Two directives, one operator
The Critical Entities Resilience Directive, Directive (EU) 2022/2557 (CER), covers physical, all-hazards resilience: storms, floods, sabotage and the failure of a supplier. The NIS2 Directive, Directive (EU) 2022/2555, covers cybersecurity. They were written separately, but they meet in the same control room. Under NIS2, an entity identified as critical under CER is automatically an essential entity (NIS2, Article 3).
Member States had to identify their critical entities by 17 July 2026. For many operators of energy, water, transport and telecoms networks, that means both directives now apply to the same people, the same assets and the same incidents.
What the clocks ask
Both directives start a clock when a significant incident happens. The first step is due within a day under each of them.
| Directive | Within 24 hours | Within 72 hours | Within one month |
|---|---|---|---|
| CER · Article 15 | Initial notification | No separate step | Detailed report |
| NIS2 · Article 23 | Early warning | Incident notification | Final report |
Nine months to the risk assessment
CER also sets a clock that starts with notification, not with an incident. A critical entity must complete its own risk assessment within nine months of being notified (Article 12), and the obligations in Chapter III apply ten months after notification (Article 6(3)). For entities notified in mid-2026, that lands around the second quarter of 2027, depending on the Member State.
What has to be ready when the clock starts
Twenty-four hours is not long. The first notice is easier to write, and the full report easier to defend, when the facts already sit together: which service was affected, how many people, which assets, what was done and who approved it. In most operations those facts live in different places: the control room, the map, the work-order system and the contact centre.
The record that supports the notification should be built while the incident unfolds, not pieced together afterwards.
