The European Union’s Critical Entities Resilience Directive (Directive (EU) 2022/2557) is past its legal “paper deadlines” and is now in the messy delivery phase. The directive is in force, but implementation is uneven across Member States. Some have enacted dedicated CER laws and are building supervisory capacity. Others have not even notified transposition measures. The result is fragmented readiness right when the timetable starts to bite.
Transposition into national law was due 17 October 2024.
National resilience strategy was due 17 January 2026.
Member State risk assessment was due 17 January 2026.
Identification of critical entities must happen by 17 July 2026.
After identification, the operational obligations switch on fast:
So February 2026 is the pivot point. Strategies and national risk assessments are already due, and the July 2026 designation deadline is close enough that slow movers are now in schedule debt.
The cleanest EU-wide signal is the EUR-Lex register of national transposition measures (NIM) for Directive 2022/2557. It is updated weekly and shows what Member States have formally communicated as transposition.
As of early February 2026, the NIM register still shows zero notified measures for several major Member States. Examples visible in the register include:
That does not prove “nothing is happening” domestically. It does prove that, from an EU compliance and enforcement perspective, notification is still not complete in a non-trivial set of countries.
At the other end, several Member States have clearly moved to formal adoption. Concrete examples:
Bottom line: the EU is operating in a two-speed model. A first group is already building operating models, competent authorities, and supervisory tooling. A second group is still closing the legal gap, and that gap now collides with the January 2026 strategy and risk assessment deliverables.
The European Commission has already used infringement steps to pressure non-notification of CER transposition measures after the October 2024 deadline. Public reporting on the November 2024 infringement package states that the Commission opened procedures by sending letters of formal notice for failure to notify CER transposition.
This matters operationally because late legal adoption usually implies late governance setup. Without competent authorities, a single point of contact, inspection powers, and enforcement processes, “implementation” becomes a slide deck, not a control regime.
Even in countries that have transposed, the hard part is execution. CER implementation is not a single project. It is a national operating model with recurring cycles. By design, it links policy, risk, supervision, and cross-border cooperation.
By February 2026, mature Member States are typically doing five things in parallel:
The Commission has also supported implementation by defining an EU list of essential services that Member States can use in risk assessments and identification work.
Across the EU, the same blockers keep showing up:
Between now and 17 July 2026, the key output is the designation of critical entities per sector. Once entities are notified, the compliance clock starts:
This means late designation compresses the window for real controls. If a country designates late in 2026, many entities will be implementing into 2027 under time pressure. That is where audit quality drops and “checkbox resilience” appears.
If you run an essential service in the EU, do not wait for your country to finish its legislative process.
Bottom line: CER is not delayed everywhere, but EU-wide implementation is not synchronized. February 2026 is the moment where legal transposition gaps start turning into operational risk, because the strategy and risk assessment milestones are already due and the July 2026 designation deadline is approaching fast.