CER Directive

On 16 January 2023, the Directive on the resilience of critical entities (CER Directive) came into force. In parallel to the NIS2 Directive, Member States are now in the process of transposing this important piece of cybersecurity-related legislation into their national law. This task must be completed by 17 October 2024 and, from 18 October 2024, the current Directive 2008/114/EC will be repealed and Member States will have to apply the measures of the national transposition act.

The Bird & Bird CER Directive Implementation Tracker provides essential information to help businesses to monitor the status of implementation into national law. With a view to achieving a higher level of resilience of critical entities, Member States may extend the scope of the CER Directive and propose national add-ons in terms of additional obligations for the market to comply with. We are available to provide any further guidance you may need. If you have any questions or would like to know more about how we can help you to prepare for the new cybersecurity legislation, please get in touch.  

Key

The Bird & Bird CER Directive Implementation Tracker is based on information from public sources that are regularly checked. The information provided may not be fully complete or up to date.

While the NIS2 Directive aims to respond to the security concerns for the cyber dimension, the CER Directive sets rules to reduce the vulnerabilities and strengthen the physical resilience of critical entities. These are entities active in such sectors as energy, transport, health, drinking water, wastewater and space and providing vital services on which the livelihoods of EU citizens and the proper functioning of the internal market depend.

See more information on the CER Directive in our articles:

• NIS 2 Directive, CER Directive and DORA – Important EU cybersecurity-related legislative acts come into force
• The Impact of the NIS2 Directive and the CER Directive for Medical Device Manufacturers and the Healthcare Sector