Compliance tools · Cybersecurity and data protection

CER Directive compliance tool

Directive (EU) 2022/2557 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your CER Directive documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

CER Directive is Directive (EU) 2022/2557, a binding instrument in the European Union. Physical resilience obligations for critical infrastructure entities.

The free assessment screens for CER Directive when a business operates in a critical or essential sector. The Directive binds an entity once its Member State has identified it as a critical entity.

Sectors this instrument reaches: energy; transport; banking; financial market infrastructure; health; drinking water; waste water; digital infrastructure; public administration; space; food production, processing and distribution.

Screen your business against all 116 agent toolkits, free →

• Your exact position under CER Directive: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that CER Directive applies to your business, free →

Does CER Directive apply to my business?

You are covered if your organisation operates in one of the eleven Annex sectors and your Member State identifies you as a critical entity under Article 6. Identification uses the criteria in Article 7(1), so the trigger is the national identification decision, not the sector alone.

Who does CER Directive apply to?

The Directive applies to public and private entities that Member States identify as critical entities in the Annex sectors under Article 6. Member States, competent authorities, the Commission and the Critical Entities Resilience Group carry the institutional obligations.

Does CER Directive apply to a small business?

The Directive sets no size threshold for being a critical entity. Article 4(2)(h) requires Member States to describe measures easing Chapter III obligations for SMEs identified as critical entities, and Article 10(1) allows financial resources for critical entities including SMEs.

When does CER Directive apply from, and what are the deadlines?

National transposition measures applied from 18 October 2024 under Article 26(1). Chapter III duties apply from 10 months after an entity receives its identification notification under Article 6(3), with the first risk assessment due within nine months of that notification under Article 12(1).

What does CER Directive require me to do?

A critical entity must carry out a risk assessment under Article 12(1), take resilience measures under Article 13(1), keep a resilience plan under Article 13(2), designate a liaison officer under Article 13(3), arrange background checks under Article 14(1), notify incidents under Article 15(1) and report cross-border essential service provision under Article 17(2).

What records or documents does CER Directive require me to keep or produce?

The entity must maintain a resilience plan or equivalent documents describing the Article 13(1) measures, under Article 13(2). The plan is the primary evidence of compliance during supervisory inspections and audits under Article 21, and background checks must corroborate identity and check criminal records under Article 14(3).

What happens if I do not comply with CER Directive?

Article 22 leaves penalty rules to Member States, which must be effective, proportionate and dissuasive, with no EU-level fine amounts set. Competent authorities may order remedial measures for infringements under Article 21(3) and may inspect, supervise and audit under Article 21(1).

Does CER Directive apply to a UK business selling into the EU?

The Directive applies across Union territory to Member States and critical entities operating within the Union under Article 1. The instrument does not state how it applies to a UK business selling into the EU.

Does CER Directive apply to an EU business selling into the UK?

The Directive applies to critical entities operating within the Union under Article 1, and identification is carried out by the Member State concerned under Article 6. The instrument does not state how it applies to an EU business selling into the UK.

How is CER Directive different from DORA?

Under Article 8, critical entities in banking (sector 3) and financial market infrastructure (sector 4) are exempt from Article 11 and Chapters III, IV and VI because DORA already imposes resilience requirements on financial entities.

How do I start complying with CER Directive?

The first practical step is the entity risk assessment, which must be carried out within nine months of the identification notification under Article 12(1). The resilience plan under Article 13(2) then documents the Article 13(1) measures taken.

Which ComplianceSME account includes the CER Directive toolkit?

The CER Directive agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · DORA