The EU's new resilience directive is a major security policy development

By the end of 2022, the EU will publish a new Critical Entities Resilience Directive (CER Directive).   

The CER Directive is based on the EU's Security Union Strategy. It aims to improve the resilience of services essential to the EU and its Member States and to maintain the vital and economic functions of society. Member States will identify at national level the critical sectors and service providers that provide these services. This is against the background of the need to ensure the uniform resilience of the EU's internal market across the EU, including in the event of disruption and hybrid effects. 

The Directive creates an obligation for all EU Member States to develop a strategy for crisis resilience, including a national risk assessment. This will identify critical actors in the public and private sectors. The identified critical actors must also carry out their own risk assessment, take appropriate measures to improve their resilience and report any incidents to the authority. 

One or more competent authorities and a national contact point should be designated at national level for the implementation of the directives. These actors will be responsible for the proper application and implementation of the Directive and for national and international cooperation. The Member State must also ensure that the authority has the powers and means to carry out inspections of critical infrastructure and premises used for the provision of essential services. Member States must also lay down penalties for breaches of national provisions and take the measures necessary to ensure that they are implemented. NATO has recognised that the EU CER Directive is a strong support to the Alliance's resilience work, as NATO member states are committed to improving the resilience and resilience of their societies. However, NATO does not have EU legislative powers - so the future CER Directive will provide a legal basis for resilience development.  

With the entry into force of the CER Directive at the end of this year, Member States have 21 months to amend their legislation in line with the Directive. In Finland, implementation will be postponed until after the parliamentary elections. 

With the national implementation of the Directive, the new competent authority will give the state a better view of the resilience of critical infrastructure and operators. This is a very important and welcome innovation in the current security policy context.  

The CER Directive will have an impact on the Finnish concept of comprehensive security, providing an excellent opportunity to update it and to take into account societal resilience as an increasingly integral part of security policy. With the CER Directive and NATO membership, societal resilience should be taken into account in the next government negotiations. There is now a clear need for an update of the national resilience organisation.

Kari Pelkonen, M.Sc. (Econ.), Evl (evp)

The author works at the Commission (DG HOME) on the preparation of the CER Directive.