The CER Directive and the German KRITIS Framework Act: Implementation and Regulatory Challenges

Global crises, acts of sabotage and natural disasters highlight just how vulnerable Europe’s supply infrastructure is. Whilst NIS-2 places a strong emphasis on cyber security, the European Union has also taken steps to address physical and operational resilience.

The European Directive on the Resilience of Critical Entities ((EU) 2022/2557) came into force on 16 January 2023. This ‘CER Directive’ significantly broadens the legal scope: In addition to IT protection, the physical, organisational and personnel resilience of operators of essential services takes centre stage. Whilst the formal deadline for transposition into national law expired on 17 October 2024, the process of identifying critical entities has been extended until mid-2026. However, implementation in the Member States also presents its own challenges.

1. What is the EU CER Directive?

The CER Directive came into force on 16 January 2023 and replaces the previous European ECI Directive from 2008. Whilst the previous regulation covered only the energy and transport sectors, the new directive drastically expands its scope to 11 critical sectors:

1. Energy
2. Transport
3. Banking
4. Financial market infrastructures
5. Health
6. Drinking water
7. Wastewater
8. Digital infrastructure
9. Public administration
10. Space
11. Food (production, processing, distribution)

The EU CER Directive covers 11 sectors, as it newly incorporates areas such as space and public administration, and lists drinking water and wastewater as two separate sectors, whereas the previous German KRITIS regulation was based on 10 traditionally defined sectors

The ‘all-hazards’ approach and its interaction with NIS2

The CER Directive adopts an ‘all-hazards’ approach. This means that operators must analyse risks of all kinds – from natural disasters, sabotage and terrorism to insider threats or pandemics – and take precautionary measures.

In this respect, the CER Directive forms the physical counterpart to the cyber-focused NIS2 Directive:

• NIS2 regulates IT and information security.

• CER governs physical, organisational and personnel resilience.

• An important knock-on effect is that once a company has been classified by Member States as a ‘critical facility’ under CER, it is automatically regarded as an ‘essential facility’ under NIS2.

2. State of implementation in Europe: A mixed picture

Although the European deadline for Member States to transpose the legislation expired on 17 October 2024, the pace of national implementation has been extremely uneven. The European Commission has already launched infringement proceedings against defaulting Member States due to late notification of transposition measures.

Germany as a pioneer: The KRITIS umbrella law

Germany has transposed the Directive through the comprehensive KRITIS umbrella law, which came into force on 17 March 2026.

• Shift in focus: German law is undergoing a transition from the mere protection of physical infrastructure to ensuring the continuous provision of essential services to society.

• Threshold: The legislation applies to facilities that are essential to the overall supply of services and serve more than 500,000 people.

• Regulatory structure: Supervisory responsibility is divided between the Federal Office for Civil Protection and Disaster Assistance (BBK) for physical resilience and the Federal Office for Information Security (BSI) for cyber security.

The key milestone: 17 July 2026

By 17 July 2026, all EU Member States must determine, on the basis of national risk analyses, which specific organisations are to be designated as ‘critical infrastructure’. Following formal notification, the organisations concerned will have just 10 months to fully comply with the extensive resilience obligations.

3. The key challenges of harmonised implementation

The creation of a uniform European resilience framework faces several hurdles:

1. Overlaps and duplication of regulation (NIS2 vs. CER): Organisations must closely coordinate physical security strategies (e.g. BBK) and IT security requirements (e.g. BSI), which leads to additional organisational burdens.

2. Inconsistent criteria and thresholds: As the CER is a directive, Member States apply different thresholds or self-assessment procedures (such as Germany, with a threshold of 500,000 people served, or specific national regulations).

3. Cross-border interdependencies: Critical infrastructure does not stop at national borders. Where supply chains or energy and transport networks span several EU countries, differing national requirements create complexity for multinational corporations.

4. Tight implementation deadlines for companies: Following designation, operators must, within 9 to 10 months, carry out risk analyses (to be renewed every four years), draw up resilience plans, establish incident reporting procedures (24-hour initial reporting) and implement security vetting of staff.

Conclusion & Action Required: Do not wait for notification

Compliance with the CER and KRITISDachG requirements demands that operators implement specific technical, structural and organisational protective measures for day-to-day operations. As the control room forms the nerve centre of any critical facility, the physical resilience, ergonomics and reliability of control rooms play a key role.