Transposition of the CER Directive in the EU Member States

Notes · Applies from 1 March 2026. The authority is the Federal Ministry of the Interior; the implementing ordinance (RKEV, BGBl. II Nr. 91/2026) applies from 15 April 2026. In January 2026 the Ministry presented the national strategy for the resilience of critical entities (ÖSRKE 2026, as of 16 January 2026) together with the national risk assessment. Critical entities, identified by administrative decision, must carry out their own risk analysis within nine months; after ten months the resilience plan and the duty to report incidents within 24 hours apply.

Notes · Replaces the Law of 1 July 2011 on the security and protection of critical infrastructure. Passed by the Chamber on 18 December 2025, it entered into force on the day of its publication in the Moniteur belge.

Notes · The Ministry of the Interior put the draft to public consultation from 27 May to 26 June 2025; no bill has yet been tabled in Parliament. Referred to the Court of Justice on 29 April 2026.

Notes · New Critical Infrastructure Act, replacing the 2013 act.

Notes · Transposed by regulations made under the Civil Defence Law, in force from publication in the Official Gazette.

Notes · New Critical Infrastructure Act, published on the same day as the NIS 2 transposing law.

Notes · For the energy sector, transposition is completed by Act No 258 of 6 March 2025.

Notes · Transposed on time by the 2024 act, which amended the Emergency Act (Hädaolukorra seadus) and related laws. From 1 October 2026 the Emergency Act is repealed and replaced by the Crisis Situation and National Defence Act (Kriisiolukorra ja riigikaitse seadus, KORKS, RT I, 30.06.2026, 1), which now contains the transposing rules on vital services and their providers and has its own entry in the database. Designated providers must draw up a risk analysis within nine months and a crisis plan within ten months of designation, report unplanned interruptions and events that significantly disrupt the continuity of the service within 24 hours, and submit a detailed report within one month of the end of the event. Providers already designated under the old law keep that status, with the deadlines it set. The 2024 act is shown here because it is the act by which the directive was transposed on time.

Notes · Act on the protection and resilience of society's critical infrastructure.

Notes · The same bill transposes NIS 2, CER and part of DORA. Adopted by the Senate on 12 March 2025; on 6 October 2026 the National Assembly plenary debate was withdrawn from the agenda, and the Conference of Presidents of 27 October 2026 did not reschedule it (agenda set up to the week of 16 November). Meanwhile the Defence Code's scheme for activities of vital importance (SAIV) remains. Referred to the Court of Justice on 29 April 2026.

Notes · Germany's first framework law on the physical protection of critical infrastructure; the central authority is the Federal Office of Civil Protection (BBK). Article 8 of the Act of 21 July 2026 (BGBl. 2026 I Nr. 221) removed the reference to 17 July 2026 and tied the deadlines to the regulation identifying critical facilities (§ 4(3) and § 5(1)); operators register with the BBK within three months of a facility being considered critical, and the risk assessment and resilience obligations apply nine or ten months after registration. According to the BBK, at the end of October 2026 the regulation was still being drafted, so no registration obligation applied yet.

Notes · In force from publication in the Government Gazette (Art. 29). The authority is the General Secretariat for the Protection of Critical Entities. The link points to a private legal database: the official text is in the Gazette issue shown.

Notes · Act on the resilience of critical entities, published in the Magyar Közlöny of 20 December 2024.

Notes · Transposed on time by ministerial regulations; the single point of contact is the Office of Emergency Planning.

Notes · Transposed on time. The coordinating authority is the Presidency of the Council of Ministers, together with the sectoral administrations. On 11 June 2026 the Government published the first National Strategy for the Resilience of Critical Entities (dated April 2026).

Notes · Transposed by amending the National Security Law; Cabinet Regulation No 10 of 13 January 2026 implements it.

Notes · Transposed by amending the Crisis Management and Civil Protection Act. The link points to the consolidated text.

Notes · Passed by the Chamber of Deputies on 28 April 2026, the day before the referral to the Court of Justice. The authority is the High Commission for National Protection.

Notes · Order (Subsidiary Legislation 460.43) published on 16 January 2026; Legal Notice 23 of 2026 set its entry into force for 23 January 2026.

Notes · Passed by the Senate on 7 July 2026, after the referral to the Court of Justice of 29 April; it entered into force together with the NIS 2 transposing law (Cyberbeveiligingswet). The implementing decree (Besluit weerbaarheid kritieke entiteiten, Stb. 2026, 190) set the entry into force at 15 August 2026. As the act entered into force after 17 July 2026, the first designations of critical entities and the first national risk assessment were due within one month.

Notes · Transposed by amending the Crisis Management Act; published in the Journal of Laws (Dziennik Ustaw) on 19 June 2026, after the referral to the Court of Justice, and in force since 4 July 2026. The competent authorities must identify critical entities for the first time within nine months of entry into force.

Notes · Decree-Law on the resilience of critical entities. The authority is the Secretary-General of the Internal Security System; the national strategy was approved by Council of Ministers Resolution 135/2026.

Notes · The authority is the Coordination Centre for Critical Infrastructure Protection (CNCPIC).

Notes · New Critical Infrastructure Act, replacing Act 45/2011.

Notes · New Critical Infrastructure Act, replacing the 2017 ZKI.

Notes · The bill, approved by the Council of Ministers on 17 March 2026 and tabled in Congress the next day, was before the Interior Committee with full legislative competence; it lapsed when the Cortes were dissolved on 6 October 2026 (Royal Decree 806/2026, elections on 29 November 2026) and will have to be reintroduced in the new legislature. It would replace Law 8/2011 and the CNPIC with a new centre (CNPREC); meanwhile Law 8/2011 remains in force. Referred to the Court of Justice on 29 April 2026.

Notes · The Government tabled the bill on 14 July 2026, proposing entry into force on 1 January 2027. The Riksdag Committee on Defence is examining it in report 2026/27:FöU4; the plenary vote is scheduled for 25 November 2026. Referred to the Court of Justice on 29 April 2026.