2008 Directive on European Critical Infrastructure. Ten sectors would now be covered: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration and space;

- lays down obligations for Member States to take certain measures aimed at ensuring the provision in the internal market of services essential for the maintenance of vital societal functions or economic activities, in particular to identify critical entities and entities to be treated as equivalent in certain respects, and to enable them to meet their obligations;

- lays down obligations for Member States to have a strategy for ensuring the resilience of critical entities, carry out a national risk assessment and, on this basis, identify critical entities;

- establishes obligations for critical entities aimed at enhancing their resilience and improving their ability to provide those services in the internal market;

- establishes rules on supervision and enforcement of critical entities, and specific oversight of critical entities considered to be of particular European significance.

Budgetary implications

The total financial resources necessary to support the implementation of this proposal are estimated to be EUR 42.9 million for the period 2021-2027, of which EUR 5.1 million is administrative expenditure. These

costs can be broken down as follows: (i) support activities by the Commission including staffing, projects, studies and support activities; (ii) advisory missions organised by the Commission; (iii) regular meetings of the Critical Entity Resilience Group, Comitology Committee and other meetings.