Summary
Details
- European Union
The CER Directive applies to public and private organizations formally identified as critical entities by EU Member States. To be identified, an organization must provide one or more essential services, operate and have relevant critical infrastructure in the Member State, and be such that an incident could significantly disrupt the provision of essential services.
Deep dive
📩 Stay ahead of climate regulation and reporting shifts
Regulatory updates, reporting standards, and new climate software — distilled into one concise weekly brief for decision-makers.
Thanks for signing up. Please check your inbox to confirm your subscription.
Practical updates. Once per week.
Background
Adopted in December 2022, the CER Directive replaced the narrower European Critical Infrastructure Directive. It covers critical services across sectors including energy, transport, health, drinking water, wastewater, digital infrastructure, food and public administration. Its central objective is to ensure that services essential to society, the economy, public health and safety, and the environment remain resilient to disruption.
Climate resilience is a key part of this framework. The Directive recognizes that climate change is increasing physical risks to critical infrastructure by intensifying the frequency and scale of extreme weather events. It also highlights longer-term changes in average climatic conditions that can reduce the capacity, efficiency and lifespan of infrastructure where adequate adaptation measures are not implemented.
CER therefore complements climate policies concerned with reducing greenhouse gas emissions. Its climate dimension is primarily about adaptation and physical climate risk: understanding how climate-related hazards could disrupt essential services and building the capacity to continue operating when such events occur.
Climate Risk Requirements
Under the CER Directive's all-hazards approach, climate-related hazards form part of the wider risks that Member States and critical entities must assess. Key requirements include:
Assess natural and climate-related risks: Critical entities must assess relevant natural and human-made risks capable of disrupting their essential services. This can include floods, droughts, wildfires, heatwaves etc.
Consider dependencies: Assessments must consider how disruption to other sectors and essential services could affect the entity, as well as how disruption of the entity's own services could affect others.
Use national risk information: Entity-level assessments must take account of relevant Member State risk assessments and other appropriate sources of information.
Review risks regularly: Critical entities must complete their first risk assessment within nine months of notification and repeat it whenever necessary and at least every four years.
The Directive does not prescribe a single climate-risk methodology or require a specific form of climate scenario analysis. Its approach is risk-based, allowing the assessment to reflect the hazards, infrastructure and essential services relevant to each entity.
Resilience and Adaptation Measures
Critical entities must use the results of their risk assessments to implement appropriate and proportionate technical, security and organizational measures. From a climate-risk perspective, these can include:
Prevent and prepare for climate-related disruption, explicitly taking disaster-risk reduction and climate adaptation measures into account.
Strengthen physical infrastructure, for example through flood, drought, fire or extreme-weather resilience measures and by avoiding high-risk locations for new critical infrastructure where appropriate.
Prepare for changing climate conditions, including extreme heat, flooding, sea-level rise and water scarcity over the expected lifetime of critical infrastructure.
Maintain continuity and recovery arrangements, including crisis-management procedures, business-continuity measures and alternative supply chains so that essential services can continue or be restored following disruption.
Consider longer-term resilience measures, such as stress testing infrastructure against more adverse climatic conditions and using nature-based solutions, where appropriate.
Importantly, CER therefore goes beyond simply identifying or disclosing physical climate risks. For designated critical entities, identified risks can translate into an obligation to implement practical resilience and adaptation measures designed to protect the continuity of essential services.
Compliance and Enforcement
CER is mandatory for entities formally designated as critical entities. These organizations must carry out their required risk assessments, implement appropriate resilience measures and notify competent authorities of significant disruptive incidents.
Member State authorities are responsible for supervision and enforcement and can conduct inspections, require information, order audits and require entities to remedy infringements. Member States must also establish penalties that are effective, proportionate and dissuasive; the Directive itself does not prescribe a uniform EU-wide fine.
Current Status
Member States were required to transpose the CER Directive by 17 October 2024, with national measures applying from 18 October 2024. They were also required to adopt national critical-entity resilience strategies by 17 January 2026 and to identify critical entities by 17 July 2026. The Directive therefore represents an increasingly important part of the EU's physical climate-risk landscape. Unlike sustainability disclosure rules that primarily require businesses to report their exposure to climate risks, CER can require designated entities to act on identified physical risks by implementing measures designed to maintain the resilience and continuity of essential services. That distinction makes it particularly relevant for operators of infrastructure exposed to worsening climate hazards.
Resources
Cut through the green tape
We don't push agendas. At Net Zero Compare, we cut through the hype and fear to deliver the straightforward facts you need for making informed decisions on green products and services. Whether motivated by compliance, customer demands, or a real passion for the environment, you’re welcome here. We provide reliable information. Why you seek it is not our concern.