--- title: "Accountability and Legal Liability Under the CER Directive: What Critical Entities Must Prepare For" description: "Part 3 of our CER series: the accountability and legal liability rules the CER Directive imposes on critical entities, and how to prepare." image: https://key2xs.com/hubfs/Part%203.jpg --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=nl) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl) [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl) Industries [Government](https://key2xs.com/sectors/government?hsLang=nl) [Utilities](https://key2xs.com/sectors/utilities?hsLang=nl) [Water management](https://key2xs.com/sectors/water-management?hsLang=nl) [Transport](https://key2xs.com/sectors/transport?hsLang=nl) [Telecom](https://key2xs.com/sectors/telecom?hsLang=nl) Platform [Product](https://key2xs.com/products?hsLang=nl) [How it works](https://key2xs.com/?hsLang=nl#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=nl) [One Identity](https://key2xs.com/partners/one-identity?hsLang=nl) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=nl) [Okta](https://key2xs.com/partners/okta?hsLang=nl) [OpenText](https://key2xs.com/partners/opentext?hsLang=nl) [iLOQ](https://key2xs.com/partners/iloq?hsLang=nl) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=nl) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=nl) Resources [Resource center](https://key2xs.com/resources?hsLang=nl) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl) [Events](https://key2xs.com/events?hsLang=nl) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=nl) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=nl) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl) [FAQ](https://key2xs.com/?hsLang=nl#faq) [News](https://key2xs.com/news-archive?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) [← The Key2XS journal](https://key2xs.com/news-archive?hsLang=nl) ASSA Abloy Cliq # Accountability and Legal Liability Under the CER Directive: What Critical Entities Must Prepare For May 28, 2025 · 4 min read · by the Key2XS team ![Accountability and Legal Liability Under the CER Directive: What Critical Entities Must Prepare For](https://key2xs.com/hubfs/Part%203.jpg) **In short:** The [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) makes critical entities legally accountable for resilience, up to and including management liability. Preparing means demonstrable risk assessments, resilience measures and incident reporting — with physical access control among the obligations auditors will test. ## **Accountability and Legal Liability Under the CER Directive: What Critical Entities Must Prepare For (Part 3 of our CER Series)** The **Critical Entities Resilience (CER) Directive**, adopted by the European Union in 2022, introduces a powerful legal and operational framework to safeguard Europe’s essential services. From energy and water to transport and digital infrastructure, operators deemed “critical” now face **a heightened level of accountability** — not only in operational terms but also in legal exposure. As the directive is transposed into national legislation across EU member states, organizations must understand the **new liabilities** it imposes on executives, board members, and operational leaders. Compliance is no longer a technical checkbox; it is a **matter of legal responsibility**.   ---   ### **1. A Shift from Voluntary to Enforceable Resilience Obligations** Prior to the CER Directive, many resilience activities — such as risk assessments or continuity planning — were considered best practices rather than enforceable requirements. The CER changes this by introducing **mandatory risk management measures** tailored to each critical entity’s threat landscape. Failure to implement these measures, or to report disruptions and incidents as required, may now lead to **administrative penalties, civil liability, or even criminal sanctions**, depending on national transposition.   ---   ### **2. Management Accountability: The Personal Risk for Executives** The directive emphasizes that responsibility for compliance lies at the **top level of management**: - **Named Accountability**: Executives must formally designate a **responsible officer** for resilience and security, and ensure regular reporting to national authorities. - **Personal Consequences**: In case of non-compliance, negligence, or failure to act on known risks, individual board members and directors may be **held personally liable**, particularly if harm to the public, the economy, or national security can be traced to organizational failure. - **Duty of Care Expansion**: The CER effectively expands the traditional “duty of care” to include threats such as cyberattacks, insider sabotage, and even climate-related disruptions — all of which must now be addressed in internal controls.   ---   ### **3. Legal Exposure from Supply Chains and Outsourcing** The CER Directive requires entities to assess and mitigate risks **not just internally**, but across their **entire value chain**, including contractors, third-party suppliers, and service providers. - **Shared Liability**: If a critical disruption stems from a third-party supplier, the critical entity may still be **held liable** for failing to ensure proper controls, oversight, and continuity provisions were in place. - **Due Diligence Obligations**: Entities must actively **audit and monitor** their suppliers’ compliance with CER-related policies — failure to do so may result in **joint or vicarious liability**.   ---   ### **4. Reporting Requirements and Legal Consequences of Non-Disclosure** Entities must report any incident that significantly disrupts critical operations within strict timelines. These obligations resemble those under GDPR, and failure to report can lead to: - **Fines and Administrative Sanctions** - **Civil Liability** if customers or citizens suffer harm - **Reputational Damage**, which can affect licensing, investor confidence, and public trust   ---   ### **5. Strengthening Legal Readiness: What Organizations Must Do** To avoid legal pitfalls and demonstrate compliance: - **Update Governance Frameworks**: Assign formal CER roles and reporting lines. - **Conduct Legal Risk Assessments**: Map out exposure under national and EU law. - **Establish Compliance Audits**: Ensure technical and procedural CER measures are documented and verifiable. - **Review Contracts and SLAs**: Incorporate CER obligations into supplier agreements and ensure clear liability clauses are included. - **Train Executives and Supervisory Boards**: Legal awareness is now a top-level priority.   ---   ### **Conclusion** The CER Directive is a wake-up call for Europe’s critical sectors: **resilience is now a legal obligation**, not a recommendation. Organizations must act swiftly to close governance gaps, upgrade their legal preparedness, and embed accountability into their core strategy. In the age of hybrid threats and systemic interdependencies, resilience isn’t just operational — it’s a matter of legal survival. ![](https://key2xs.com/hubfs/1587550138006.jpeg)![](https://key2xs.com/hubfs/img/niels-bakker.png)![](https://key2xs.com/hubfs/1746630921693.jpeg)![](https://key2xs.com/hubfs/1696359051569.jpeg) **Written by the Key2XS team** Key2XS is founder-run. Questions about this piece land with the people who built the platform. [Talk to us](https://key2xs.com/contact?hsLang=nl). ## Keep reading [![](https://key2xs.com/hubfs/Part%202.jpg) **Adapting to the CER Directive: Organizational Changes in Facility Management and ICT**May 27, 2025](https://key2xs.com/news/adapting-to-the-cer-directive-organizational-changes-in-facility-management-and-ict?hsLang=nl) [![](https://key2xs.com/hubfs/Part%204.jpg) **Legal Accountability in the Energy Sector Under the CER Directive: A New Era of Responsibility**Jun 02, 2025](https://key2xs.com/news/legal-accountability-in-the-energy-sector-under-the-cer-directive-a-new-era-of-responsibility?hsLang=nl) [![](https://key2xs.com/hubfs/Part%2010.jpg) **Building Resilience: What Every Critical Entity Needs to Know About the CER Directive**Jun 11, 2025](https://key2xs.com/news/building-resilience-what-every-critical-entity-needs-to-know-about-the-cer-directive?hsLang=nl) ## Govern the keys you already have See identity, policy and physical keys in one 30-minute demo, scoped to your estate. [Book a demo](https://key2xs.com/contact?hsLang=nl) [More in the journal](https://key2xs.com/news-archive?hsLang=nl) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl) - [Product](https://key2xs.com/products?hsLang=nl) - [Integrations](https://key2xs.com/integrations?hsLang=nl) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=nl) - [Resource center](https://key2xs.com/resources?hsLang=nl) - [Events](https://key2xs.com/events?hsLang=nl) - [News](https://key2xs.com/news-archive?hsLang=nl) - [Contact](https://key2xs.com/contact?hsLang=nl) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=nl) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=nl) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Key2XS", "url" : "https://key2xs.com/news/author/key2xs-2" }, "dateModified" : "2025-09-16T07:44:52.726Z", "datePublished" : "2025-05-28T07:00:00.000Z", "headline" : "Accountability and Legal Liability Under the CER Directive: What Critical Entities Must Prepare For", "image" : [ "https://key2xs.com/hubfs/Part%203.jpg" ], "mainEntityOfPage" : { "@id" : "https://key2xs.com/news/accountability-and-legal-liability-under-the-cer-directive-what-critical-entities-must-prepare-for", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://key2xs.com/hubfs/logo%20blue.svg" }, "name" : "Key2XS B.V." } } ```