Protecting essential infrastructure: MEP approve deal on new rules with broader scope

Parliament and EU member states’ negotiators have agreed on new rules to make the EU’s essential infrastructure more resilient.

Negotiating teams from the European Parliament and the Council of the EU reached a deal on the resilience of essential infrastructure. The new rules would establish harmonised minimum rules to ensure that different member states classify the same providers as essential, and risk assessments for essential infrastructure to boost its resilience in the face of disruptions and hazards. The scope would be expanded to eleven sectors in total, including energy, transport, banking, financial market infrastructures, health, drinking water, waste water, food, digital infrastructure and space. At Parliament’s request, public administration was also included in the scope of the rules.

Under the new rules, critical service-providers would have to carry out risk assessments of their own and report disruptive incidents. Also, Member States would be required to adopt national strategies for boosting resilience and carry out regular risk assessments. National authorities should have the possibility to conduct on-site inspections of critical infrastructure, and introduce penalties in case of non-compliance.

To harmonise communication, each member state should designate a single point of contact to act as liaison and ensure functioning cross-border cooperation.

MEPs pushed for broader scope

In the negotiations, MEPs wished to widen the definition of essential services to also include the environment and public health and safety, which were adopted. They also managed to include consideration of rule of law in the context of resilience against threats and risks. The directive will therefore also address possible threats affecting the functioning of national systems that safeguard the rule of law.

To smoothen cross-border co-operation, MEPs wanted to lower the threshold of recognising service providers as having “European significance”. In the end, it was agreed that the threshold be lowered from ten or more member states (in the Commission proposal) to six or more, which will cover several hundreds of critical entities of the European significance across the Union. At the same time, MEPs wanted to ensure coherence between the present directive and the NIS2 directive on cybersecurity.

After the vote, rapporteur Michal Šimečka (Renew, SK) said: “Against the backdrop of the pandemic and Russia’s war in Ukraine, securing Europe’s critical infrastructure has become a top priority. Today’s agreement will boost the resilience of critical entities, and as the Parliament’s lead negotiator, I pushed to include in the scope of the regulation new and vital sectors, including food production and distribution and public administration. I’m also satisfied that we retained a key provision that will allow Member States to develop a common understanding of what services are essential in any crisis scenario. We, as the Parliament, must not let fragmentation and divergence in national rules stand to weaken the resilience of European societies from increasingly frequent physical and hybrid threats.”


In the previous directive on critical infrastructures, only energy and transport were within the scope of common rules. The European Parliament called for the revision of previous directive in a resolution on the findings of the Special Committee on Terrorism in 2018. On 16 December 2020, the European Commission published its proposal for a new directive on the resilience of critical entities.

Political agreement on new rules to enhance the resilience of critical entities

As a key part of the EU's work to build a Security Union, the new rules will strengthen the resilience of critical infrastructure to a range of threats, including natural hazards, terrorist attacks, insider threats, or sabotage, as well as public health emergencies like the recent COVID-19 pandemic.

Against an ever more complex risk landscape, the new Directive replaces the European Critical Infrastructure Directive of 2008. A wider sectoral scope will allow Member States and critical entities to better address interdependencies and potential cascading effects of an incident. Eleven sectors will be covered: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food.

Vice-President for Promoting our European Way of Life, Margaritis Schinas, said: “It is essential to shield our economy and our society against physical threats that could disrupt services that are vital for people's daily lives and for the functioning of our internal market. With today's agreement, we are delivering on our commitment to enhance the resilience of critical infrastructure in the EU, complementing the recently strengthened cybersecurity legislation. Together, these new rules form a coherent and robust system to protect our infrastructure online and off”.

Commissioner for Home Affairs, Ylva Johansson, said: “In the light of the current geopolitical situation in Europe, enhancing our resilience is of key importance. The CER Directive will make us better prepared against disruptions that impact the security of our citizens and the prosperity of the internal market, following the lessons learnt from the pandemic and long-term challenges like climate change. The new Directive will ensure the provision of essential services such as energy, transport, water and healthcare while minimising the impact of natural and man-made incidents”.

The proposal introduces new rules to strengthen the resilience of critical entities:

- Member States will need to adopt a national strategy and carry out regular risk assessments to identify entities that are considered critical or vital for the society and the economy.
- Critical entities will need to carry out risk assessments of their own, take technical and organisational measures to enhance their resilience and notify incidents. They will also be able to request background checks on personnel holding sensitive roles.
- Critical entities in the EU, from the sectors covered, providing essential services in six Member States or more, will benefit from extra advice on how best to meet their obligations to assess risks and take resilience-enhancing measures.
- A Critical Entities Resilience Group will facilitate cooperation among Member States and the exchange of information and good practices.
- An enforcement mechanism will help ensure that the rules are followed: Member States will need to ensure that national authorities have the powers and means to conduct on-site inspections of critical entities. Member States will also introduce penalties in case of non-compliance.
- Member States will need to provide support to critical entities in enhancing their resilience with, for instance, guidance material. The Commission will provide complementary support to Member States and critical entities, by developing a Union-level overview of cross-border and cross-sectoral risks, best practices, methodologies, cross-border training activities and exercises to test the resilience of critical entities, among others.

Next steps

The political agreement reached by the European Parliament and the Council is now subject to formal approval by the co-legislators. Once published in the Official Journal, the Directive will enter into force 20 days after publication. Member States will then need to transpose the elements of the Directive into national law within 21 months.

New EU Regulation on Gas Storage

New storage legislation adopted will strengthen the EU's security of gas supply in view of the upcoming and next winters. Faced with the threat of supply disruptions by Russia, the EU Gas Storage Regulation requires that Europe's gas reserves are refilled before the winter, and their management protected from outside interference. In particular, the new rules will require the EU Member States to fill storage facilities to 80% of capacity by November this year – and to 90% in the years after.

The rules were adopted in record time thanks to the Parliament and Council's readiness to examine the legislative proposal as a matter of urgency, against the backdrop of Russia's war against Ukraine.

Welcoming the adoption at the Energy Council in Luxembourg, Commissioner for Energy, Kadri Simson, said: I would like to pay tribute to the positive and constructive approach that the Parliament and Council have shown on this proposal. This is an important statement of EU unity, determination and speed of action in the face of the Kremlin's moves to weaponise their gas exports. It is now crucial that we press on with meeting the new storage targets and step up our preparedness in case the situation further deteriorates.”

Under the new legislation, the 18 Member States with underground gas storage facilities are required to fill 80% of their storage capacity by 1 November – and are encouraged to aim for 85%. In the coming years, the target will be 90%. Member States without storage infrastructure are required to agree bilateral arrangements for sufficient quantities to be stored for their use in neighbouring countries, in a spirit of solidarity. Gas storage facilities will now be considered critical infrastructure and all storage operators in the EU will have to go through a new certification process to reduce the risks of outside interference.

EC adopts Contingency Plan for Transport

The European Commission adopted a Contingency Plan for Transport to strengthen the resilience of EU transport in times of crisis. The plan draws lessons from the COVID-19 pandemic as well as taking into account the challenges the EU transport sector has been facing since the beginning of Russia's military aggression against Ukraine. Both crises have severely affected the transport of goods and people, but the resilience of this sector and the improved coordination between member states were key to the EU's response to these challenges.

Commissioner for Transport Adina Vălean said: “These challenging and difficult times remind us of the importance of our EU transport sector and the need to work on our preparedness and resilience. The COVID-19 pandemic was not the first crisis with consequences for the transport sector, and Russia's illegal invasion of Ukraine shows us that it will definitely not be the last. This is why we need to be ready. Today's Contingency Plan, notably based on lessons learnt and initiatives taken during the COVID-19 pandemic, creates a strong framework for a crisis-proof and resilient EU transport sector. I firmly believe that this plan will be a key driver for transport resilience since many of its tools have already proven essential when supporting Ukraine – including the EU-Ukraine Solidarity Lanes, which are now helping Ukraine export its grain.”

10 actions to draw lessons from recent crises

The plan proposes a toolbox of 10 actions to guide the EU and its Member States when introducing such emergency crisis-response measures. Among other actions, it highlights the importance of ensuring minimum connectivity and passenger protection, building resilience to cyberattacks, and resilience testing. It also stresses the relevance of the Green Lanes principles, which ensure that land freight can cross borders in less than 15 minutes, and reinforces the role of the Network of Contact Points in national transport authoritiesBoth have proved crucial during the COVID-19 pandemic, as well as in the current crisis caused by Russian aggression against Ukraine.

The 10 areas of action are:

1 Making EU transport laws fit for crisis situations
2 Ensuring adequate support for the transport sector
3 Ensuring free movement of goods, services and people
4 Managing refugee flows and repatriating stranded passengers and transport workers
5 Ensuring minimum connectivity and passenger protection
6 Sharing transport information
7 Strengthening transport policy coordination
8 Strengthening cybersecurity
9 Testing transport contingency
10 Cooperation with international partners

One key lesson from the pandemic is the importance of coordinating crisis response measures – to avoid, for example, situations where lorries, their drivers and essential goods are stuck at borders, as observed during the early days of the pandemic. The Contingency Plan for Transport introduces guiding principles that ensure crisis response measures are proportionate, transparent, non-discriminatory, in line with the EU Treaties, and able to ensure the Single Market continues to function as it should.

Next steps

The Commission and the Member States will use this Contingency Plan to respond to current challenges affecting the transport sector. The Commission will support Member States and steer the process of building crisis preparedness in cooperation with the EU agencies, by coordinating the Network of National Transport Contact Points and maintaining regular discussions with international partners and stakeholders. To respond to immediate challenges and ensure Ukraine can export grain, but also import the goods it needs, from humanitarian aid, to animal feed and fertilisers, the Commission will coordinate the Solidarity Lanes contact points network and the Solidarity Lanes matchmaking platform.