From Compliance to Design: Navigating the Critical Entities Resilience Directive
The evidence is irrefutable: recent years have seen an increase in the frequency of disruptive events experienced by organisations and governments – when surveyed, 96% of businesses experienced a crisis within a given two-year period. The WEF highlighted geoeconomic confrontation and armed conflict as the two most material drivers of crisis in 2026 – but the global picture remains complex in the face of increased political polarisation, supply chain disruption and climate-related severe weather events.
This has shifted the focus of global regulators – there is an increasing sense that highly disruptive events cannot be managed through traditional risk management and control. Governments are looking to develop holistic resilience in society; irrespective of source, domain or impact. This is the background to the European Union (EU) Critical Entities Resilience Directive (CERD).
In this article, we explore the challenges posed by CERD to Critical Entities across Europe, and how the pursuit of compliance may precipitate a change in the resilience architecture of organisations.
What CERD Requires
EU nation states were required to identify Critical Entities across eleven sectors by July 2026. Moving forward, the organisations identified will be subject to:
1. Risk Assessment
Organisations must assess and maintain the risks to essential service delivery, with consideration for ‘all hazards’ and where risks arise from dependencies on third parties and other infrastructure.
2. Resilience Measures & Planning
Document and implement measures to prevent disruption and protect critical assets and services. Plans to respond and recover essential services must be established and tested and may require cross-functional recovery strategies and alternative suppliers.
3. Incident Notification
Notify responsible authorities within 24 hours of significant disruption and should expect to provide detailed follow-up reporting.
4. Compliance Enforcement
Critical Entities should expect to receive on-site inspections for compliance from national authorities, with penalties for non-compliance.
Driving Consistency Across the Organisation
Managing CERD compliance manually or in silos is unsustainable. Legacy approaches to risk have left many firms operating different methodologies across geographies, functions and risk categories – CERD compliance will require a holistic approach which ensures consistent assessment and planning across the enterprise, compatible with NIS2 and/or DORA methodologies, and grounded in accountability for prevention and response.
Operating models, methodologies and technologies that support the resilience of the organisation may need review. Entities that meet CERD obligations without disproportionate cost will build resilience into their organisation, and empower executives to confidently understand risk exposures, model impacts, and optimise response.
Moving Beyond Compliance
Real resilience requires a deep understanding of the interconnected dependencies within and beyond the organisation.
Take a regional flooding event affecting a pharmaceutical manufacturing site, a logistics hub, and key transport routes. Suppliers, physical distribution networks and staff are all severely disrupted, while external stakeholders – public authorities and healthcare providers – expect prompt and transparent updates to enable them to manage the broader impact to the public.
An effective response to this scenario requires the whole organisation to be joined up in preparations before disruption occurs, during the disruption itself, and when orchestrating recovery. Consistency is key to this; from risk assessment and response planning to cross-functional coordination and external communications. Response strategies should extend beyond the organisation to the suppliers who are essential to continued operation, and stakeholders in society who depend on services provided by the Critical Entity.
Summary
While uncertainty persists in the world, resilience will remain on the agenda of global lawmakers and regulators. Building meaningful enterprise resilience across all domains must therefore be an executive priority – supported by holistic frameworks and technologies that look beyond singular risks, threats, and regulations – and towards the sustainable protection of economic value and societal outcomes.
More on
About the author
-
Rex Erby
EMEA & APAC Alliances, Fusion Risk Management UK Ltd.
-
Adriana Vilan
Resilience - Business Continuity & Crisis Manager
-
Bram van Tiel
Partner, PwC
