--- title: "CER in Europe: From Infrastructure Protection to Demonstrable Resilience" description: CER implementation status in Europe image: https://key2xs.com/hubfs/key2xs-statement-20261103-1444.png --- [![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=nl) Why Governance? [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl) [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl) Industries [Government](https://key2xs.com/sectors/government?hsLang=nl) [Utilities](https://key2xs.com/sectors/utilities?hsLang=nl) [Water management](https://key2xs.com/sectors/water-management?hsLang=nl) [Transport](https://key2xs.com/sectors/transport?hsLang=nl) [Telecom](https://key2xs.com/sectors/telecom?hsLang=nl) Platform [Product](https://key2xs.com/products?hsLang=nl) [How it works](https://key2xs.com/?hsLang=nl#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) Partners Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=nl) [One Identity](https://key2xs.com/partners/one-identity?hsLang=nl) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=nl) [Okta](https://key2xs.com/partners/okta?hsLang=nl) [OpenText](https://key2xs.com/partners/opentext?hsLang=nl) [iLOQ](https://key2xs.com/partners/iloq?hsLang=nl) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=nl) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=nl) Resources [Resource center](https://key2xs.com/resources?hsLang=nl) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl) [Events](https://key2xs.com/events?hsLang=nl) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=nl) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=nl) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl) [FAQ](https://key2xs.com/?hsLang=nl#faq) [News](https://key2xs.com/news-archive?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl) [← The Key2XS journal](https://key2xs.com/news-archive?hsLang=nl) Compliance # CER in Europe: From Infrastructure Protection to Demonstrable Resilience Nov 03, 2026 · 10 min read · by the Key2XS team ![CER Status](https://key2xs.com/hubfs/key2xs-statement-20261103-1444.png) ## What the implementation of the Critical Entities Resilience Directive actually changes for Europe's critical infrastructure. Europe has introduced a new regulatory framework for the resilience of organisations delivering essential services. The Critical Entities Resilience Directive (CER), officially Directive (EU) 2022/2557, requires EU Member States to identify critical entities and establish a framework for risk assessment, protection, incident response and recovery. The significance of this development extends beyond physical security. While previous European legislation primarily focused on identifying and protecting specific categories of critical infrastructure, CER explicitly addresses the continuity of the essential services that depend on that infrastructure. However, the relevant question is what the implementation of CER actually changes. Which obligations are now legally established? How far has Europe progressed with implementation? And what conclusions can be drawn from the available evidence about Europe's resilience? ## A Documented Need for a Broader Approach European infrastructure faces a wide range of risks. CER therefore addresses not only deliberate attacks, including sabotage, terrorism and insider threats, but also natural disasters, accidents, public health emergencies and other events capable of disrupting essential services. *The economic consequences of natural hazards are well documented.* According to figures published by the European Environment Agency (EEA) in 2025, weather- and climate-related extreme events caused approximately €822 billion in economic losses across the European Union between 1980 and 2024, expressed in 2024 prices. More than €208 billion of those losses occurred between 2021 and 2024. These figures represent total economic losses from weather- and climate-related events, rather than losses specifically attributable to critical infrastructure. The European Commission also identifies sabotage, terrorist threats, criminal infiltration and hybrid threats as relevant risks affecting critical entities. These different categories of risk explain why CER adopts an *all-hazards approach*. Organisations must consider all relevant threats capable of disrupting their essential services, regardless of their origin. ## From Infrastructure Protection to Essential Service Continuity The previous European Directive 2008/114/EC focused on identifying and protecting European critical infrastructure in the energy and transport sectors. CER replaces that directive and expands the European framework to eleven sectors: Energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and food production, processing and distribution. This creates a broader regulatory framework in which the protection of individual facilities is no longer the sole consideration. The ability of organisations to maintain essential services also becomes a central regulatory objective. CER requires Member States to carry out national risk assessments and identify critical entities. Those entities must subsequently assess their own risks and implement appropriate and proportionate measures, subject to the provisions applicable to their sector. Article 13 distinguishes between measures for prevention, physical protection, response, mitigation of consequences, recovery and personnel security. Resilience is therefore not limited to preventing incidents. The ability to maintain essential functions during disruption and restore services afterwards is explicitly included in the legal framework. There is, however, an important legal distinction. Under Article 8, critical entities in the banking, financial market infrastructure and digital infrastructure sectors are exempt from certain CER obligations, including Chapter III. Other European regulatory frameworks, including DORA and NIS2, apply to these sectors. It would therefore be incorrect to suggest that all eleven sectors are subject to exactly the same operational requirements under CER. ## Implementation Across Europe Remains Uneven The CER Directive entered into force on 16 January 2023. Member States were required to adopt and publish the necessary national legislation by 17 October 2024. Two further milestones followed: - By 17 January 2026, Member States were required to establish their national resilience strategies and conduct their first national risk assessments. - By 17 July 2026, they were required to identify critical entities. However, national implementation has experienced delays. On 29 April 2026, the European Commission decided to refer seven Member States to the Court of Justice of the European Union for failing to transpose the CER Directive. These countries were Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain and Sweden. An independent review of national legislation published by Cybersecurity Database on 29 October 2026 reported that 23 of the 27 EU Member States had brought national transposition legislation into force. According to that assessment, Bulgaria, France, Spain and Sweden had not yet brought the relevant transposition legislation into force. This assessment concerns national legislation. It is not an official European evaluation of full compliance. In the Netherlands, the Critical Entities Resilience Act (*Wet weerbaarheid kritieke entiteiten*, Wwke) entered into force on 15 August 2026. According to the Dutch government, the legislation concerns approximately 500 organisations. The relevant obligations apply to organisations once they have been formally designated as critical entities. These developments demonstrate that the European legal framework has now been implemented across much of the Union. They do not, however, demonstrate that all affected organisations have completed their risk assessments, implemented the required measures or achieved measurable improvements in operational resilience. ## Physical Access Becomes an Explicit Component of Resilience One concrete aspect of CER concerns the protection of buildings, facilities and other critical infrastructure against unauthorised physical access. Article 13 explicitly identifies access controls as an example of measures that organisations can implement to ensure adequate physical protection. The European Commission elaborated on this provision in its non-binding guidelines adopted on 10 July 2026 and published on 13 July 2026. These guidelines address security zones, access logging, management of physical keys and electronic access credentials, periodic reviews of authorisations, and the immediate revocation of lost or stolen credentials. Particularly relevant is the recommendation to maintain a single authoritative register of physical keys and electronic access credentials, including issuance, revocation and return dates. The Commission also recommends assigning access rights according to the *principle of least privilege* and reviewing those rights when an individual's role or responsibilities change. This establishes a clear relationship between organisational responsibility, identity and physical access. For critical entities, physical access management can consequently be treated as part of broader risk management and resilience accountability, rather than solely as an operational security function. An important distinction must nevertheless be maintained. CER does not mandate electronic locking systems, prescribe a particular software architecture or require integration between Identity and Access Management (IAM) systems and physical access control platforms. The legally binding obligation concerns appropriate and proportionate measures based on the organisation's risks. The Commission's guidelines provide examples of how these measures may be implemented, but are not themselves legally binding. ## Dependencies Between European Infrastructure Sectors Receive Formal Recognition Another significant development is CER's explicit recognition of dependencies between sectors and across national borders. Electricity networks, for example, depend on communications infrastructure and operational support services. Drinking water operators rely on electricity and technical systems. Transport services depend on multiple forms of infrastructure and supporting services. CER requires critical entities to consider relevant dependencies on other essential services in their risk assessments, including cross-border dependencies where applicable. This matters because disruptions do not necessarily remain confined to a single facility, organisation or sector. CER also introduces a specific regime for critical entities of particular European significance. This regime applies to qualifying entities providing the same or similar essential services in or to six or more Member States. In addition, on 25 June 2024, the Council of the European Union adopted a recommendation establishing an EU blueprint for coordinating responses to significant cross-border disruptions of critical infrastructure. The *EU Critical Infrastructure Blueprint* addresses information sharing, shared situational awareness, crisis communication and coordination between Member States and European institutions. The existence of these mechanisms is documented. Their effectiveness during future large-scale incidents, however, cannot be established simply from the adoption of legislation and coordination procedures. ## From Policy to Demonstrable Implementation The operational implications of CER become particularly relevant once organisations have been formally designated as critical entities. The Directive requires designated entities to conduct their own risk assessment within nine months of receiving notification. The required appropriate and proportionate resilience measures must be implemented within ten months, subject to the applicable national legal framework. CER also establishes incident notification obligations for events that significantly disrupt, or have the potential to significantly disrupt, essential services. As a general rule, an initial notification must be submitted no later than 24 hours after becoming aware of the incident, unless the entity is operationally unable to do so. In the Netherlands, these obligations are incorporated into the Wwke. This creates a legal basis for assessing implementation. Competent supervisory authorities may request information and conduct inspections to verify compliance with the applicable requirements. For organisations, the practical consequence is an increased emphasis on demonstrating the effectiveness and implementation of risk assessments, security measures, assigned responsibilities, incident procedures and recovery arrangements. This does not mean that CER introduces a single European resilience certification or a uniform security standard for every critical facility. Measures must remain proportionate to the relevant risks and the essential services provided. ## What Do We Actually Know About the Impact on European Resilience? CER has changed the legal and organisational conditions governing resilience in Europe. That is an established fact. The scope of the European framework has expanded. National authorities are required to identify critical entities and assess risks. Designated organisations are subject to defined obligations and must implement relevant measures to strengthen their resilience. Cross-border cooperation and regulatory oversight have also been formally established. However, the actual effects on incident frequency, disruption duration, economic losses and recovery times have not yet been demonstrated at European level. There are currently insufficient comparable, publicly available European results to establish how many incidents CER has prevented, how much faster critical services have recovered or how much economic damage has been avoided as a direct consequence of its implementation. This is partly explained by the phased implementation process and the relatively recent entry into force of national legislation. The Directive itself provides for future evaluations. By 17 July 2027, the European Commission must report on the measures Member States have taken to comply with the Directive. The first evaluation of CER's operation and added value, including its impact on the resilience of critical entities, must be published by 17 June 2029. Reliable implementation data, operational performance indicators and comparable outcomes will be necessary before specific improvements can be attributed, fully or partially, to CER. ## Conclusion: A Legal Framework Is Not Yet Proven Resilience The implementation of CER represents a documented change in Europe's approach to protecting critical infrastructure. The protection of individual buildings, facilities and systems is no longer the sole focus. The continuity of essential services, the management of interdependencies, and the ability to respond to and recover from disruptions have acquired an explicit place in European legislation. Together with NIS2 and existing sector-specific regulations, CER provides a framework in which cybersecurity, physical protection and organisational resilience can be assessed together, while respecting their different legal scopes. But legislation alone does not prevent sabotage, natural disasters or operational incidents. That requires security and resilience measures that are actually implemented, maintained, tested and demonstrably effective. What CER has already changed is the legal framework for accountability, risk assessment, protection and supervision. Whether it will deliver fewer disruptions, shorter recovery times and greater operational resilience across Europe remains to be demonstrated through measurable results. Distinguishing between regulatory implementation and proven operational outcomes is essential to any credible assessment of Europe's resilience.   ## Sources and Verification 1. **European Union, Directive (EU) 2022/2557 on the Resilience of Critical Entities.** The primary legal source, including Articles 6, 8, 12, 13, 15, 17 and 25. [https://eur-lex.europa.eu/eli/dir/2022/2557/oj/eng](https://eur-lex.europa.eu/eli/dir/2022/2557/oj/eng) 2. **European Commission, Critical Infrastructure Resilience at EU Level.** Official explanation of the Directive's scope, objectives and implementation milestones. [https://home-affairs.ec.europa.eu/policies/internal-security/counter-terrorism-and-radicalisation/protection/critical-infrastructure-resilience-eu-level\_en](https://home-affairs.ec.europa.eu/policies/internal-security/counter-terrorism-and-radicalisation/protection/critical-infrastructure-resilience-eu-level_en) 3. **European Commission, Guidelines on Resilience Measures, July 2026.** Non-binding guidance, particularly paragraphs 24 to 39 concerning physical protection and access management. [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX%3A52026XC03712](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX%3A52026XC03712) 4. **European Environment Agency, Economic Losses from Weather- and Climate-related Extremes.** European economic loss data covering 1980 to 2024. [https://www.eea.europa.eu/en/analysis/indicators/economic-losses-from-climate-related/](https://www.eea.europa.eu/en/analysis/indicators/economic-losses-from-climate-related/) 5. **European Commission, April 2026 Infringements Package.** Official announcement of infringement proceedings against seven Member States concerning CER transposition. [https://malta.representation.ec.europa.eu/news/april-infringements-package-key-decisions-2026-04-29\_en](https://malta.representation.ec.europa.eu/news/april-infringements-package-key-decisions-2026-04-29_en) 6. **Government of the Netherlands, Entry into Force of the Wwke, 15 August 2026.** National implementation, scope and obligations. [https://www.rijksoverheid.nl/actueel/nieuws/2026/08/15/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-vandaag-van-kracht](https://www.rijksoverheid.nl/actueel/nieuws/2026/08/15/cyberbeveiligingswet-en-wet-weerbaarheid-kritieke-entiteiten-vanaf-vandaag-van-kracht) 7. **Council of the European Union, EU Critical Infrastructure Blueprint, 25 June 2024.** Cross-border crisis coordination framework. [https://www.consilium.europa.eu/en/press/press-releases/2024/06/25/critical-infrastructure-blueprint-for-protecting-eu-citizens-and-the-internal-market/](https://www.consilium.europa.eu/en/press/press-releases/2024/06/25/critical-infrastructure-blueprint-for-protecting-eu-citizens-and-the-internal-market/) 8. **Cybersecurity Database, CER Transposition Status, 29 October 2026.** Independent inventory of national legislation, not an official European compliance assessment. [https://www.cybersecuritydatabase.org/en/reports/cer-cra/](https://www.cybersecuritydatabase.org/en/reports/cer-cra/) ![](https://key2xs.com/hubfs/1587550138006.jpeg)![](https://key2xs.com/hubfs/img/niels-bakker.png)![](https://key2xs.com/hubfs/1746630921693.jpeg)![](https://key2xs.com/hubfs/1696359051569.jpeg) **Written by the Key2XS team** Key2XS is founder-run. Questions about this piece land with the people who built the platform. [Talk to us](https://key2xs.com/contact?hsLang=nl). ## Keep reading [![](https://key2xs.com/hubfs/key2xs-quote-20260913-1935.png) **Rolling Out Electronic Key Systems Is the Easy Part. Integrating Them Is Not.**Sep 14, 2026](https://key2xs.com/news/rolling-out-electronic-key-systems-is-the-easy-part.-integrating-them-is-not?hsLang=nl) [![](https://key2xs.com/hubfs/256154170_m.png) **The Strategic Importance of NIS2 and CER Reporting and Why Key2XS Makes It Operationally Mandatory**Nov 24, 2025](https://key2xs.com/news/the-strategic-importance-of-nis2-and-cer-reporting-and-why-key2xs-makes-it-operationally-mandatory?hsLang=nl) [![](https://key2xs.com/hubfs/313828979_m.png) **Physical access is generating data. AI turns that data into intelligence.**Jul 27, 2026](https://key2xs.com/news/physical-access-is-generating-data.-ai-turns-that-data-into-intelligence?hsLang=nl) ## Govern the keys you already have See identity, policy and physical keys in one 30-minute demo, scoped to your estate. [Book a demo](https://key2xs.com/contact?hsLang=nl) [More in the journal](https://key2xs.com/news-archive?hsLang=nl) ### Contact us [Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag) Kraanspoor 50, 1033 SE Amsterdam, The Netherlands [info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180) ### Platform - [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl) - [Product](https://key2xs.com/products?hsLang=nl) - [Integrations](https://key2xs.com/integrations?hsLang=nl) - [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl) ### Compliance - [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) - [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl) - [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl) ### Company - [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=nl) - [Resource center](https://key2xs.com/resources?hsLang=nl) - [Events](https://key2xs.com/events?hsLang=nl) - [News](https://key2xs.com/news-archive?hsLang=nl) - [Contact](https://key2xs.com/contact?hsLang=nl) [![ISO/IEC 27001 certified by EIK Certificering](https://key2xs.com/hubfs/img/badges/iso-27001-certified-key2xs.svg)](https://www.eikcertificering.nl/certificatieregister/key2xs-b-v/) [![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=nl) --- ![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) Key2XS, pronounced “key to access” © 2026 Key2XS B.V. All rights reserved [Privacy](https://key2xs.com/privacy-statement?hsLang=nl) Cookie Preferences Patent Pending Nr: 2040721 & 2041284 Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Key2XS", "url" : "https://key2xs.com/news/author/key2xs-2" }, "dateModified" : "2026-11-03T13:47:17.873Z", "datePublished" : "2026-11-03T13:47:17.000Z", "headline" : "CER in Europe: From Infrastructure Protection to Demonstrable Resilience", "image" : [ "https://key2xs.com/hubfs/key2xs-statement-20261103-1444.png" ], "mainEntityOfPage" : { "@id" : "https://key2xs.com/news/cer-in-europe-from-infrastructure-protection-to-demonstrable-resilience", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://key2xs.com/hubfs/logo%20blue.svg" }, "name" : "Key2XS B.V." } } ```