Critical Entity (CER)

A critical entity is an organisation that has been designated by national authorities as critical under the CER Directive. The designation occurs because the organisation provides an essential service, and a serious disruption would have significant negative consequences for society, the economy or security.

Back to Dictionary

What is a critical entity?

Under the CER Directive, each EU Member State carries out a national risk assessment and maps the organisations that deliver critical services within the 11 CER sectors. Organisations assessed as having critical importance for maintaining vital societal functions are formally designated as critical entities.

The designation is not voluntary -- it is an administrative decision taken by the national authorities. Organisations that are designated receive a formal notification and become subject to the directive's requirements.

The designation process

The designation process under CER follows these steps:

National risk assessment: Each Member State conducts a comprehensive national risk assessment for the 11 sectors.
Mapping: The authorities map organisations that provide services within the sectors.
Criticality assessment: Assessment of the consequences of a disruption at the organisation in question.
Formal designation: The organisation receives a formal notification of its designation.
Notification to the European Commission: Member States notify the Commission of designated critical entities.

Obligations as a critical entity

As a designated critical entity under CER, the organisation must:

Carry out a risk assessment to identify relevant threats to the organisation's ability to deliver its services
Implement appropriate technical, security and organisational resilience measures
Prepare a resilience plan documenting the measures taken
Notify the competent authorities of incidents that disrupt the delivery of services
Cooperate with authorities in supervisory activities
Allow background checks of personnel in sensitive functions

Critical entities of European significance: The CER Directive identifies a special category of critical entities that are critical for six or more EU Member States. These are subject to specific support measures and supervisory activities at EU level, including advisory missions coordinated by the European Commission.

Frequently Asked Questions about Critical Entity (CER)

What is a critical entity under CER?

A critical entity is an organisation designated by national authorities as critical under the CER Directive because it provides an essential service whose disruption would have significant negative consequences for society, the economy or security.

How are critical entities designated?

Each Member State conducts a national risk assessment, maps organisations providing services in the 11 CER sectors, assesses the criticality of each, and formally designates those deemed critical. The designation is an administrative decision, not voluntary.

Is a NIS2 essential entity the same as a CER critical entity?

Not necessarily. NIS2 applies generally to medium-sized and large organisations in 18 sectors based on size and sector. CER designation is more selective and based on an individual criticality assessment. An organisation can be subject to NIS2 without being a CER critical entity, and vice versa.

What obligations does a CER critical entity have?

Critical entities must carry out risk assessments, implement resilience measures, prepare a resilience plan, notify authorities of disrupting incidents, cooperate with supervisory activities, and allow background checks of personnel in sensitive functions.

What is a critical entity of European significance?

It is a critical entity that provides essential services to or in six or more EU Member States. These entities are subject to additional support and oversight at EU level, including advisory missions coordinated by the European Commission.