22 October 2021

LIBE COMMITTEE ENDORSES REPORT ON RESILIENCE OF CRITICAL ENTITIES

On 12 October, the European Parliament’s Civil Liberties (LIBE) Committee endorsed its report on the  proposal for a Directive on the Resilience of Critical Entities (CER Directive), introducing new rules to better protect essential services including transport, energy and drinking water. Before negotiations with the Council can start, the negotiating position will have to be endorsed by the European Parliament’s plenary.

The CER Directive replaces the European Critical Infrastructure (ECI) Directive from 2008, which currently covers only two sectors (transport and energy), and expands its scope to ten sectors (energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, public administration and space). At the same time, the CER Directive introduces an all-hazard risk approach, where the ECI was largely focused on terrorism.

The LIBE Committee’s report highlights the need for more transparency when disruptions happen, requiring critical entities to inform the general public about incidents or serious risks. Additionally, Member States should provide financial support to critical entities, where this is in the public interest, without prejudice to state aid rules. Furthermore, the Committee proposes to widen the definition of essential services, so that protecting the environment, public health and safety, and the rule of law are also mentioned. To make cross-border co-operation frictionless, the Committee wants service providers to be considered “of European significance” if they offer similar services in at least three member states.

The CER Directive was proposed alongside the proposal for a revised Network and Information Systems Directive (NIS2), which aims to ensure robust cyber resilience on the part of a large number of entities. In order to ensure alignment between the two instruments, all critical entities identified under the CER Directive would be subject to cyber resilience obligations under NIS2.

Source: European Parliament