Critical entities: you are in scope when your state says so

Who it applies to

Companies in eleven Annex sectors, across 52 categories of entities. Only once your own state identifies you.

The dates

Each state had to identify its critical entities by 17 July 2026. Your duties begin the day it notifies you.

The one thing to do

Assess your risks within nine months of that notification, write a resilience plan, name a liaison officer, and notify an incident in 24 hours.

The determination on its own page

This Directive reaches a company only through its own member state. It is in scope when that state identifies it as a critical entity and notifies it under Article 6(3), and not before. Being in the Annex makes you a candidate.

Which states have an act

21 of 27 have notified an act that transposes this Directive, 3 have notified measures that are something else, and 3 have notified nothing. The Directive's own date for a state's law was 17 October 2024.

Without a transposing act:

• Bulgaria · nothing notified
• Estonia · 23 measures notified, none transposing
• France · 22 measures notified, none transposing
• Lithuania · 15 measures notified, none transposing
• Spain · nothing notified
• Sweden · nothing notified

The eleven sectors

The Annex lists 52 categories of entities across eleven sectors. A company outside all of them cannot be identified.

• 1Energy · Electricity, District heating and cooling, Oil, Gas, Hydrogen
• 2Transport · Air, Rail, Water, Road, public transport
• 3Banking
• 4Financial market infrastructure
• 5Health
• 6Drinking water
• 7Waste water
• 8Digital infrastructure
• 9Public administration
• 10Space
• 11Production, processing and distribution of food

What your state is looking for

Commission Delegated Regulation (EU) 2023/2450 lists 64 essential services across those sectors. Article 6(2) has the state assess whether an entity provides one or more of them.

• 1.a.isupply of electricity (electricity undertakings) · electricity subsector
• 1.a.iioperation, maintenance and development of an electricity distribution system (distribution system operators) · electricity subsector
• 1.a.iiioperation, maintenance and development of an electricity transmission system (transmission system operators) · electricity subsector
• 1.a.ivgeneration of electricity (producers) · electricity subsector
• 1.a.vnominated electricity market operator service (nominated electricity market operators) · electricity subsector
• 1.a.videmand response (electricity market participants) · electricity subsector
• 1.a.viiaggregation of electricity (electricity market participants) · electricity subsector
• 1.a.viiienergy storage (electricity market participants) · electricity subsector
• 1.bprovision of district heating or district cooling (operators of district heating or district cooling) · district heating and cooling subsector
• 1.c.ioil transmission (operators of oil transmission pipelines) · oil subsector
• 1.c.iiproduction of oil (operators of oil production) · oil subsector
• 1.c.iiirefinement and treatment of oil (operators of oil refining and treatment facilities) · oil subsector
• 1.c.ivoil storage (operators of oil storage) · oil subsector
• 1.c.vmanagement of oil stocks, including emergency stocks and specific oil stocks (central stockholding entities) · oil subsector
• 1.d.isupply of gas (supply undertaking) · gas subsector
• 1.d.iidistribution of gas (distribution system operators) · gas subsector
• 1.d.iiitransmission of gas (transmission system operators) · gas subsector
• 1.d.ivstorage of gas (storage system operators) · gas subsector
• 1.d.voperation of a liquified natural gas (LNG) system (LNG system operators) · gas subsector
• 1.d.viproduction of natural gas (natural gas undertakings) · gas subsector
• 1.d.viipurchase of natural gas (natural gas undertakings) · gas subsector
• 1.d.viiirefinement and treatment of natural gas (operators of natural gas refining and treatment facilities) · gas subsector
• 1.e.iproduction of hydrogen (operators of hydrogen production) · hydrogen subsector
• 1.e.iistorage of hydrogen (operators of hydrogen storage) · hydrogen subsector
• 1.e.iiitransmission of hydrogen (operators of hydrogen transmission) · hydrogen subsector
• 2.a.iair transport services used for commercial purposes (passenger and cargo) (air carriers) · air subsector
• 2.a.iioperation, management and maintenance of airports and of airport network infrastructure (airport managing bodies) · air subsector
• 2.a.iiiair traffic control services (traffic management control operators) · air subsector
• 2.b.irailway transport services (passenger and freight) (railway undertakings) · rail subsector
• 2.b.iioperation, management and maintenance of railway infrastructure, including passenger stations, freight terminals, railway yards and traffic control centres (infrastructure managers) · rail subsector
• 2.b.iiioperation, management and maintenance of railway service facilities (operators of service facilities) · rail subsector
• 2.b.ivoperation, management and maintenance of rail traffic management, control-command and signalling as well as telecommunication installations and systems used for control-command and signalling (infrastructure managers) · rail subsector
• 2.c.iinland, sea and coastal water transport services (passenger and freight) (inland, sea and coastal passenger and freight water transport companies) · water subsector
• 2.c.iioperation, management and maintenance of port and port facilities, and operation of works and equipment within ports, including bunkering, cargo-handling, mooring, passenger services, collection of ship-generated waste and cargo residues, pilotage and towage (managing bodies of ports and entities operating works and equipment contained within ports) · water subsector
• 2.c.iiivessel traffic services (operators of vessel traffic services) · water subsector
• 2.d.itraffic management control, including aspects related to road network planning, control and management services, excluding traffic management or the operation of intelligent transport systems where they are not an essential part of the general activity of public entities (road authorities) · road subsector
• 2.d.iiIntelligent Transport Systems services (operators of Intelligent Transport Systems) · road subsector
• 2.epublic passenger transport services by rail and other track-based modes and by road (public service operators) · public transport subsector
• 3.itaking deposits (credit institutions) · banking sector
• 3.iilending (credit institutions) · banking sector
• 4.ioperation of a trading venue (operators of trading venues) · financial market infrastructure sector
• 4.iioperation of clearing systems (central counterparties) · financial market infrastructure sector
• 5.iprovision of healthcare services (healthcare providers) · health sector
• 5.iianalysis performed by a European Union reference laboratory (EU Reference laboratories) · health sector
• 5.iiiresearch and development of medicinal products (entities carrying out research and development activities of medicinal products) · health sector
• 5.ivmanufacturing of basic pharmaceutical products and of basic pharmaceutical preparations (entities manufacturing basic pharmaceutical products and pharmaceutical preparations) · health sector
• 5.vmanufacturing of medical devices considered as critical during a public health emergency (entities manufacturing medical devices) · health sector
• 5.vidistribution of medicinal products (entities holding a distribution authorisation) · health sector
• 6drinking water supply and drinking water distribution excluding distribution of water for human consumption where that service is a non-essential part of the general activity of distributors distributing other commodities and goods (suppliers and distributors of water intended for human consumption) · drinking water sector
• 7waste water collection, treatment and disposal excluding collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water where they are not an essential part of the general activities of undertakings (undertakings collecting, disposing of or treating urban waste water, domestic waste water and industrial waste water) · waste water sector
• 8.iprovision and operation of internet exchange point service (providers of internet Exchange Points) · digital infrastructure sector
• 8.iiprovision of domain name system (DNS) service excluding services related to root name servers (DNS service providers) · digital infrastructure sector
• 8.iiioperation and administration of top-level domain (TLD) name registries (TLD name registries) · digital infrastructure sector
• 8.ivprovision of cloud computing services (providers of cloud computing services) · digital infrastructure sector
• 8.vprovision of data centre service (providers of data centre services) · digital infrastructure sector
• 8.viprovision of content delivery networks (providers of content delivery networks) · digital infrastructure sector
• 8.viiprovision of trust services (trust service providers) · digital infrastructure sector
• 8.viiiprovision of publicly available electronic communications services (providers of electronic communications services) · digital infrastructure sector
• 8.ixprovision of public electronic communications networks (providers of public electronic communications networks) · digital infrastructure sector
• 9services provided by public administration entities within the meaning of Article 2, point (10), of Directive (EU) 2022/2557, of central governments as defined by Member States in accordance with national law (public administration entities of central governments) · public administration sector
• 10operation of ground-based infrastructure owned, managed and operated by Member States or by private parties that support the provision of space-based services, excluding providers of public electronic communication networks (operators of ground-based infrastructure) · space sector
• 11.ilarge-scale industrial food production and processing · production, processing and distribution of food sector (food businesses which are engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing)
• 11.iifood supply chain services, including storage and logistics · production, processing and distribution of food sector (food businesses which are engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing)
• 11.iiifood wholesale distribution · production, processing and distribution of food sector (food businesses which are engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing)

The list is non-exhaustive, by its own title. A service that is not on it can still be essential, so finding nothing of yours here leaves you where you were.

The duties, once you are identified

18 rows, in the Directive's order. Twenty-four of its twenty-nine articles address the member state; these are what reach a company.

• 6(3)You are a critical entity when your state tells you so · critical entity
• 12(1)Assess your risks within nine months, then every four years · critical entity
• 12(2)Cover natural and man-made risks, and your dependencies · critical entity
• 13(1)Take measures to prevent, protect, respond and recover · critical entity
• 13(2)Write a resilience plan, or use documents you already have · critical entity
• 13(3)Name a liaison officer for the competent authority · critical entity
• 14(1)You may ask for background checks on sensitive roles · critical entity
• 14(2)A check is proportionate and limited to what is necessary · critical entity
• 14(3)A check confirms identity and criminal records for the role · critical entity
• 15(1)Notify an incident in 24 hours, report within one month · critical entity
• 15(2)Say what happened, why, and what it may do across borders · critical entity
• 15(4)The authority sends follow-up, and may inform the public · critical entity
• 16States encourage European and international standards · critical entity
• 17(1)Six or more member states makes you of European significance · European significance
• 17(2)Tell your authority if you serve six or more member states · critical entity
• 21(1)The authority may inspect you on site and audit you · critical entity
• 21(3)The authority may order you to fix what it finds · critical entity
• 22Penalties are effective, proportionate and dissuasive · critical entity

Questions

Is my company a critical entity?

Only if your member state has identified you and notified you under Article 6(3). Each state had to do that by 17 July 2026, and none has to publish its list.

Does being in the Annex put us in scope?

No, not on its own. Until your state identifies you and notifies you, no duty under this Directive has arrived. It may identify you later, so the reading is not yet rather than never.

How long do we have once we are notified?

Nine months for the first risk assessment, then at least every four years. The resilience plan follows from it, and an incident is notified within 24 hours.

Is this the same as NIS2?

The same sectors and often the same authority, a different question. NIS2 asks whether your network and systems are secure; this asks whether the service keeps running.

What is an entity of particular European significance?

One that has been identified, provides the same or similar essential services in six or more member states, and has been told so by the Commission. All three.

Read from the Publications Office's CELLAR store, the database behind the Directive's national transposition tab on EUR-Lex, on 18 October 2026. Titles are quoted as communicated; the selection of the act named as the CER law is ours. Nothing on this page is legal advice.