32022L2557

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC

Gerð á tungumálum ESB: OJ L 333, 27.12.2022, p. 164

Þýðing EES-gerðar birtist hér á íslensku við upptöku í EES-samninginn og birtingu í EES-viðbæti.

Gerð ekki til á íslensku

Tillaga sem gæti verið EES-tæk
Gerð í skoðun hjá EES-EFTA ríkjunum
Drög að ákvörðun sameiginlegu nefndarinnar í skoðun
Ákvörðun sameiginlegu nefndarinnar samþykkt en hefur ekki öðlast gildi
Tekin upp í EES-samninginn og í gildi
Tekin upp í EES-samninginn en ekki lengur í gildi

Staða og svið tillögu/gerðar

Staða tillögu/gerðar	ESB gerð í skoðun hjá Íslandi, Liechtenstein og Noregi til upptöku í EES-samninginn
Svið (EES-samningur, bókun)	31 um samvinnu á sérstökum sviðum utan marka fjórþætta frelsisins

Staða innan stjórnsýslunnar

Stofnun hefur lokið yfirferð	Á ekki við
Þörf á aðlögun í ákvörðun sameiginlegu nefndarinnar	Ekki þörf á aðlögun
Fagráðuneyti hefur lokið vinnu við upplýsingablað og samþykkir drög að ákvörðun sameiginlegu nefndarinnar	Nei
Alþingi hefur lokið mati sínu	Nei
Utanríkisráðuneyti hefur veitt samþykki fyrir því að drög að ákvörðun sameiginlegu nefndarinnar séu send til ESB	Nei

Innleiðing

Innleiðing	Engar laga- eða reglugerðabreytingar
Staða innleiðingarvinnu	Innleiðing ekki hafin

Samráð

Samráð	Nei

Áhrif

Áætlaður kostnaður hins opinbera	Ekki vitað

Ábyrgðaraðilar

Ábyrgt ráðuneyti	Dómsmálaráðuneytið

Samþykktar gerðir birtar í Stjórnartíðindum ESB

CELEX-númer	32022L2557
Þennan dag skulu skilyrði uppfyllt í ESB	14.12.2022
Samþykkt tilvísun í Stjórnartíðindi ESB	OJ L 333, 27.12.2022, p. 164
Þennan dag skulu skilyrði uppfyllt í ESB	17.10.2024

Vinnslustig (pipeline stage)

COM numer	COM(2020) 829
Dagsetning tillögu ESB	16.12.2020
Dagsetning tillögu	16.12.2020
Samþykktardagur i ESB	17.10.2024

Tillögur að breytingum (Proposed amendments)

COM(2025) 837 52025PC0837	Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus)	Tillaga sem gæti verið EES-tæk
COM(2025) 502 52025PC0502	Proposal for a Directive of the European Parliament and of the Council amending Directives 2014/65/EU and (EU) 2022/2557 as regards the extension of certain mitigating measures available for small and medium sized enterprises to small mid-cap enterprises and further simplifying measures	Tillaga sem gæti verið EES-tæk

Breytt af (Modified by)

72014L0054CZE_211450	measure national implementing implements
72014L0051CZE_211450	measure national implementing implements
72014L0049CZE_211450	measure national implementing implements
72014L0040CZE_211450	measure national implementing implements
72014L0036CZE_211450	measure national implementing implements

Breytir (Modifies)

COM(2020) 829 52020PC0829	adopts	Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC	Gerð í skoðun hjá EES EFTA-ríkjunum
32008L0114	repeals	Council Directive 2008/114/EC on the identification and designation of European Critical Infrastructures and the assessment of the need to improve their protection	Tekin upp í EES-samninginn og í gildi

Samantekt EUR-Lex

WHAT IS THE AIM OF THE DIRECTIVE?

The directive aims to:

reduce vulnerabilities and strengthen the physical resilience¹ of critical entities in the European Union (EU) in order to ensure the unobstructed provision of services that are essential for the economy and society as a whole;
increase the resilience of the critical entities that provide these services.

KEY POINTS

EU Member States must, following a risk assessment, identify critical entities providing services that are essential for the maintenance of functions vital to society, the economy, public health and safety, or the environment, and where an incident would have significant disruptive effects on these essential services. This covers entities in the following sectors:

energy, including electricity, district heating, oil, gas and hydrogen operators;
transport by air, rail, water and road, including public transport;
banking, which is also subject to Regulation (EU) 2022/2554 (the Digital Operational Resilience Act – see summary);
financial market infrastructure, including trading venues, also subject to the Digital Operational Resilience Act;
health, including healthcare providers, basic pharmaceutical product and critical device manufacturers and research and development of medicinal products;
drinking water suppliers and distributors;
wastewater disposal and treatment;
digital infrastructure, including electronic communication services and data centres, which is also subject to Directive (EU) 2022/2555 (see summary);
public administration entities at the central government level, excluding national security, public security, defence and law enforcement;
space operators of ground-based infrastructure; and
food businesses engaged exclusively in logistics and wholesale distribution and in large-scale industrial production and processing.

It should be noted that certain parts of the directive do not apply to entities in the banking, financial market infrastructure and digital infrastructure sectors.

Each Member State must:

adopt a national strategy and carry out regular risk assessments;
taking into account the outcome of the risk assessments, identify entities that rely on critical infrastructure to provide essential services to society, the economy, public health and safety, or the environment;
support the identified critical entities in enhancing their resilience with, for instance, guidance material, exercises, advice and training;
ensure that national authorities have the powers, resources and means to carry out their supervisory tasks, including conducting on-site inspections of critical entities and introducing penalties for non-compliance as part of an enforcement mechanism;
specify the conditions under which a critical entity can submit requests for background checks on personnel holding sensitive roles.

Member States must identify the critical entities for the sectors and subsectors set out in the Annex to the directive by 17 July 2026.

Critical entities must:

carry out risk assessments of their own to identify risks that could disrupt their ability to provide essential services;
take technical, security and organisational measures to enhance their resilience;
report significant disruptive incidents to the national authorities.

If critical entities provide essential services in or to six or more Member States, they may benefit from extra advice in the form of advisory missions that evaluate the risk assessment and the resilience-enhancing measures that the entity has put in place.

Delegated act

The European Commission adopted Delegated Regulation (EU) 2023/2450, establishing a non-exhaustive list of essential services in the abovementioned sectors and subsectors. Member States’ competent authorities are to use this list for the purpose of carrying out a risk assessment, and the risk assessment is thereafter to be used for the purpose of identifying critical entities.

The Critical Entities Resilience Group facilitates cooperation among Member States, including sharing information and good practices.

The Commission provides support, including on cross-sectoral risks, best practices, methodologies, cross-border training and exercises to test the resilience of critical entities.

FROM WHEN DO THE RULES APPLY?

The directive has to be transposed into national law by 17 October 2024. These rules should apply from 18 October 2024.

BACKGROUND

The Commission’s EU security union strategy and the counter-terrorism agenda for the EU stress the importance of ensuring the resilience of critical entities in the face of physical and digital risks.

This directive is part of a package of legislative measures to improve the resilience and incident-response capacities of public and private entities in the EU in the fields of cybersecurity and critical infrastructure protection.

The Council also issued a recommendation on an EU-wide coordinated approach to strengthen the resilience of critical infrastructure in January 2023.

For further information, see:

How the EU responds to crises and builds resilience (European Council, Council of the European Union)
Critical infrastructure (European Commission).

KEY TERMS

Resilience. The capacity to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from incidents that may be caused by, among other things, natural disasters such as public health emergencies or human-made threats such as terrorism, sabotage or hybrid threats. Hybrid threats arise when state or non-state actors seek to exploit the vulnerabilities of critical infrastructure by using a mixture of measures (i.e. diplomatic, military, economic, technological) in a coordinated way while remaining below the threshold of formal warfare, for example mass disinformation campaigns that hinder the democratic process in elections.

MAIN DOCUMENT

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (OJ L 333, 27.12.2022, pp. 164–198).

Flokkun (Classifications)

EUROVOC	provision of services, single market, European security, exchange of information, risk management, critical infrastructure security
Subject matter	Common foreign and security policy