---
title: "Europe's CER Directive: Why Compliance Isn't Enough"
description: Discover how to effectively prepare for the Critical Entities Resilience (CER) Directive and build genuine resilience beyond compliance. Learn from industry experts.
image: https://www.humanrisks.com/hubfs/Imported_Blog_Media/pexels-ekaterina-bolovtsova-6077497-scaled.jpg
---
[Skip to content](https://www.humanrisks.com/insights/blog/europes-cer-directive-why-compliance-isnt-enough#main-content)
Close
- [Platform](https://www.humanrisks.com/platform)
- [Risk Assessment](https://www.humanrisks.com/platform/risk-assessments)
- [Incident Reports](https://www.humanrisks.com/platform/incident-reports)
- [Questionnaires](https://www.humanrisks.com/platform/questionnaires)
- [Tasks](https://www.humanrisks.com/platform/tasks)
- [Business Continuity Management](https://www.humanrisks.com/platform/bcm)
- [Business Impact Analysis](https://www.humanrisks.com/platform/bcm/business-impact-analysis)
- [Business Continuity Plans](https://www.humanrisks.com/platform/bcm)
- [Crisis Management](https://www.humanrisks.com/platform/bcm/crisis-management)
- [Mass Communication](https://www.humanrisks.com/platform/mass-comms)
- [Industries](https://www.humanrisks.com/industries)
- [Manufacturing](https://www.humanrisks.com/industry/manufacturing)
- [Banking & Financial Services](https://www.humanrisks.com/industry/banking-and-financial-services)
- [Critical Infrastructure](https://www.humanrisks.com/industry/critical-infrastructure)
- [Pharmaceuticals](https://www.humanrisks.com/industry/pharmaceuticals)
- [Facility Management](https://www.humanrisks.com/industry/facility-management)
- [Professional Services](https://www.humanrisks.com/industry/professional-services)
- [Resources](https://www.humanrisks.com/resources)
- [Security Templates](https://www.humanrisks.com/resources/templates)
- [Risk Assessment](https://www.humanrisks.com/resources/risk-assessment-series)
- [Webinars](https://www.humanrisks.com/resources/webinars)
- [Whitepapers](https://www.humanrisks.com/resources/whitepapers)
- [Insights](https://www.humanrisks.com/insights)
- [Customer Cases](https://www.humanrisks.com/customer-cases)
SEARCH
CONTACT
E-MAIL: [info@humanrisks.com](mailto:info@humanrisks.com)
[Book a Demo](https://www.humanrisks.com/book-a-demo)
[](https://www.humanrisks.com/)
- [Platform](https://www.humanrisks.com/platform)
- [Industries](https://www.humanrisks.com/industries)
- [Resources](https://www.humanrisks.com/resources)
E-MAIL: [info@humanrisks.com](mailto:info@humanrisks.com)
[Book a Demo](https://www.humanrisks.com/book-a-demo)
Quick results for "{search\_term}"
[Risk Assessments](https://www.humanrisks.com/platform/risk-assessments)[Incident Reports](https://www.humanrisks.com/platform/incident-reports)[Questionnaires](https://www.humanrisks.com/platform/questionnaires)[Tasks](https://www.humanrisks.com/platform/tasks)[Business Continuity Management](https://www.humanrisks.com/platform/bcm)
[Business Impact Analysis](https://www.humanrisks.com/platform/bcm/business-impact-analysis)[Business Continuity Plans](https://www.humanrisks.com/platform/bcm/business-continuity-plans)[Crisis Management](https://www.humanrisks.com/platform/bcm/crisis-management)[Mass Communications](https://www.humanrisks.com/platform/mass-comms)
[Manufacturing](https://www.humanrisks.com/industry/manufacturing)[Banking & Financial Services](https://www.humanrisks.com/industry/banking-and-financial-services)[Critical Infrastructure](https://www.humanrisks.com/industry/critical-infrastructure)
[Pharmaceuticals](https://www.humanrisks.com/industry/pharmaceuticals)[Facility Management](https://www.humanrisks.com/industry/facility-management)[Professional Services](https://www.humanrisks.com/industry/professional-services)
[Security Templates](https://www.humanrisks.com/resources/templates)[Risk Assessment](https://www.humanrisks.com/resources/risk-assessment-series)[Webinars](https://www.humanrisks.com/resources/webinars)
[Whitepapers](https://www.humanrisks.com/resources/whitepapers)[Insights](https://www.humanrisks.com/insights)[Customer Cases](https://www.humanrisks.com/customer-cases)
[Human Risks](https://www.humanrisks.com/insights/author/human-risks)7 min read
# Europe's CER Directive: Why Compliance Isn't Enough
[](https://video.humanrisks.com/cer-directive-compliance-essential/join?utm%5fcampaign=webinar%5fmar17&token=de3c2f6aad2f2c095083&utm%5fsource=website&utm%5fmedium=website%5fbanner)
The CER Directive ([Critical Entities Resilience Directive, EU 2022/2557](https://eur-lex.europa.eu/eli/dir/2022/2557/oj/eng)) is European legislation that requires organizations providing essential services to strengthen their resilience against all types of threats, including physical attacks, natural disasters, supply chain failures, and geopolitical disruption. It applies across 11 critical sectors and replaces the older European Critical Infrastructure Directive with a far broader mandate: not just protecting assets, but ensuring essential services continue to function no matter what happens.
The deadline is approaching. By 17 July 2026, EU Member States must identify their critical entities under the Critical Entities Resilience (CER) Directive, and once that list is published, the pressure shifts squarely onto those entities and their suppliers. First compliance deadlines follow in May 2027, meaning now is the time to turn awareness to action.
We recently brought together two leading experts to unpack what CER compliance looks like in practice. Their verdict was clear: organisations that treat CER as a compliance exercise are already approaching it wrong. Read on for the key takeaways or jump straight to the full [**on-demand webinar**](https://video.humanrisks.com/unpacking-cer-directive-compliance/de3c2f6aad2f2c095083?utm_source=website&utm_medium=website_banner&utm_campaign=webinar_mar17)featuring Christel Teglers (Kromann Reumert) and Patrick Moloney (Ramboll).
### What Is the CER Directive
The CER Directive entered into force in January 2023 as the physical resilience counterpart to [NIS2](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng), which covers cybersecurity. Together, the two directives form the EU's answer to a threat landscape where sabotage, hybrid attacks, extreme weather, and cascading supply chain failures can disrupt essential services just as effectively as any cyberattack.
Where the previous European Critical Infrastructure Directive focused narrowly on protecting individual assets in energy and transport, the CER Directive shifts the focus to resilience: the ability of an entire organisation to anticipate, absorb, and recover from disruption. According to the [European Commission](https://home-affairs.ec.europa.eu/policies/internal-security/counter-terrorism-and-radicalisation/protection/critical-infrastructure-resilience-eu-level_en), Member States were required to transpose the directive into national law by 17 October 2024, and many have introduced national legislation that goes further than the EU baseline. This means CER compliance is not one uniform standard. Organisations operating across multiple Member States need to track how each country has implemented the directive.
### Who is affected by the CER Directive
> The CER Directive covers [11 critical sectors](https://eur-lex.europa.eu/EN/legal-content/summary/making-critical-entities-more-resilient.html): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, and food production, processing, and distribution.
Each Member State must identify the specific organisations within these sectors that qualify as critical entities, based on the essential services they provide and the potential impact of their disruption. The European Commission adopted [guidelines in September 2025](https://home-affairs.ec.europa.eu/news/commission-adopts-guidelines-enhance-resilience-critical-entities-eu-2025-09-11_en) to support Member States in this identification process, which concludes by 17 July 2026. Once an organisation receives notification that it has been designated, its compliance obligations begin within ten months.
Enforcement carries real teeth. Member States define their own penalty regimes, and several have already signalled fines comparable to those under NIS2, alongside powers to compel remediation. The reputational cost of being publicly identified as a critical entity that failed its obligations may prove even more damaging than the financial one.
Crucially, the directive's reach extends well beyond the named entities themselves. If you supply software, logistics, maintenance, or any other critical input to a designated entity, you sit inside the perimeter of their resilience obligations. Expect your critical customers to start asking harder questions about your own continuity arrangements.
### What Makes CER Different
Unlike NIS2, which is focused on cybersecurity, CER demands something broader: all-hazards resilience. That includes physical security, operational continuity, and supply-chain risk management across 11 critical sectors, such as energy, transport, banking, health, and more. This isn't a matter of ticking boxes in a security audit. It's a mandate to ensure that essential services can withstand and recover from incidents regardless of their cause. That can be a cyberattack, flood, supplier failure, or geopolitical disruption. This also extends beyond the entities directly named as critical. Even if you supply to a critical entity, you are likely inside the perimeter of their resilience obligations.
### The Real Obstacles Are Internal
**Christel Teglers, Partner at Kromann Reumert,** explains:
"*Almost all the things that entities struggle with in practice are not really because of the requirements. It's because of all the internal hassle. It's because of all the silos. It's because of the lack of registers or inventories*."
Christel TeglersPartner at Kromann Reumert
This is one of the most important perspectives for any leadership team approaching CER. The directive is not the hard part, but the organisational reality is. Christel points to siloed teams that don't share information or missed asset registers and infrastructure inventories. It is the unclear ownership of cross-functional risk processes and incident reporting workflows that exist on paper but have never been tested under pressure. These are the things that derail implementation, and they're all fixable if you start preparing now.
### Compliance-First Thinking Will Backfire
The temptation with any new regulation is to assign it to a legal or compliance team, produce a gap analysis, and work through requirements item by item. That approach has a poor track record with resilience mandates, and CER is no exception.
"*The teams that will handle it the best are those that don't treat it as a compliance exercise. Seeing it as a must-do, as a business imperative, rather than a compliance.*"
Patrick MoloneyGlobal Director of Sustainability & Resilience Advisory at Ramboll
Meaning that it is important to treat CER as what it actually is: a strategic imperative. Resilience built to pass an audit is fragile. Resilience built because leadership genuinely believes continuity is a competitive advantage. That is what makes it real, rather than merely documented.
### The Core CER Compliance Requirements
Once designated, critical entities face a set of concrete obligations. The details vary by Member State, but the directive establishes a common baseline:
- [**Risk assessment.**](https://www.humanrisks.com/platform/risk-assessments) Entities must assess all relevant risks that could disrupt their essential services, covering natural hazards, accidents, deliberate attacks, and dependencies on suppliers and infrastructure. National authorities conduct their own risk assessments, which entities are expected to take into account.
- **Resilience measures.** Based on the risk assessment, entities must implement appropriate technical, security, and organisational measures. These span physical protection of premises, access control, crisis management procedures, business continuity arrangements, and supply chain security.
- [**Incident notification.**](https://www.humanrisks.com/platform/incident-reports) Entities must report incidents that significantly disrupt or could significantly disrupt their essential services to national authorities, with initial notification expected within 24 hours of becoming aware of the incident.
- **Background checks.** For personnel in sensitive roles, entities may need to carry out background verification in line with national rules.
None of these requirements is exotic. Most map directly onto disciplines that mature security and continuity teams already practise. The challenge is doing them systematically, keeping the evidence current, and connecting them into a single coherent picture that leadership and regulators can both trust.
### The Supply Chain Dimension
CER's all-hazards framing also makes supply-chain risk a central concern. Critical entities are expected to understand their dependencies and ensure that key suppliers meet appropriate resilience standards.
In practice, this cascades obligations across the supply chain. A utility may be named as a critical entity; its software vendor, maintenance contractor, or logistics provider may face indirect pressure to show their own resilience posture. Due diligence processes, contractual requirements, and supplier assessments are all likely to become more rigorous as the July deadline approaches and Member States begin enforcement activity. For suppliers who haven't started thinking about this, the window to get ahead of it is closing.
### What Good Preparation Looks Like
Here is what organisations can do to prepare before the July 2026 deadline:
- Map their critical functions and dependencies honestly. This is not about the idealised version, but the real operational picture, including single points of failure and undocumented workarounds.
- Assign clear cross-functional ownership, with a resilience lead who has the authority to drive workstreams across legal, operations, IT, procurement, and communications.
- Build 24-hour incident reporting capability that has been tested, not just described in a policy document.
- Leverage existing compliance work from NIS2, DORA, ISO 22301, or sector-specific frameworks rather than starting from scratch. CER overlaps significantly with other mandates, and smart organisations are integrating rather than duplicating.
- Centralise the evidence. Risk assessments, resilience measures, incident logs, and supplier assessments scattered across spreadsheets and inboxes will not withstand regulatory scrutiny. A single platform view makes CER compliance demonstrable, not just claimed.
The organisations that come through this period well will be the ones that used regulation as a forcing function and a real opportunity to build something genuinely resilient.
### Want to learn more?
If you want to prepare for the CER directive**, [watch the full on-demand webinar](https://video.humanrisks.com/unpacking-cer-directive-compliance/de3c2f6aad2f2c095083?utm_source=website&utm_medium=website_banner&utm_campaign=webinar_mar17)** featuring legal expert Christel Teglers (Kromann Reumert), resilience advisor Patrick Moloney (Ramboll), and the team at Human Risks for a detailed breakdown of CER scope and practical tools for audit readiness.
[WATCH THE ON-DEMAN WEBINAR FOR FREE](https://video.humanrisks.com/unpacking-cer-directive-compliance/de3c2f6aad2f2c095083?utm_source=website&utm_medium=website_banner&utm_campaign=webinar_mar17)
[Human Risks](https://www.humanrisks.com/insights/author/human-risks)Human Risks is a security risk management (SRM) and business continuity management (BCM) platform, combining both disciplines in a single standardised environment covering the full risk landscape, including physical security. Refined through partnerships with Fortune 500 organisations and over 2,500 professionals worldwide, including teams at HSBC, GSK, and Yondr, the platform consolidates risk assessments, impact analysis, continuity planning, crisis management, and incident reporting. Intelligent automation delivers risk assessments in under 15 minutes, with 90% less manual work. Human Risks is trusted across industries like logistics, pharmaceuticals, banking, and critical infrastructure, driving a business-centred approach to security that supports resilience and informed decision-making.
[mailto:info@humanrisks.com](mailto:info@humanrisks.com)
## RELATED ARTICLES
### [Douglas Gray5 min read Prioritizing the Human Element | When Technology Alone is not Enough When a new problem emerges, business leaders often turn to technology for a solution. Software platforms offer scalable, and ... Start Reading](https://www.humanrisks.com/insights/blog/people-process-technology)
### [Human Risks6 min read If Everyone’s Responsible for Security… Then No One Is? It sounds great, democratic, empowering, and even inspiring. It suggests that every person in the organization, regardless of ... Start Reading](https://www.humanrisks.com/insights/blog/if-everyones-responsible-for-security-then-no-one-is)
### [Human Risks5 min read Understanding ISO 22336 - A Guide for Security Leaders In today’s rapidly evolving risk environment, organizational resilience is more important than ever. Security leaders are ... Start Reading](https://www.humanrisks.com/insights/blog/understanding-iso-22336-a-guide-for-security-leaders)
[](https://www.humanrisks.com/)
- [Platform](https://www.humanrisks.com/platform)
- [Risk Assessments](https://www.humanrisks.com/platform/risk-assessments)
- [Tasks](https://www.humanrisks.com/platform/tasks)
- [Incident Reports](https://www.humanrisks.com/platform/incident-reports)
- [Questionnaires](https://www.humanrisks.com/platform/questionnaires)
- [Business Continuity](https://www.humanrisks.com/platform/bcm)
- [Business Impact Analysis](https://www.humanrisks.com/platform/bcm/business-impact-analysis)
- [Business Continuity Plans](https://www.humanrisks.com/platform/bcm/business-continuity-plans)
- [Crisis Management](https://www.humanrisks.com/platform/bcm/crisis-management)
- [Mass Communications](https://www.humanrisks.com/platform/mass-comms)
- [Resources](https://www.humanrisks.com/resources)
- [CER Directive Practical Guide](https://www.humanrisks.com/cer-guide)
- [Whitepapers](https://www.humanrisks.com/resources/whitepapers)
- [Webinars](https://www.humanrisks.com/resources/webinars)
- [Security Templates](https://www.humanrisks.com/resources/templates)
- [Risk Assessment](https://www.humanrisks.com/resources/risk-assessment-series)
- [Case Studies](https://www.humanrisks.com/customer-cases)
- [Insights](https://www.humanrisks.com/insights)
- [Podcast](https://tr.ee/KvAUisFgFY)
- Company
- [About Us](https://www.humanrisks.com/company/about-us)
- [Partners](https://www.humanrisks.com/company/partners)
- [Careers](https://www.humanrisks.com/company/careers)
- [Contact](https://www.humanrisks.com/company/contact)
© All rights reserved, Human Risks 2026
- [Privacy Policy](https://www.humanrisks.com/privacy-policy)
- [Legal Disclaimer](https://www.humanrisks.com/hubfs/Website%20Assets/Company/Legal%20Disclaimer.pdf)
- [Data Security](https://www.humanrisks.com/hubfs/Website%20Assets/Company/Security-White-Paper_V1.9_2024.04.29_HumanRisks1.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "Organization",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "Denmark",
"addressLocality" : "Aalborg",
"addressRegion" : "Nordjylland",
"postalCode" : "9000",
"streetAddress" : "Adelgade 12"
},
"email" : "info@humanrisks.com",
"knowsLanguage" : "en",
"logo" : {
"@type" : "ImageObject",
"url" : "https://26655958.fs1.hubspotusercontent-eu1.net/hubfs/26655958/Human%20Risks_Logo-4.png"
},
"name" : "Human Risks",
"url" : "https://www.humanrisks.com/insights/blog/europes-cer-directive-why-compliance-isnt-enough"
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"abstract" : "Discover how to effectively prepare for the Critical Entities Resilience (CER) Directive and build genuine resilience beyond compliance. Learn from industry experts.",
"author" : {
"@type" : "Person",
"name" : "Human Risks"
},
"dateModified" : "",
"datePublished" : "",
"headline" : "Europe's CER Directive: Why Compliance Isn't Enough",
"image" : "https://26655958.fs1.hubspotusercontent-eu1.net/hubfs/26655958/Imported_Blog_Media/pexels-ekaterina-bolovtsova-6077497-scaled.jpg",
"inLanguage" : "en",
"keywords" : "[Regulatory & Compliance]",
"mainEntityOfPage" : {
"@type" : "WebPage"
},
"name" : "Europe's CER Directive: Why Compliance Isn't Enough",
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : ""
},
"name" : "Human Risks"
},
"text" : "The CER Directive (Critical Entities Resilience Directive, EU 2022/2557) is European legislation that requires organizations providing essential services to strengthen their resilience against all types of threats, including physical attacks, natural disasters, supply chain failures, and geopolitical disruption. It applies across 11 critical sectors and replaces the older European Critical Infrastructure Directive with a far broader mandate: not just protecting assets, but ensuring essential services continue to function no matter what happens. The deadline is approaching. By 17 July 2026, EU Member States must identify their critical entities under the Critical Entities Resilience (CER) Directive, and once that list is published, the pressure shifts squarely onto those entities and their suppliers. First compliance deadlines follow in May 2027, meaning now is the time to turn awareness to action. We recently brought together two leading experts to unpack what CER compliance looks like in practice. Their verdict was clear: organisations that treat CER as a compliance exercise are already approaching it wrong. Read on for the key takeaways or jump straight to the full on-demand webinar featuring Christel Teglers (Kromann Reumert) and Patrick Moloney (Ramboll). What Is the CER Directive The CER Directive entered into force in January 2023 as the physical resilience counterpart to NIS2, which covers cybersecurity. Together, the two directives form the EU's answer to a threat landscape where sabotage, hybrid attacks, extreme weather, and cascading supply chain failures can disrupt essential services just as effectively as any cyberattack. Where the previous European Critical Infrastructure Directive focused narrowly on protecting individual assets in energy and transport, the CER Directive shifts the focus to resilience: the ability of an entire organisation to anticipate, absorb, and recover from disruption. According to the European Commission, Member States were required to transpose the directive into national law by 17 October 2024, and many have introduced national legislation that goes further than the EU baseline. This means CER compliance is not one uniform standard. Organisations operating across multiple Member States need to track how each country has implemented the directive. Who is affected by the CER Directive The CER Directive covers 11 critical sectors: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, and food production, processing, and distribution. Each Member State must identify the specific organisations within these sectors that qualify as critical entities, based on the essential services they provide and the potential impact of their disruption. The European Commission adopted guidelines in September 2025 to support Member States in this identification process, which concludes by 17 July 2026. Once an organisation receives notification that it has been designated, its compliance obligations begin within ten months. Enforcement carries real teeth. Member States define their own penalty regimes, and several have already signalled fines comparable to those under NIS2, alongside powers to compel remediation. The reputational cost of being publicly identified as a critical entity that failed its obligations may prove even more damaging than the financial one. Crucially, the directive's reach extends well beyond the named entities themselves. If you supply software, logistics, maintenance, or any other critical input to a designated entity, you sit inside the perimeter of their resilience obligations. Expect your critical customers to start asking harder questions about your own continuity arrangements. What Makes CER Different Unlike NIS2, which is focused on cybersecurity, CER demands something broader: all-hazards resilience. That includes physical security, operational continuity, and supply-chain risk management across 11 critical sectors, such as energy, transport, banking, health, and more. This isn't a matter of ticking boxes in a security audit. It's a mandate to ensure that essential services can withstand and recover from incidents regardless of their cause. That can be a cyberattack, flood, supplier failure, or geopolitical disruption. This also extends beyond the entities directly named as critical. Even if you supply to a critical entity, you are likely inside the perimeter of their resilience obligations. The Real Obstacles Are Internal Christel Teglers, Partner at Kromann Reumert, explains: \"Almost all the things that entities struggle with in practice are not really because of the requirements. It's because of all the internal hassle. It's because of all the silos. It's because of the lack of registers or inventories.\" Christel TeglersPartner at Kromann Reumert This is one of the most important perspectives for any leadership team approaching CER. The directive is not the hard part, but the organisational reality is. Christel points to siloed teams that don't share information or missed asset registers and infrastructure inventories. It is the unclear ownership of cross-functional risk processes and incident reporting workflows that exist on paper but have never been tested under pressure. These are the things that derail implementation, and they're all fixable if you start preparing now. Compliance-First Thinking Will Backfire The temptation with any new regulation is to assign it to a legal or compliance team, produce a gap analysis, and work through requirements item by item. That approach has a poor track record with resilience mandates, and CER is no exception. \"The teams that will handle it the best are those that don't treat it as a compliance exercise. Seeing it as a must-do, as a business imperative, rather than a compliance.\" Patrick MoloneyGlobal Director of Sustainability & Resilience Advisory at Ramboll Meaning that it is important to treat CER as what it actually is: a strategic imperative. Resilience built to pass an audit is fragile. Resilience built because leadership genuinely believes continuity is a competitive advantage. That is what makes it real, rather than merely documented. The Core CER Compliance Requirements Once designated, critical entities face a set of concrete obligations. The details vary by Member State, but the directive establishes a common baseline: Risk assessment. Entities must assess all relevant risks that could disrupt their essential services, covering natural hazards, accidents, deliberate attacks, and dependencies on suppliers and infrastructure. National authorities conduct their own risk assessments, which entities are expected to take into account. Resilience measures. Based on the risk assessment, entities must implement appropriate technical, security, and organisational measures. These span physical protection of premises, access control, crisis management procedures, business continuity arrangements, and supply chain security. Incident notification. Entities must report incidents that significantly disrupt or could significantly disrupt their essential services to national authorities, with initial notification expected within 24 hours of becoming aware of the incident. Background checks. For personnel in sensitive roles, entities may need to carry out background verification in line with national rules. None of these requirements is exotic. Most map directly onto disciplines that mature security and continuity teams already practise. The challenge is doing them systematically, keeping the evidence current, and connecting them into a single coherent picture that leadership and regulators can both trust. The Supply Chain Dimension CER's all-hazards framing also makes supply-chain risk a central concern. Critical entities are expected to understand their dependencies and ensure that key suppliers meet appropriate resilience standards. In practice, this cascades obligations across the supply chain. A utility may be named as a critical entity; its software vendor, maintenance contractor, or logistics provider may face indirect pressure to show their own resilience posture. Due diligence processes, contractual requirements, and supplier assessments are all likely to become more rigorous as the July deadline approaches and Member States begin enforcement activity. For suppliers who haven't started thinking about this, the window to get ahead of it is closing. What Good Preparation Looks Like Here is what organisations can do to prepare before the July 2026 deadline: Map their critical functions and dependencies honestly. This is not about the idealised version, but the real operational picture, including single points of failure and undocumented workarounds. Assign clear cross-functional ownership, with a resilience lead who has the authority to drive workstreams across legal, operations, IT, procurement, and communications. Build 24-hour incident reporting capability that has been tested, not just described in a policy document. Leverage existing compliance work from NIS2, DORA, ISO 22301, or sector-specific frameworks rather than starting from scratch. CER overlaps significantly with other mandates, and smart organisations are integrating rather than duplicating. Centralise the evidence. Risk assessments, resilience measures, incident logs, and supplier assessments scattered across spreadsheets and inboxes will not withstand regulatory scrutiny. A single platform view makes CER compliance demonstrable, not just claimed. The organisations that come through this period well will be the ones that used regulation as a forcing function and a real opportunity to build something genuinely resilient. Want to learn more? If you want to prepare for the CER directive, watch the full on-demand webinar featuring legal expert Christel Teglers (Kromann Reumert), resilience advisor Patrick Moloney (Ramboll), and the team at Human Risks for a detailed breakdown of CER scope and practical tools for audit readiness. WATCH THE ON-DEMAN WEBINAR FOR FREE",
"url" : "https://www.humanrisks.com/insights/blog/europes-cer-directive-why-compliance-isnt-enough",
"wordCount" : "3142"
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Human Risks",
"url" : "https://www.humanrisks.com/insights/author/human-risks"
},
"dateModified" : "2026-09-14T06:17:28.979Z",
"datePublished" : "2026-07-16T13:44:02.000Z",
"headline" : "Europe's CER Directive: Why Compliance Isn't Enough",
"image" : [ "https://www.humanrisks.com/hubfs/Imported_Blog_Media/pexels-ekaterina-bolovtsova-6077497-scaled.jpg" ],
"mainEntityOfPage" : {
"@id" : "https://www.humanrisks.com/insights/blog/europes-cer-directive-why-compliance-isnt-enough",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://www.humanrisks.com/hubfs/Human%20Risks_Logo-4.png"
},
"name" : "Human Risks"
}
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://www.humanrisks.com",
"name" : "Home",
"position" : 1
}, {
"@type" : "ListItem",
"item" : "https://www.humanrisks.com/insights",
"name" : "Insights",
"position" : 2
}, {
"@type" : "ListItem",
"item" : "https://www.humanrisks.com/insights/blog/europes-cer-directive-why-compliance-isnt-enough",
"name" : "Europe's CER Directive: Why Compliance Isn't Enough",
"position" : 3
} ]
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "FAQPage",
"mainEntity" : [ {
"@type" : "Question",
"acceptedAnswer" : {
"@type" : "Answer",
"text" : "EU Member States must identify their critical entities under the CER Directive by 17 July 2026. Once that list is published, compliance obligations shift to those entities and their suppliers, with first compliance deadlines following in May 2027."
},
"name" : "What is the deadline for the EU Critical Entities Resilience (CER) Directive?"
}, {
"@type" : "Question",
"acceptedAnswer" : {
"@type" : "Answer",
"text" : "While NIS2 focuses on cybersecurity, CER requires all-hazards resilience covering physical security, operational continuity, and supply-chain risk management across 11 critical sectors, including energy, transport, banking, and health. It addresses any type of disruption, whether caused by a cyberattack, natural disaster, supplier failure, or geopolitical event."
},
"name" : "How is the CER Directive different from NIS2?"
}, {
"@type" : "Question",
"acceptedAnswer" : {
"@type" : "Answer",
"text" : "Yes. Even organizations that are not directly named as critical entities can fall within the perimeter of CER obligations if they supply a critical entity. This cascades resilience expectations across the supply chain, including due diligence, contractual requirements, and supplier resilience assessments."
},
"name" : "Does the CER Directive apply to suppliers of critical entities?"
}, {
"@type" : "Question",
"acceptedAnswer" : {
"@type" : "Answer",
"text" : "According to legal and resilience experts, the main obstacles are internal rather than regulatory: siloed teams that don't share information, missing asset registers and infrastructure inventories, unclear ownership of cross-functional risk processes, and incident reporting workflows that have never been tested under real pressure."
},
"name" : "What are the biggest obstacles to CER compliance?"
}, {
"@type" : "Question",
"acceptedAnswer" : {
"@type" : "Answer",
"text" : "Experts advise against a compliance-first approach. Organizations that succeed with CER tend to treat it as a strategic business imperative rather than a checklist, since resilience built only to pass an audit tends to be fragile compared to resilience built because leadership sees continuity as a competitive advantage."
},
"name" : "Should organizations treat CER as a compliance exercise?"
}, {
"@type" : "Question",
"acceptedAnswer" : {
"@type" : "Answer",
"text" : "Recommended steps include honestly mapping critical functions and dependencies (including single points of failure), assigning a cross-functional resilience lead with authority across legal, operations, IT, procurement, and communications, building and testing a 24-hour incident reporting capability, and leveraging existing compliance work from frameworks like NIS2, DORA, or ISO 22301 rather than starting from scratch."
},
"name" : "How should organizations prepare for the CER Directive before the deadline?"
} ]
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Organization",
"name" : "Human Risks",
"url" : "https://www.humanrisks.com/insights/author/human-risks"
},
"dateModified" : "2026-07-17",
"datePublished" : "2026-03-15",
"description" : "Discover how to effectively prepare for the Critical Entities Resilience (CER) Directive and build genuine resilience beyond compliance. Learn from industry experts.",
"headline" : "Europe's CER Directive: Why Compliance Isn't Enough",
"image" : "https://www.humanrisks.com/hubfs/Imported_Blog_Media/pexels-ekaterina-bolovtsova-6077497-scaled.jpg",
"mainEntityOfPage" : {
"@id" : "https://www.humanrisks.com/insights/blog/europes-cer-directive-why-compliance-isnt-enough",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://www.humanrisks.com/hs-fs/hubfs/Website%20Assets/Company/Logo%20Round%20Blue.jpg"
},
"name" : "Human Risks"
}
}
```