Under the Critical Entities Resilience Directive (EU 2022/2557), a critical entity has to show that access to its premises and infrastructure is controlled, and that it can reconstruct who was where when an incident hits. In offices that evidence comes from the badge system. In the field it has to come from the key.
Energy, water, transport and government run on thousands of dispersed, unmanned sites: substations, pumping stations, sluices, relay houses, telecom shelters, cabinets along roads and tracks. Most of them have no network, no reader and no badge. Whatever hangs on the technician's belt is the only access control there is.
This article walks through the risks CER cares about at those assets, the controls that mitigate them, and how far mechanical keys, key cabinets and electromechanical locks get you, with and without Key2XS, in one matrix.
CER is an all-hazards law: sabotage, insider misuse, terrorism and natural hazards all count, and the obligations centre on what you can demonstrate about your physical operation. Four of them land directly on keys and locks.
Before any of that comes the risk assessment: nine months after designation, and at least every four years (Art. 12). None of it prescribes a technology. CER asks for controls that fit your risks, and for proof that they work.
In practice that is three questions, each answered with a timestamp. A technician loses a key: from when was the asset protected again? An employee leaves or a contract ends: when did their access stop, and was anything opened after that? A substation is sabotaged: who had access, who used it and which assets were exposed, within 24 hours? With mechanical keys the honest answers are “when we had replaced every cylinder it opened”, “when the key came back, if it did” and “we do not know”.
Transposition across the EU is uneven. The deadline was 17 October 2024 and most member states missed it. By spring 2026 twenty had notified national measures, and on 29 April 2026 the Commission referred the remaining seven (Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain and Sweden) to the Court of Justice with a request for financial penalties; the Netherlands has since caught up. Member states also had to identify their critical entities by 17 July 2026, so designation letters are landing now.
The obligations are the same everywhere, because Chapter III is minimum harmonisation. What differs per country is the date on your designation letter, which starts your own clock (nine months to the risk assessment, ten until the obligations apply), and national add-ons such as extra sectors. An entity with sites in several member states should expect several letters and several clocks. Where each country stands today is on our EU enforcement tracker.
Offices have a badge system, a receptionist and cameras. A pumping station has a door, a lock and a technician who may be the only person there all week. The risk list for that kind of asset is short and familiar.
Behind all seven sits an eighth: rights granted by a local administrator in a vendor tool or a spreadsheet, with no approval, no review and no evidence for the inspector.
Eight controls cover those risks, and they are deliberately technology-neutral: an inspector asks whether the control exists and whether you can prove it, not which brand delivers it. One person, one credential. Rights scoped to the asset and the time window. Revocation that needs no manual step. Credentials that cannot be copied and can be blocked. Four eyes on every rights decision. Two people present at high-impact assets. An audit trail of openings and of decisions. A periodic review against an inventory that is correct today.
The matrix scores the three technologies on those eight controls, first on their own and then governed through Key2XS. Yes means the technology enforces the control: at the lock for the asset-level rows, in the platform for the governance rows. Partly means procedural, manual, or only at one point in the chain (the cabinet, not the lock). No means the technology cannot deliver the control. The key technology is scored alone: alarms, cameras and patrols are compensating controls that detect, not controls that govern.
Mechanical keys are cheap and simple, and that is where their case ends. Every lost key is a re-keying decision, every leaver is a hope that the key comes back, and no opening is ever recorded. On the field assets of a designated critical entity, a master-key system is a finding waiting to be written, unless the risk assessment can show what compensates for it.
Key cabinets are strong exactly where the key changes hands, which makes them a good fit for a depot with a fleet and a shift pattern. For dispersed assets they have a geography problem: the cabinet is at the depot, the asset is 40 kilometres away, and the key that opens it is as anonymous in the field as it ever was. The audit trail ends at the cabinet door.
Electromechanical locks (ASSA ABLOY CLIQ, iLOQ) resolve the hardware questions: the credential is programmed for a person, cannot be copied, carries its own time windows, can be blocked, and both lock and key log every opening, with no power or network at the cylinder. Programmed for a person is not the same as bound to one: a key found in the field or handed over by a colleague works for whoever holds it, and the vendor app will update it for whoever has it in hand. What they do not resolve is governance. Rights are still decided and logged inside a vendor tool by an administrator, disconnected from HR, from IAM, and from the approval and certification cycles that already govern digital access.
With Key2XS the cabinet and the lock stay where they are. What moves is the decision: who may open what is derived from the identity in the IAM you already run, passes the same approvals as digital access, and reaches the lock system with the evidence attached. For electromechanical locks that closes every row. For cabinets it closes the governance rows and ties every handover to a corporate identity, so a key that is out is attributable to one named person; the asset-level rows stay where the mechanical key leaves them, until the cylinder changes. For many entities that is the right order anyway: govern what you have, then replace cylinders cluster by cluster under a key plan that already exists. Much of the gain is plain automation: most Partly cells in the matrix are Partly because a person has to remember a step, and a step nobody has to remember is a control that still holds when the office is empty.
Every Yes in the last two columns maps to a specific function. The ones that matter most for field work:
Two design choices matter in the field. Everything is offline-first: a sluice or a relay house has no network, so rights, windows and the two-person check are enforced by the credential and the lock, and every lock keeps working on the rights it already holds if the platform is unreachable. The platform itself runs single-tenant on EU infrastructure and is penetration tested by an independent party. And nothing is replaced: Key2XS connects to the CLIQ, iLOQ and cabinet systems you already run.
Take the asset list from your risk assessment, mark which key technology sits on each asset, and score the eight controls. Every No against a critical asset is a line in the Article 12 risk assessment and, ten months after designation, a question the authority is entitled to ask.
In every case the goal is what CER asks for: not a promise that people stay out, but proof of who can get in, who decided that, and who was there. Book a demo to see the last column running on your own IAM and lock systems, or read what the directive requires.