--- title: "EU CER Directive: Critical Entities, Requirements and Deadlines - Key2XS" description: What the Critical Entities Resilience Directive (EU 2022/2557) requires, the 2026 and 2027 deadlines for newly designated entities, the Dutch Wwke, live transposition status, and how identity governance proves physical resilience. --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=en) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) [CER Directive](https://key2xs.com/cer-directive?hsLang=en) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) Industries [Government](https://key2xs.com/sectors/government?hsLang=en) [Utilities](https://key2xs.com/sectors/utilities?hsLang=en) [Water management](https://key2xs.com/sectors/water-management?hsLang=en) [Transport](https://key2xs.com/sectors/transport?hsLang=en) [Telecom](https://key2xs.com/sectors/telecom?hsLang=en) Platform [Product](https://key2xs.com/products?hsLang=en) [How it works](https://key2xs.com/?hsLang=en#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=en) [One Identity](https://key2xs.com/partners/one-identity?hsLang=en) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=en) [Okta](https://key2xs.com/partners/okta?hsLang=en) [OpenText](https://key2xs.com/partners/opentext?hsLang=en) [iLOQ](https://key2xs.com/partners/iloq?hsLang=en) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=en) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=en) Resources [Resource center](https://key2xs.com/resources?hsLang=en) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=en) [Events](https://key2xs.com/events?hsLang=en) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=en) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=en) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) [FAQ](https://key2xs.com/?hsLang=en#faq) [News](https://key2xs.com/news-archive?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) [Home](https://key2xs.com?hsLang=en) > CER Directive EU Directive (EU) 2022/2557 · In force since 16 January 2023 # EU Critical Entities Resilience Directive (CER) Europe's physical resilience law for the organisations it cannot afford to lose. Member states identified their critical entities by **17 July 2026**; if a designation letter has reached you, your compliance clock is already running. Transposition deadline **17 Oct 2024** Entity designation **17 Jul 2026** NL: Wwke in force **15 Aug 2026** EU transposition: live tracker below [See the live EU tracker](https://key2xs.com/cer-tracker?hsLang=en) [Book a demo](https://key2xs.com/contact?hsLang=en) The CER clock ## Designated in 2026, accountable in 2027 CER runs on a fixed cascade: member states transpose, identify their critical entities, and each notified entity then has nine months to assess its risks and ten before the resilience obligations of Chapter III apply. Today 1. 16 Jan 2023Directive in force across the EU 2. 17 Oct 2024National transposition deadline 3. 17 Jan 2026National resilience strategies and state risk assessments due 4. 17 Jul 2026Member states identify critical entities; designation letters are landing now 5. May / Jun 2027Notified entities: risk assessment due 17 May, resilience obligations apply from 17 Jun Entity deadlines assume notification by 17 August 2026. A later designation letter shifts your dates accordingly: nine months to the risk assessment, ten to the obligations. What it requires ## What a critical entity must be able to prove CER is all-hazards: sabotage, terrorism, insider threats and natural hazards, not just cyber. The obligations centre on demonstrable control of your physical operation. ART. 12 ### Entity risk assessment Within nine months of notification, an all-hazards assessment of the risks that could disrupt your essential services, refreshed at least every four years. ART. 13 ### Resilience measures Prevent, protect, respond, mitigate and recover. Explicitly includes adequate physical protection of premises and infrastructure: perimeter, detection and access controls. ART. 13 & 14 ### Employee security Manage who holds sensitive roles and access, with background checks: identity verification and criminal records for defined categories of personnel. ART. 15 ### Incident notification Notify significant incidents without undue delay and within 24 hours of awareness, including cross-border and cross-sector effects. ART. 21 ### Supervision and enforcement Competent authorities can inspect sites, audit your measures and issue binding orders; national law attaches penalties. ALL-HAZARDS ### The complement to NIS2 CER covers the physical half of resilience; NIS2 covers the cyber half. Most designated critical entities must satisfy both regimes at once. Who is in scope ## Eleven sectors Europe cannot afford to lose Member states designate critical entities per sector on the basis of their national risk assessments. Designation is individual: you are in scope when the letter says so. In the Netherlands roughly 500 organisations are expected to be designated under the Wwke. [Energy↗](https://key2xs.com/sectors/utilities?hsLang=en)[Transport↗](https://key2xs.com/sectors/transport?hsLang=en)Health[Public administration↗](https://key2xs.com/sectors/government?hsLang=en)BankingFinancial market infrastructure[Drinking water↗](https://key2xs.com/sectors/water-management?hsLang=en)[Waste water↗](https://key2xs.com/sectors/water-management?hsLang=en)[Digital infrastructure↗](https://key2xs.com/sectors/telecom?hsLang=en)SpaceFood production & distribution Where the directive meets physical access ## Resilience you can prove, not just claim Fences and cameras protect sites; they do not govern who can open what. Identity-governed physical access turns CER's paper obligations into an operating model with evidence built in. ART. 13 Adequate physical protection of premises and critical infrastructure, including access controls. Every key and access point is bound to an identity and a policy: who may open what, where, in which time window. ART. 13 & 14 Employee security management and background checks for sensitive roles. Sensitive-area access follows verified identity and role, and is revoked the day the role ends, for employees and contractors alike. ART. 12 An all-hazards risk assessment of what could disrupt essential services. A complete, current inventory of physical access: which key opens which door, who holds it, and where the exposure concentrates. ART. 15 Incident notification within 24 hours of awareness. Reconstruct who accessed what, when and on whose approval from one audit trail, within the notification window. ART. 21 On-site inspections and audits by the competent authority. Inspection-ready reporting: certification runs, exception lists and full access history on demand. [See how the platform works →](https://key2xs.com/?hsLang=en#how-it-works) Live from EUR-Lex ## Live: CER transposition across the EU The Critical Entities Resilience Directive (EU 2022/2557) requires every member state to transpose it into national law. We track the implementing measures notified to EUR-Lex in real time, so you always know where each country stands. Loading implementation data... 0 / 27 EU Countries 0 Countries implemented 0% Compliance rate 0 Countries pending - Latest notification [View full tracker](https://key2xs.com/cer-tracker?hsLang=en) [View source data on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/NIM/?uri=oj:JOL_2022_333_R_0004) In the Netherlands ## Wet weerbaarheid kritieke entiteiten (Wwke) The Netherlands transposed CER through the Wet weerbaarheid kritieke entiteiten, approved by the Senate on 7 July 2026 and in force since 15 August 2026, together with the implementing decree Besluit weerbaarheid kritieke entiteiten. Sector ministries now designate critical entities; each notified organisation gets nine months for its risk assessment and ten before the resilience obligations apply. In force 15 August 2026 Expected designations ± 500 organisations Implementing decree Stb. 2026, 190 Coordination NCTV and sector ministries [Rijksoverheid](https://www.rijksoverheid.nl/actueel/nieuws/2026/07/07/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-15-augustus-2026-van-kracht)[Eerste Kamer dossier 36.765](https://www.eerstekamer.nl/wetsvoorstel/36765_wet_weerbaarheid_kritieke) The other half ### The cyber half of your obligations is NIS2. Most designated critical entities are also essential entities under NIS2, and its access-control and reporting duties apply on top of CER. [Explore the NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) Keep reading ## Latest on CER [All coverage →](https://key2xs.com/news-archive?hsLang=en) ### [ComplianceJun 2026 CER Implementation in the EU: From Legal Deadline to Operational Reality Read article](https://key2xs.com/news/news-cer-implementation-in-the-eu-from-legal-deadline-to-operational-reality-juni-1-2026?hsLang=en) ### [ComplianceFeb 2026 CER Compliance Calendar for Newly Appointed Critical Entities Read article](https://key2xs.com/news/cer-compliance-calendar-for-newly-appointed-critical-entities?hsLang=en) ### [Insight2026 Impact of CER on the Transition from Mechanical to Electronic Locks Read article](https://key2xs.com/news/impact-of-cer-on-the-transition-from-mechanical-to-electronic-locks?hsLang=en) ## Designated? Start the clock with evidence in hand Nine months to a risk assessment, ten to demonstrable resilience. See how identity-governed physical access gets a critical entity inspection-ready, and what it saves along the way. [Book a demo](https://key2xs.com/contact?hsLang=en) [Build your business case](https://key2xs.com/roi-calculator?hsLang=en) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=en) - [Product](https://key2xs.com/products?hsLang=en) - [Integrations](https://key2xs.com/integrations?hsLang=en) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=en) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=en) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=en) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=en) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=en) - [Resource center](https://key2xs.com/resources?hsLang=en) - [Events](https://key2xs.com/events?hsLang=en) - [News](https://key2xs.com/news-archive?hsLang=en) - [Contact](https://key2xs.com/contact?hsLang=en) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=en) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=en) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V.