@ansvar/eu-regulations-mcp 0.1.0 → 0.2.1

package/data/seed/cer.json

@@ -0,0 +1,233 @@
+{
+  "id": "CER",
+  "full_name": "Critical Entities Resilience Directive",
+  "celex_id": "32022L2557",
+  "eur_lex_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2557",
+  "articles": [
+    {
+      "number": "1",
+      "title": "Subject matter and scope",
+      "text": "1.   This Directive:\n\n(a)\n\nlays down obligations on Member States to take specific measures aimed at ensuring that services which are essential for the maintenance of vital societal functions or economic activities within the scope of Article 114 TFEU are provided in an unobstructed manner in the internal market, in particular obligations to identify critical entities and to support critical entities in meeting the obligations imposed on them;\n\n(b)\n\nlays down obligations for critical entities aimed at enhancing their resilience and ability to provide services as referred to in point (a) in the internal market;\n\n(c)\n\nestablishes rules:\n\n(i)\n\non the supervision of critical entities;\n\n(ii)\n\non enforcement;\n\n(iii)\n\nfor the identification of critical entities of particular European significance and on advisory missions to assess the measures that such entities have put in place to meet their obligations under Chapter III;\n\n(d)\n\nestablishes common procedures for cooperation and reporting on the application of this Directive;\n\n(e)\n\nlays down measures with a view to achieving a high level of resilience of critical entities in order to ensure the provision of essential services within the Union and to improve the functioning of the internal market.\n\n2.   This Directive shall not apply to matters covered by Directive (EU) 2022/2555, without prejudice to Article 8 of this Directive. In light of the relationship between the physical security and cybersecurity of critical entities, Member States shall ensure that this Directive and Directive (EU) 2022/2555 are implemented in a coordinated manner.\n\n3.   Where provisions of sector-specific Union legal acts require critical entities to take measures to enhance their resilience and where those requirements are recognised by Member States as at least equivalent to the corresponding obligations laid down in this Directive, the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VI, shall not apply.\n\n4.   Without prejudice to Article 346 TFEU, information that is confidential pursuant to Union or national rules, such as rules on business confidentiality, shall be exchanged with the Commission and other relevant authorities in accordance with this Directive only where that exchange is necessary for the application of this Directive. The information exchanged shall be limited to that which is relevant and proportionate to the purpose of that exchange. The exchange of information shall preserve the confidentiality of that information and the security and commercial interests of critical entities, while respecting the security of Member States.\n\n5.   This Directive is without prejudice to the Member States’ responsibility for safeguarding national security and defence and their power to safeguard other essential State functions, including ensuring the territorial integrity of the State and maintaining law and order.\n\n6.   This Directive does not apply to public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement, including the investigation, detection and prosecution of criminal offences.\n\n7.   Member States may decide that Article 11 and Chapters III, IV and VI, in whole or in part, do not apply to specific critical entities which carry out activities in the areas of national security, public security, defence or law enforcement, including the investigation, detection and prosecution of criminal offences, or which provide services exclusively to the public administration entities referred to in paragraph 6 of this Article.\n\n8.   The obligations laid down in this Directive shall not entail the supply of information the disclosure of which would be contrary to the essential interests of Member States’ national security, public security or defence.\n\n9.   This Directive is without prejudice to Union law on the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (28) and Directive 2002/58/EC of the European Parliament and of the Council (29).",
+      "chapter": "I"
+    },
+    {
+      "number": "2",
+      "title": "Definitions",
+      "text": "For the purposes of this Directive, the following definitions apply:\n\n(1)\n\n‘critical entity’ means a public or private entity which has been identified by a Member State in accordance with Article 6 as belonging to one of the categories set out in the third column of the table in the Annex;\n\n(2)\n\n‘resilience’ means a critical entity’s ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident;\n\n(3)\n\n‘incident’ means an event which has the potential to significantly disrupt, or that disrupts, the provision of an essential service, including when it affects the national systems that safeguard the rule of law;\n\n(4)\n\n‘critical infrastructure’ means an asset, a facility, equipment, a network or a system, or a part of an asset, a facility, equipment, a network or a system, which is necessary for the provision of an essential service;\n\n(5)\n\n‘essential service’ means a service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment;\n\n(6)\n\n‘risk’ means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;\n\n(7)\n\n‘risk assessment ’ means the overall process for determining the nature and extent of a risk by identifying and analysing potential relevant threats, vulnerabilities and hazards which could lead to an incident and by evaluating the potential loss or disruption of the provision of an essential service caused by that incident;\n\n(8)\n\n‘standard’ means a standard as defined in Article 2, point (1), of Regulation (EU) No 1025/2012 of the European Parliament and of the Council (30);\n\n(9)\n\n‘technical specification’ means a technical specification as defined in Article 2, point (4), of Regulation (EU) No 1025/2012;\n\n(10)\n\n‘public administration entity’ means an entity recognised as such in a Member State in accordance with national law, not including the judiciary, parliaments or central banks, which complies with the following criteria:\n\n(a)\n\nit is established for the purpose of meeting needs in the general interest and does not have an industrial or commercial character;\n\n(b)\n\nit has legal personality or is entitled by law to act on behalf of another entity with legal personality;\n\n(c)\n\nit is financed, for the most part, by the State authorities or by other central-level bodies governed by public law, is subject to management supervision by those authorities or bodies, or has an administrative, managerial or supervisory board, more than half of whose members are appointed by the State authorities or by other central-level bodies governed by public law;\n\n(d)\n\nit has the power to address to natural or legal persons administrative or regulatory decisions affecting their rights in the cross-border movement of persons, goods, services or capital.",
+      "chapter": "I"
+    },
+    {
+      "number": "3",
+      "title": "Minimum harmonisation",
+      "text": "This Directive shall not preclude Member States from adopting or maintaining provisions of national law with a view to achieving a higher level of resilience of critical entities, provided that such provisions are consistent with Member States’ obligations laid down in Union law.\n\nNATIONAL FRAMEWORKS ON THE RESILIENCE OF CRITICAL ENTITIES",
+      "chapter": "II"
+    },
+    {
+      "number": "4",
+      "title": "Strategy on the resilience of critical entities",
+      "text": "1.   Following a consultation that is, to the extent practically possible, open to relevant stakeholders, each Member State shall adopt by 17 January 2026 a strategy for enhancing the resilience of critical entities (the ‘strategy’). The strategy shall set out strategic objectives and policy measures, building upon relevant existing national and sectoral strategies, plans or similar documents, with a view to achieving and maintaining a high level of resilience on the part of critical entities and covering at least the sectors set out in the Annex.\n\n2.   Each strategy shall contain at least the following elements:\n\n(a)\n\nstrategic objectives and priorities for the purposes of enhancing the overall resilience of critical entities, taking into account cross-border and cross-sectoral dependencies and interdependencies;\n\n(b)\n\na governance framework to achieve the strategic objectives and priorities, including a description of the roles and responsibilities of the different authorities, critical entities and other parties involved in the implementation of the strategy;\n\n(c)\n\na description of measures necessary to enhance the overall resilience of critical entities, including a description of the risk assessment referred to in Article 5;\n\n(d)\n\na description of the process by which critical entities are identified;\n\n(e)\n\na description of the process supporting critical entities in accordance with this Chapter, including measures to enhance cooperation between the public sector, on the one hand, and the private sector and public and private entities, on the other hand;\n\n(f)\n\na list of the main authorities and relevant stakeholders, other than critical entities, involved in the implementation of the strategy;\n\n(g)\n\na policy framework for coordination between the competent authorities under this Directive (‘competent authorities’) and the competent authorities under Directive (EU) 2022/2555 for the purposes of information sharing on cybersecurity risks, cyber threats and cyber incidents and non-cyber risks, threats and incidents and the exercise of supervisory tasks;\n\n(h)\n\na description of measures already in place which aim to facilitate the implementation of obligations under Chapter III of this Directive by small and medium-sized enterprises within the meaning of the Annex to Commission Recommendation 2003/361/EC (31) that the Member State in question has identified as critical entities.\n\nFollowing a consultation that is, to the extent practically possible, open to relevant stakeholders, Member States shall update their strategies at least every four years.\n\n3.   Member States shall communicate their strategies, and substantial updates thereto, to the Commission within three months of their adoption.",
+      "chapter": "II"
+    },
+    {
+      "number": "5",
+      "title": "Risk assessment by Member States",
+      "text": "1.   The Commission is empowered to adopt a delegated act, in accordance with Article 23, by 17 November 2023 to supplement this Directive by establishing a non-exhaustive list of essential services in the sectors and subsectors set out in the Annex. The competent authorities shall use that list of essential services for the purpose of carrying out a risk assessment (‘Member State risk assessment’) by 17 January 2026, whenever necessary subsequently, and at least every four years. The competent authorities shall use Member State risk assessments for the purpose of identifying critical entities in accordance with Article 6 and assisting those critical entities to take measures pursuant to Article 13.\n\nMember State risk assessments shall account for the relevant natural and man-made risks, including those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid threats or other antagonistic threats, including terrorist offences as provided for in Directive (EU) 2017/541 of the European Parliament and of the Council (32).\n\n2.   In carrying out Member State risk assessments, Member States shall take into account at least the following:\n\n(a)\n\nthe general risk assessment carried out pursuant to Article 6(1) of Decision No 1313/2013/EU;\n\n(b)\n\nother relevant risk assessments, carried out in accordance with the requirements of the relevant sector-specific Union legal acts, including Regulations (EU) 2017/1938 (33) and (EU) 2019/941 (34) of the European Parliament and of the Council and Directives 2007/60/EC (35) and 2012/18/EU (36) of the European Parliament and of the Council;\n\n(c)\n\nthe relevant risks arising from the extent to which the sectors set out in the Annex depend on one another, including from the extent to which they depend on entities located within other Member States and third countries, and the impact that a significant disruption in one sector may have on other sectors, including any significant risks to citizens and the internal market;\n\n(d)\n\nany information on incidents notified in accordance with Article 15.\n\nFor the purposes of the first subparagraph, point (c), Member States shall cooperate with the competent authorities of other Member States and the competent authorities of third countries, as appropriate.\n\n3.   Member States shall make the relevant elements of Member State risk assessments available, where relevant through their single points of contact, to the critical entities that they have identified in accordance with Article 6. Member States shall ensure that the information provided to critical entities assists them in carrying out their risk assessments pursuant to Article 12 and in taking measures to ensure their resilience pursuant to Article 13.\n\n4.   Within three months of carrying out a Member State risk assessment, a Member State shall provide the Commission with relevant information on the types of risks identified following, and the outcomes of, that Member State risk assessment, per sector and subsector set out in the Annex.\n\n5.   The Commission shall, in cooperation with the Member States, develop a voluntary common reporting template for the purpose of complying with paragraph 4.",
+      "chapter": "II"
+    },
+    {
+      "number": "6",
+      "title": "Identification of critical entities",
+      "text": "1.   By 17 July 2026, each Member State shall identify the critical entities for the sectors and subsectors set out in the Annex.\n\n2.   When a Member State identifies critical entities pursuant to paragraph 1, it shall take into account the outcomes of its Member State risk assessment and its strategy and shall apply all of the following criteria:\n\n(a)\n\nthe entity provides one or more essential services;\n\n(b)\n\nthe entity operates, and its critical infrastructure is located, on the territory of that Member State; and\n\n(c)\n\nan incident would have significant disruptive effects, as determined in accordance with Article 7(1), on the provision by the entity of one or more essential services or on the provision of other essential services in the sectors set out in the Annex that depend on that or those essential services.\n\n3.   Each Member State shall establish a list of the critical entities identified pursuant to paragraph 2 and ensure that those critical entities are notified that they have been identified as critical entities within one month of that identification. Member States shall inform those critical entities of their obligations under Chapters III and IV and the date from which those obligations apply to them, without prejudice to Article 8. Member States shall inform critical entities in the sectors set out in points 3, 4 and 8 of the table in the Annex that they have no obligations under Chapters III and IV, unless national measures provide otherwise.\n\nFor the critical entities concerned, Chapter III shall apply from 10 months after the date of the notification referred to in the first subparagraph of this paragraph.\n\n4.   Member States shall ensure that their competent authorities under this Directive notify the competent authorities under Directive (EU) 2022/2555 of the identity of the critical entities that they have identified under this Article within one month of that identification. That notification shall specify, where applicable, that the critical entities concerned are entities in the sectors set out in points 3, 4 and 8 of the table in the Annex to this Directive and have no obligations under Chapters III and IV thereof.\n\n5.   Member States shall, where necessary and in any event at least every four years, review and, where appropriate, update the list of identified critical entities referred to in paragraph 3. Where those updates lead to the identification of additional critical entities, paragraphs 3 and 4 shall apply to those additional critical entities. In addition, Member States shall ensure that entities that are no longer identified as critical entities following any such update are notified in due time of that fact and the fact that they are no longer subject to the obligations under Chapter III from the date of receipt of that notification.\n\n6.   The Commission shall, in cooperation with the Member States, develop recommendations and non-binding guidelines to support Member States in identifying critical entities.",
+      "chapter": "II"
+    },
+    {
+      "number": "7",
+      "title": "Significant disruptive effect",
+      "text": "1.   When determining the significance of a disruptive effect as referred to in Article 6(2), point (c), Member States shall take into account the following criteria:\n\n(a)\n\nthe number of users relying on the essential service provided by the entity concerned;\n\n(b)\n\nthe extent to which other sectors and subsectors as set out in the Annex depend on the essential service in question;\n\n(c)\n\nthe impact that incidents could have, in terms of degree and duration, on economic and societal activities, the environment, public safety and security, or the health of the population;\n\n(d)\n\nthe entity’s market share in the market for the essential service or essential services concerned;\n\n(e)\n\nthe geographic area that could be affected by an incident, including any cross-border impact, taking into account the vulnerability associated with the degree of isolation of certain types of geographic areas, such as insular regions, remote regions or mountainous areas;\n\n(f)\n\nthe importance of the entity in maintaining a sufficient level of the essential service, taking into account the availability of alternative means for the provision of that essential service.\n\n2.   After the identification of the critical entities under Article 6(1), each Member State shall submit the following information to the Commission without undue delay:\n\n(a)\n\na list of essential services in that Member State where there are any additional essential services as compared to the list of essential services referred to in Article 5(1);\n\n(b)\n\nthe number of critical entities identified for each sector and subsector set out in the Annex and for each essential service;\n\n(c)\n\nany thresholds applied to specify one or more of the criteria in paragraph 1.\n\nThresholds as referred to in the first subparagraph, point (c), may be presented as such or in aggregated form.\n\nMember States shall subsequently submit information referred to in the first subparagraph whenever necessary and at least every four years.\n\n3.   The Commission shall, after consulting the Critical Entities Resilience Group referred to in Article 19, adopt non-binding guidelines to facilitate the application of the criteria referred to in paragraph 1 of this Article, taking into account the information referred to in paragraph 2 of this Article.",
+      "chapter": "II"
+    },
+    {
+      "number": "8",
+      "text": "Critical entities in the banking, financial market infrastructure and digital infrastructure sectors\n\nMember States shall ensure that Article 11 and Chapters III, IV and VI do not apply to critical entities that they have identified in the sectors set out in points 3, 4 and 8 of the table in the Annex. Member States may adopt or maintain provisions of national law to achieve a higher level of resilience for those critical entities, provided that those provisions are consistent with applicable Union law.",
+      "chapter": "II"
+    },
+    {
+      "number": "9",
+      "title": "Competent authorities and single point of contact",
+      "text": "1.   Each Member State shall designate or establish one or more competent authorities responsible for the correct application and, where necessary, enforcement of the rules set out in this Directive at national level.\n\nAs regards the critical entities in the sectors set out in points 3 and 4 of the table in the Annex to this Directive, the competent authorities shall, in principle, be the competent authorities referred to in Article 46 of Regulation (EU) 2022/2554. As regards the critical entities in the sector set out in point 8 of the table in the Annex to this Directive, the competent authorities shall, in principle, be the competent authorities under Directive (EU) 2022/2555. Member States may designate a different competent authority for the sectors set out in points 3, 4 and 8 of the table in the Annex to this Directive in accordance with existing national frameworks.\n\nWhere Member States designate or establish more than one competent authority, they shall clearly set out the tasks of each of the authorities concerned and ensure that they cooperate effectively to fulfil their tasks under this Directive, including with regard to the designation and activities of the single point of contact referred to in paragraph 2.\n\n2.   Each Member State shall designate or establish one single point of contact to exercise a liaison function for the purpose of ensuring cross-border cooperation with the single points of contact of other Member States and the Critical Entities Resilience Group referred to in Article 19 (‘single point of contact’). Where relevant, a Member State shall designate its single point of contact within a competent authority. Where relevant, a Member State may provide that its single point of contact also exercise a liaison function with the Commission and ensure cooperation with third countries.\n\n3.   By 17 July 2028, and every two years thereafter, the single points of contact shall submit a summary report to the Commission and to the Critical Entities Resilience Group referred to in Article 19 on the notifications they have received, including the number of notifications, the nature of notified incidents and the actions taken in accordance with Article 15(3).\n\nThe Commission shall, in cooperation with the Critical Entities Resilience Group, develop a common reporting template. The competent authorities may use, on a voluntary basis, that common reporting template for the purpose of submitting summary reports as referred to in the first subparagraph.\n\n4.   Each Member State shall ensure that its competent authority and single point of contact have the powers and the adequate financial, human and technical resources to carry out, in an effective and efficient manner, the tasks assigned to them.\n\n5.   Each Member State shall ensure that its competent authority, whenever appropriate, and in accordance with Union and national law, consults and cooperates with other relevant national authorities, including those in charge of civil protection, law enforcement and the protection of personal data, and with critical entities and relevant interested parties.\n\n6.   Each Member State shall ensure that its competent authority under this Directive cooperates and exchanges information with competent authorities under Directive (EU) 2022/2555 on cybersecurity risks, cyber threats and cyber incidents and non-cyber risks, threats and incidents affecting critical entities, including with regard to relevant measures its competent authority and competent authorities under Directive (EU) 2022/2555 have taken.\n\n7.   Within three months of the designation or establishment of the competent authority and the single point of contact, each Member State shall notify the Commission of their identity and their tasks and responsibilities under this Directive, their contact details and any subsequent change thereto. Member States shall inform the Commission where they decide to designate an authority other than the competent authorities referred to in paragraph 1, second subparagraph, as the competent authorities in respect of the critical entities in the sectors set out in points 3, 4 and 8 of the table in the Annex. Each Member State shall make public the identity of its competent authority and single point of contact.\n\n8.   The Commission shall make a list of the single points of contact publicly available.",
+      "chapter": "II"
+    },
+    {
+      "number": "10",
+      "title": "Member States’ support to critical entities",
+      "text": "1.   Member States shall support critical entities in enhancing their resilience. That support may include developing guidance materials and methodologies, supporting the organisation of exercises to test their resilience and providing advice and training to the personnel of critical entities. Without prejudice to applicable rules on State aid, Member States may provide financial resources to critical entities, where necessary and justified by public interest objectives.\n\n2.   Each Member State shall ensure that its competent authority cooperates and exchanges information and good practices with critical entities of the sectors set out in the Annex.\n\n3.   Member States shall facilitate voluntary information sharing between critical entities in relation to matters covered by this Directive, in accordance with Union and national law on, in particular, classified and sensitive information, competition and protection of personal data.",
+      "chapter": "II"
+    },
+    {
+      "number": "11",
+      "title": "Cooperation between Member States",
+      "text": "1.   Whenever appropriate, Member States shall consult one another regarding critical entities for the purpose of ensuring that this Directive is applied in a consistent manner. Such consultations shall take place, in particular, regarding critical entities that:\n\n(a)\n\nuse critical infrastructure which is physically connected between two or more Member States;\n\n(b)\n\nare part of corporate structures that are connected with, or linked to, critical entities in other Member States;\n\n(c)\n\nhave been identified as critical entities in one Member State and provide essential services to or in other Member States.\n\n2.   The consultations referred to in paragraph 1 shall aim at enhancing the resilience of critical entities and, where possible, reducing the administrative burden on them.\n\nRESILIENCE OF CRITICAL ENTITIES",
+      "chapter": "III"
+    },
+    {
+      "number": "12",
+      "title": "Risk assessment by critical entities",
+      "text": "1.   Notwithstanding the deadline set out in Article 6(3), second subparagraph, Member States shall ensure that critical entities carry out a risk assessment within nine months of receiving the notification referred to in Article 6(3), whenever necessary subsequently, and at least every four years, on the basis of Member State risk assessments and other relevant sources of information, in order to assess all relevant risks that could disrupt the provision of their essential services (‘critical entity risk assessment’).\n\n2.   Critical entity risk assessments shall account for all the relevant natural and man-made risks which could lead to an incident, including those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid threats and other antagonistic threats, including terrorist offences as provided for in Directive (EU) 2017/541. A critical entity risk assessment shall take into account the extent to which other sectors as set out in the Annex depend on the essential service provided by the critical entity and the extent to which that critical entity depends on essential services provided by other entities in such other sectors, including, where relevant, in neighbouring Member States and third countries.\n\nWhere a critical entity has carried out other risk assessments or drawn up documents pursuant to obligations laid down in other legal acts that are relevant for its critical entity risk assessment, it may use those assessments and documents to meet the requirements set out in this Article. When exercising its supervisory functions, the competent authority may declare an existing risk assessment carried out by a critical entity that addresses the risks and extent of dependence referred to in the first subparagraph of this paragraph as compliant, in whole or in part, with the obligations under this Article.",
+      "chapter": "III"
+    },
+    {
+      "number": "13",
+      "title": "Resilience measures of critical entities",
+      "text": "1.   Member States shall ensure that critical entities take appropriate and proportionate technical, security and organisational measures to ensure their resilience, based on the relevant information provided by Member States on the Member State risk assessment and on the outcomes of the critical entity risk assessment, including measures necessary to:\n\n(a)\n\nprevent incidents from occurring, duly considering disaster risk reduction and climate adaptation measures;\n\n(b)\n\nensure adequate physical protection of their premises and critical infrastructure, duly considering, for example, fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls;\n\n(c)\n\nrespond to, resist and mitigate the consequences of incidents, duly considering the implementation of risk and crisis management procedures and protocols and alert routines;\n\n(d)\n\nrecover from incidents, duly considering business continuity measures and the identification of alternative supply chains, in order to resume the provision of the essential service;\n\n(e)\n\nensure adequate employee security management, duly considering measures such as setting out categories of personnel who exercise critical functions, establishing access rights to premises, critical infrastructure and sensitive information, setting up procedures for background checks in accordance with Article 14 and designating the categories of persons who are required to undergo such background checks, and laying down appropriate training requirements and qualifications;\n\n(f)\n\nraise awareness about the measures referred to in points (a) to (e) among relevant personnel, duly considering training courses, information materials and exercises.\n\nFor the purposes of the first subparagraph, point (e), Member States shall ensure that critical entities take into account the personnel of external service providers when setting out categories of personnel who exercise critical functions.\n\n2.   Member States shall ensure that critical entities have in place and apply a resilience plan or equivalent document or documents which describe the measures taken pursuant to paragraph 1. Where critical entities have drawn up documents or taken measures pursuant to obligations laid down in other legal acts that are relevant for the measures referred to in paragraph 1, they may use those documents and measures to meet the requirements set out in this Article. When exercising its supervisory functions, the competent authority may declare existing resilience-enhancing measures taken by a critical entity that address, in an appropriate and proportionate manner, the technical, security and organisational measures referred to in paragraph 1 as compliant, in whole or in part, with the obligations under this Article.\n\n3.   Member States shall ensure that each critical entity designates a liaison officer or equivalent as the point of contact with the competent authorities.\n\n4.   At the request of the Member State that has identified the critical entity and with the agreement of the critical entity concerned, the Commission shall organise advisory missions, in accordance with the arrangements set out in Article 18(6), (8) and (9), to provide advice to the critical entity concerned in meeting its obligations under Chapter III. The advisory mission shall report its findings to the Commission, that Member State and the critical entity concerned.\n\n5.   The Commission shall, after consulting the Critical Entities Resilience Group referred to in Article 19, adopt non-binding guidelines to further specify the technical, security and organisational measures that may be taken pursuant to paragraph 1 of this Article.\n\n6.   The Commission shall adopt implementing acts in order to set out the necessary technical and methodological specifications relating to the application of the measures referred to in paragraph 1 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).",
+      "chapter": "III"
+    },
+    {
+      "number": "14",
+      "title": "Background checks",
+      "text": "1.   Member States shall specify the conditions under which a critical entity is permitted, in duly reasoned cases and taking into account the Member State risk assessment, to submit requests for background checks on persons who:\n\n(a)\n\nhold sensitive roles in or for the benefit of the critical entity, in particular in relation to the resilience of the critical entity;\n\n(b)\n\nare authorised to directly or remotely access its premises, information or control systems, including in connection with the security of the critical entity;\n\n(c)\n\nare under consideration for recruitment to positions that fall under the criteria set out in point (a) or (b).\n\n2.   Requests as referred to in paragraph 1 of this Article shall be assessed within a reasonable timeframe and processed in accordance with national law and procedures and relevant and applicable Union law, including Regulation (EU) 2016/679 and Directive (EU) 2016/680 of the European Parliament and of the Council (37). Background checks shall be proportionate and strictly limited to what is necessary. They shall be carried out for the sole purpose of evaluating a potential security risk to the critical entity concerned.\n\n3.   A background check as referred to in paragraph 1 shall, at least:\n\n(a)\n\ncorroborate the identity of the person who is the subject of the background check;\n\n(b)\n\ncheck the criminal records of that person with regards to offences which would be relevant for a specific position.\n\nWhen carrying out background checks, Member States shall use the European Criminal Records Information System in accordance with the procedures set out in Framework Decision 2009/315/JHA and, where relevant and applicable, Regulation (EU) 2019/816 for the purpose of obtaining information from criminal records held by other Member States. The central authorities referred to in Article 3(1) of Framework Decision 2009/315/JHA and in Article 3, point (5), of Regulation (EU) 2019/816 shall provide replies to requests for such information within 10 working days from the date on which the request was received in accordance with Article 8(1) of Framework Decision 2009/315/JHA.",
+      "chapter": "III"
+    },
+    {
+      "number": "15",
+      "title": "Incident notification",
+      "text": "1.   Member States shall ensure that critical entities notify the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services. Member States shall ensure that, unless operationally unable to do so, critical entities submit an initial notification no later than 24 hours after becoming aware of an incident, followed, where relevant, by a detailed report no later than one month thereafter. In order to determine the significance of a disruption, the following parameters shall, in particular, be taken into account:\n\n(a)\n\nthe number and proportion of users affected by the disruption;\n\n(b)\n\nthe duration of the disruption;\n\n(c)\n\nthe geographical area affected by the disruption, taking into account whether the area is geographically isolated.\n\nWhere an incident has or might have a significant impact on the continuity of the provision of essential services to or in six or more Member States, the competent authorities of the Member States affected by the incident shall notify the Commission of that incident.\n\n2.   Notifications as referred to in paragraph 1, first subparagraph, shall include any available information necessary to enable the competent authority to understand the nature, cause and possible consequences of the incident, including any available information necessary to determine any cross-border impact of the incident. Such notifications shall not subject critical entities to increased liability.\n\n3.   On the basis of the information provided by a critical entity in a notification as referred to in paragraph 1, the relevant competent authority, via the single point of contact, shall inform the single point of contact of other affected Member States where the incident has or might have a significant impact on critical entities and the continuity of the provision of essential services to or in one or more other Member States.\n\nSingle points of contact sending and receiving information pursuant to the first subparagraph shall, in accordance with Union or national law, treat that information in a way that respects its confidentiality and protects the security and commercial interest of the critical entity concerned.\n\n4.   As soon as possible following a notification as referred to in paragraph 1, the competent authority concerned shall provide the critical entity concerned with relevant follow-up information, including information that could support that critical entity’s effective response to the incident in question. Member States shall inform the public where they determine that it would be in the public interest to do so.",
+      "chapter": "III"
+    },
+    {
+      "number": "16",
+      "title": "Standards",
+      "text": "In order to promote the convergent implementation of this Directive, Member States shall, where useful and without imposing or discriminating in favour of the use of a particular type of technology, encourage the use of European and international standards and technical specifications relevant to the security and resilience measures applicable to critical entities.\n\nCRITICAL ENTITIES OF PARTICULAR EUROPEAN SIGNIFICANCE",
+      "chapter": "IV"
+    },
+    {
+      "number": "17",
+      "title": "Identification of critical entities of particular European significance",
+      "text": "1.   An entity shall be considered a critical entity of particular European significance where it:\n\n(a)\n\nhas been identified as a critical entity pursuant to Article 6(1);\n\n(b)\n\nprovides the same or similar essential services to or in six or more Member States; and\n\n(c)\n\nhas been notified pursuant to paragraph 3 of this Article.\n\n2.   Member States shall ensure that a critical entity, following the notification referred to in Article 6(3), informs its competent authority where it provides essential services to or in six or more Member States. In such a case, Member States shall ensure that the critical entity informs its competent authority of the essential services it provides to or in those Member States and of the Member States to which or in which it provides such essential services. Member States shall notify the Commission, without undue delay, of the identity of such critical entities and of the information they provide under this paragraph.\n\nThe Commission shall consult the competent authority of the Member State which identified a critical entity as referred to in the first subparagraph, the competent authority of other Member States concerned and the critical entity in question. During those consultations, each Member State shall inform the Commission where it deems that the services provided to that Member State by the critical entity are essential services.\n\n3.   Where the Commission establishes, on the basis of the consultations referred to in paragraph 2 of this Article, that the critical entity concerned provides essential services to or in six or more Member States, the Commission shall notify that critical entity, through its competent authority, that it is considered a critical entity of particular European significance and inform that critical entity of its obligations under this Chapter and the date from which those obligations apply to it. Once the Commission informs the competent authority of its decision to consider a critical entity as a critical entity of particular European significance, the competent authority shall forward that notification to that critical entity without undue delay.\n\n4.   This Chapter shall apply to the critical entity of particular European significance concerned from the date of receipt of the notification referred to in paragraph 3 of this Article.",
+      "chapter": "IV"
+    },
+    {
+      "number": "18",
+      "title": "Advisory missions",
+      "text": "1.   At the request of the Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1), the Commission shall organise an advisory mission to assess the measures that that critical entity has put in place to meet its obligations under Chapter III.\n\n2.   On its own initiative or at the request of one or more Member States to or in which the essential service is provided, and provided that the Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1) so agrees, the Commission shall organise an advisory mission as referred to in paragraph 1 of this Article.\n\n3.   On a reasoned request from the Commission or from one or more Member States to or in which the essential service is provided, the Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1) shall provide the following to the Commission:\n\n(a)\n\nthe relevant parts of the critical entity risk assessment;\n\n(b)\n\na list of relevant measures taken in accordance with Article 13;\n\n(c)\n\nsupervisory or enforcement actions, including assessments of compliance or orders issued, that its competent authority has undertaken pursuant to Articles 21 and 22 in respect of that critical entity.\n\n4.   The advisory mission shall report its findings to the Commission, to the Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1), to the Member States to or in which the essential service is provided and to the critical entity concerned within three months of the conclusion of the advisory mission.\n\nThe Member States to or in which the essential service is provided shall analyse the report referred to in the first subparagraph and, where necessary, shall advise the Commission as to whether the critical entity of particular European significance concerned complies with its obligations under Chapter III and, where appropriate, as to the measures which could be taken to improve the resilience of that critical entity.\n\nThe Commission shall, based on the advice referred to in the second subparagraph of this paragraph, communicate its opinion to the Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1), to the Member States to or in which the essential service is provided and to that critical entity as to whether that critical entity complies with its obligations under Chapter III and, where appropriate, as to the measures which could be taken to improve the resilience of that critical entity.\n\nThe Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1) shall ensure that its competent authority and the critical entity concerned take into account the opinion referred to in the third subparagraph of this paragraph and provide information to the Commission and the Member States to or in which the essential service is provided on the measures it has taken pursuant to that opinion.\n\n5.   Each advisory mission shall consist of experts from the Member State in which the critical entity of particular European significance is located, experts from the Member States to or in which the essential service is provided, and Commission representatives. Those Member States may propose candidates to be part of an advisory mission. The Commission shall, following a consultation with the Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1), select and appoint the members of each advisory mission in accordance with their professional capacity and ensuring, where possible, a geographically balanced representation from all those Member States. Whenever necessary, members of the advisory mission shall have valid and appropriate security clearance. The Commission shall bear the costs related to participation in advisory missions.\n\nThe Commission shall organise the programme of each advisory mission, in consultation with the members of the advisory mission in question and in agreement with the Member State that has identified a critical entity of particular European significance as a critical entity pursuant to Article 6(1).\n\n6.   The Commission shall adopt an implementing act laying down rules on the procedural arrangements for requests to organise advisory missions, for handling such requests, for the conduct and reports of advisory missions and for handling the communication of the Commission’s opinion referred to in paragraph 4, third subparagraph, of this Article and of the measures taken, duly taking into account the confidentiality and commercial sensitivity of the information concerned. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 24(2).\n\n7.   Member States shall ensure that critical entities of particular European significance provide advisory missions with access to information, systems and facilities relating to the provision of their essential services necessary for carrying out the advisory mission concerned.\n\n8.   Advisory missions shall be carried out in compliance with the applicable national law of the Member State in which they take place, with respect for that Member State’s responsibility for national security and the protection of its security interests.\n\n9.   When organising advisory missions, the Commission shall take into account the reports of any inspections carried out by the Commission under Regulations (EC) No 725/2004 and (EC) No 300/2008 and the reports of any monitoring carried out by the Commission under Directive 2005/65/EC in respect of the critical entity concerned.\n\n10.   The Commission shall inform the Critical Entities Resilience Group referred to in Article 19 whenever an advisory mission is organised. The Member State in which the advisory mission took place and the Commission shall also inform the Critical Entities Resilience Group of the main findings of the advisory mission and the lessons learned with a view to promoting mutual learning.\n\nCOOPERATION AND REPORTING",
+      "chapter": "V"
+    },
+    {
+      "number": "19",
+      "title": "Critical Entities Resilience Group",
+      "text": "1.   A Critical Entities Resilience Group is hereby established. The Critical Entities Resilience Group shall support the Commission and facilitate cooperation among Member States and the exchange of information on issues relating to this Directive.\n\n2.   The Critical Entities Resilience Group shall be composed of representatives of the Member States and the Commission who hold security clearance, where appropriate. Where relevant for the performance of its tasks, the Critical Entities Resilience Group may invite relevant stakeholders to participate in its work. Where requested by the European Parliament, the Commission may invite experts from the European Parliament to attend meetings of the Critical Entities Resilience Group.\n\nThe Commission’s representative shall chair the Critical Entities Resilience Group.\n\n3.   The Critical Entities Resilience Group shall have the following tasks:\n\n(a)\n\nsupporting the Commission in assisting Member States in reinforcing their capacity to contribute to ensuring the resilience of critical entities in accordance with this Directive;\n\n(b)\n\nanalysing the strategies in order to identify best practices in respect of the strategies;\n\n(c)\n\nfacilitating the exchange of best practices with regard to the identification of critical entities by the Member States pursuant to Article 6(1), including in relation to cross-border and cross-sectoral dependencies and regarding risks and incidents;\n\n(d)\n\nwhere appropriate, contributing on issues relating to this Directive to documents concerning resilience at Union level;\n\n(e)\n\ncontributing to the preparation of the guidelines referred to in Article 7(3) and Article 13(5) and, upon request, any delegated or implementing acts adopted pursuant to this Directive;\n\n(f)\n\nanalysing the summary reports referred to in Article 9(3) with a view to promoting the sharing of best practices on the action taken in accordance with Article 15(3);\n\n(g)\n\nexchanging best practices related to the notification of incidents referred to in Article 15;\n\n(h)\n\ndiscussing the summary reports of advisory missions and the lessons learned in accordance with Article 18(10);\n\n(i)\n\nexchanging information and best practices on innovation, research and development relating to the resilience of critical entities in accordance with this Directive;\n\n(j)\n\nwhere relevant, exchanging information on matters concerning the resilience of critical entities with relevant Union institutions, bodies, offices and agencies.\n\n4.   By 17 January 2025 and every two years thereafter, the Critical Entities Resilience Group shall establish a work programme in respect of actions to be undertaken to implement its objectives and tasks. That work programme shall be consistent with the requirements and objectives of this Directive.\n\n5.   The Critical Entities Resilience Group shall meet on a regular basis and in any event at least once a year with the Cooperation Group established under Directive (EU) 2022/2555 to promote and facilitate cooperation and the exchange of information.\n\n6.   The Commission may adopt implementing acts laying down procedural arrangements necessary for the functioning of the Critical Entities Resilience Group, respecting Article 1(4). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 24(2).\n\n7.   The Commission shall provide the Critical Entities Resilience Group with a summary report of the information provided by the Member States pursuant to Article 4(3) and Article 5(4) by 17 January 2027, whenever necessary subsequently, and at least every four years.",
+      "chapter": "V"
+    },
+    {
+      "number": "20",
+      "title": "Commission support to competent authorities and critical entities",
+      "text": "1.   The Commission shall, where appropriate, support Member States and critical entities in complying with their obligations under this Directive. The Commission shall prepare a Union-level overview of cross-border and cross-sectoral risks to the provision of essential services, organise advisory missions as referred to in Article 13(4) and Article 18 and facilitate information exchange among Member States and experts across the Union.\n\n2.   The Commission shall complement Member States’ activities as referred to in Article 10 by developing best practices, guidance materials and methodologies, and cross-border training activities and exercises to test the resilience of critical entities.\n\n3.   The Commission shall inform Member States about financial resources at Union level available to Member States for enhancing the resilience of critical entities.\n\nSUPERVISION AND ENFORCEMENT",
+      "chapter": "VI"
+    },
+    {
+      "number": "21",
+      "title": "Supervision and enforcement",
+      "text": "1.   In order to assess the compliance of the entities identified by Member States as critical entities pursuant to Article 6(1) with the obligations laid down in this Directive, Member States shall ensure that the competent authorities have the powers and means to:\n\n(a)\n\nconduct on-site inspections of the critical infrastructure and the premises that the critical entity uses to provide its essential services, and off-site supervision of measures taken by critical entities in accordance with Article 13;\n\n(b)\n\nconduct or order audits in respect of critical entities.\n\n2.   Member States shall ensure that the competent authorities have the powers and means to require, where necessary for the performance of their tasks under this Directive, that the entities under Directive (EU) 2022/2555 that Member States have identified as critical entities under this Directive provide, within a reasonable time limit set by those authorities:\n\n(a)\n\nthe information necessary to assess whether the measures taken by those entities to ensure their resilience meet the requirements set out in Article 13;\n\n(b)\n\nevidence of the effective implementation of those measures, including the results of an audit conducted by an independent and qualified auditor selected by that entity and conducted at its expense.\n\nWhen requiring that information, the competent authorities shall state the purpose of the requirement and specify the information required.\n\n3.   Without prejudice to the possibility to impose penalties in accordance with Article 22, the competent authorities may, following the supervisory actions referred to in paragraph 1 of this Article or the assessment of the information referred to in paragraph 2 of this Article, order the critical entities concerned to take the necessary and proportionate measures to remedy any identified infringement of this Directive, within a reasonable time limit set by those authorities, and to provide those authorities with information on the measures taken. Those orders shall take into account, in particular, the seriousness of the infringement.\n\n4.   Member State shall ensure that the powers provided for in paragraphs 1, 2 and 3 can only be exercised subject to appropriate safeguards. Those safeguards shall guarantee, in particular, that such exercise takes place in an objective, transparent and proportionate manner, and that the rights and legitimate interests of the critical entities affected, such as the protection of trade and business secrets, are duly safeguarded, including the right to be heard, the right of defence and the right to an effective remedy before an independent court.\n\n5.   Member States shall ensure that, where a competent authority under this Directive assesses the compliance of a critical entity pursuant to this Article, that competent authority informs the competent authorities of the Member States concerned under Directive (EU) 2022/2555. For that purpose, Member States shall ensure that competent authorities under this Directive can request the competent authorities under Directive (EU) 2022/2555 to exercise their supervisory and enforcement powers in relation to an entity under that Directive that has been identified as a critical entity under this Directive. For that purpose, Member States shall ensure that competent authorities under this Directive cooperate and exchange information with the competent authorities under Directive (EU) 2022/2555.",
+      "chapter": "VI"
+    },
+    {
+      "number": "22",
+      "title": "Penalties",
+      "text": "Member States shall lay down the rules on penalties applicable to infringements of the national measures adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, by 17 October 2024, notify the Commission of those rules and of those measures and shall notify it, without delay, of any subsequent amendment affecting them.\n\nDELEGATED AND IMPLEMENTING ACTS",
+      "chapter": "VII"
+    },
+    {
+      "number": "23",
+      "title": "Exercise of the delegation",
+      "text": "1.   The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.\n\n2.   The power to adopt delegated acts referred to in Article 5(1) shall be conferred on the Commission for a period of five years from 16 January 2023.\n\n3.   The delegation of power referred to in Article 5(1) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.\n\n4.   Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.\n\n5.   As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.\n\n6.   A delegated act adopted pursuant to Article 5(1) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.",
+      "chapter": "VII"
+    },
+    {
+      "number": "24",
+      "title": "Committee procedure",
+      "text": "1.   The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.\n\n2.   Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.\n\nFINAL PROVISIONS",
+      "chapter": "VIII"
+    },
+    {
+      "number": "25",
+      "title": "Reporting and review",
+      "text": "By 17 July 2027, the Commission shall submit to the European Parliament and to the Council a report assessing the extent to which each Member State has taken the necessary measures to comply with this Directive.\n\nThe Commission shall periodically review the functioning of this Directive and report to the European Parliament and to the Council. That report shall, in particular, assess the added value of this Directive, its impact on ensuring the resilience of critical entities and whether the Annex to this Directive should be modified. The Commission shall submit the first such report by 17 June 2029. For the purpose of reporting under this Article, the Commission shall take into account relevant documents of the Critical Entities Resilience Group.",
+      "chapter": "VIII"
+    },
+    {
+      "number": "26",
+      "title": "Transposition",
+      "text": "1.   By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive. They shall immediately inform the Commission thereof.\n\nThey shall apply those measures from 18 October 2024.\n\n2.   When Member States adopt the measures referred to in paragraph 1, they shall contain a reference to this Directive or be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.",
+      "chapter": "VIII"
+    },
+    {
+      "number": "27",
+      "title": "Repeal of Directive 2008/114/EC",
+      "text": "Directive 2008/114/EC is repealed with effect from 18 October 2024.\n\nReferences to the repealed Directive shall be construed as references to this Directive.",
+      "chapter": "VIII"
+    },
+    {
+      "number": "28",
+      "title": "Entry into force",
+      "text": "This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.",
+      "chapter": "VIII"
+    },
+    {
+      "number": "29",
+      "title": "Addressees",
+      "text": "This Directive is addressed to the Member States.\n\nDone at Strasbourg, 14 December 2022.\n\nFor the European Parliament\n\nThe President\n\nR. METSOLA\n\nFor the Council\n\nThe President\n\nM. BEK\n\n(1)\n\nOJ C 286, 16.7.2021, p. 170.\n\n(2)\n\nOJ C 440, 29.10.2021, p. 99.\n\n(3)  Position of the European Parliament of 22 November 2022 (not yet published in the Official Journal) and Council decision of 8 December 2022.\n\n(4)  Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (OJ L 345, 23.12.2008, p. 75).\n\n(5)  Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (see page 80 of this Official Journal).\n\n(6)  Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).\n\n(7)  Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union (OJ L 79 I, 21.3.2019, p. 1).\n\n(8)  Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1).\n\n(9)  Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).\n\n(10)  Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84).\n\n(11)  Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).\n\n(12)  Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).\n\n(13)  Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (see page 1 of this Official Journal).\n\n(14)  Regulation (EC) No 725/2004 of the European Parliament and of the Council of 31 March 2004 on enhancing ship and port facility security (OJ L 129, 29.4.2004, p. 6).\n\n(15)  Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 (OJ L 97, 9.4.2008, p. 72).\n\n(16)  Directive 2005/65/EC of the European Parliament and of the Council of 26 October 2005 on enhancing port security (OJ L 310, 25.11.2005, p. 28).\n\n(17)  Directive 2008/96/EC of the European Parliament and of the Council of 19 November 2008 on road infrastructure safety management (OJ L 319, 29.11.2008, p. 59).\n\n(18)  Commission Decision of 29 June 2018 setting up the EU Rail Passenger Security Platform 2018/C 232/03 (OJ C 232, 3.7.2018, p. 10).\n\n(19)  Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States (OJ L 93, 7.4.2009, p. 23).\n\n(20)  Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726 (OJ L 135, 22.5.2019, p. 1).\n\n(21)  Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).\n\n(22)  Decision No 1313/2013/EU of the European Parliament and of the Council of 17 December 2013 on a Union Civil Protection Mechanism (OJ L 347, 20.12.2013, p. 924).\n\n(23)  Regulation (EU) 2021/1149 of the European Parliament and of the Council of 7 July 2021 establishing the Internal Security Fund (OJ L 251, 15.7.2021, p. 94).\n\n(24)  Regulation (EU) 2021/695 of the European Parliament and of the Council of 28 April 2021 establishing Horizon Europe – the Framework Programme for Research and Innovation, laying down its rules for participation and dissemination, and repealing Regulations (EU) No 1290/2013 and (EU) No 1291/2013 (OJ L 170, 12.5.2021, p. 1).\n\n(25)\n\nOJ L 123, 12.5.2016, p. 1.\n\n(26)  Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).\n\n(27)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).\n\n(28)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).\n\n(29)  Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).\n\n(30)  Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council (OJ L 316, 14.11.2012, p. 12).\n\n(31)  Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).\n\n(32)  Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).\n\n(33)  Regulation (EU) 2017/1938 of the European Parliament and of the Council of 25 October 2017 concerning measures to safeguard the security of gas supply and repealing Regulation (EU) No 994/2010 (OJ L 280, 28.10.2017, p. 1).\n\n(34)  Regulation (EU) 2019/941 of the European Parliament and of the Council of 5 June 2019 on risk-preparedness in the electricity sector and repealing Directive 2005/89/EC (OJ L 158, 14.6.2019, p. 1).\n\n(35)  Directive 2007/60/EC of the European Parliament and of the Council of 23 October 2007 on the assessment and management of flood risks (OJ L 288, 6.11.2007, p. 27).\n\n(36)  Directive 2012/18/EU of the European Parliament and of the Council of 4 July 2012 on the control of major-accident hazards involving dangerous substances, amending and subsequently repealing Council Directive 96/82/EC (OJ L 197, 24.7.2012, p. 1).\n\n(37)  Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).\n\nANNEX\n\nSECTORS, SUBSECTORS AND CATEGORIES OF ENTITIES\n\nSectors\n\nSubsectors\n\nCategories of entities\n\n1.\n\nEnergy\n\n(a)\n\nElectricity\n\n—\n\nElectricity undertakings as defined in Article 2, point (57), of Directive (EU) 2019/944 of the European Parliament and of the Council (1), which carry out the function of ‘supply’ as defined in Article 2, point (12), of that Directive\n\n—\n\nDistribution system operators as defined in Article 2, point (29), of Directive (EU) 2019/944\n\n—\n\nTransmission system operators as defined in Article 2, point (35), of Directive (EU) 2019/944\n\n—\n\nProducers as defined in Article 2, point (38), of Directive (EU) 2019/944\n\n—\n\nNominated electricity market operators as defined in Article 2, point (8), of Regulation (EU) 2019/943 of the European Parliament and of the Council (2)\n\n—\n\nMarket participants as defined in Article 2, point (25), of Regulation (EU) 2019/943 providing aggregation, demand response or energy storage services as defined in Article 2, points (18), (20) and (59), of Directive (EU) 2019/944\n\n(b)\n\nDistrict heating and cooling\n\n—\n\nOperators of district heating or district cooling as defined in Article 2, point (19), of Directive (EU) 2018/2001 of the European Parliament and of the Council (3)\n\n(c)\n\nOil\n\n—\n\nOperators of oil transmission pipelines\n\n—\n\nOperators of oil production, refining and treatment facilities, storage and transmission\n\n—\n\nCentral stockholding entities as defined in Article 2, point (f), of Council Directive 2009/119/EC (4)\n\n(d)\n\nGas\n\n—\n\nSupply undertakings as defined in Article 2, point (8), of Directive 2009/73/EC of the European Parliament and of the Council (5)\n\n—\n\nDistribution system operators as defined in Article 2, point (6), of Directive 2009/73/EC\n\n—\n\nTransmission system operators as defined in Article 2, point (4), of Directive 2009/73/EC\n\n—\n\nStorage system operators as defined in Article 2, point (10), of Directive 2009/73/EC\n\n—\n\nLNG system operators as defined in Article 2, point (12), of Directive 2009/73/EC\n\n—\n\nNatural gas undertakings as defined in Article 2, point (1), of Directive 2009/73/EC\n\n—\n\nOperators of natural gas refining and treatment facilities\n\n(e)\n\nHydrogen\n\n—\n\nOperators of hydrogen production, storage and transmission\n\n2.\n\nTransport\n\n(a)\n\nAir\n\n—\n\nAir carriers as defined in Article 3, point (4), of Regulation (EC) No 300/2008 used for commercial purposes\n\n—\n\nAirport managing bodies as defined in Article 2, point (2), of Directive 2009/12/EC of the European Parliament and of the Council (6), airports as defined in Article 2, point (1), of that Directive, including the core airports listed in Section 2 of Annex II to Regulation (EU) No 1315/2013 of the European Parliament and of the Council (7), and entities operating ancillary installations contained within airports\n\n—\n\nTraffic management control operators providing air traffic control (ATC) services as defined in Article 2, point (1), of Regulation (EC) No 549/2004 of the European Parliament and of the Council (8)\n\n(b)\n\nRail\n\n—\n\nInfrastructure managers as defined in Article 3, point (2), of Directive 2012/34/EU of the European Parliament and of the Council (9)\n\n—\n\nRailway undertakings as defined in Article 3, point (1), of Directive 2012/34/EU and operators of service facilities as defined in Article 3, point (12), of that Directive\n\n(c)\n\nWater\n\n—\n\nInland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to Regulation (EC) No 725/2004, not including the individual vessels operated by those companies\n\n—\n\nManaging bodies of ports as defined in Article 3, point (1), of Directive 2005/65/EC, including their port facilities as defined in Article 2, point (11), of Regulation (EC) No 725/2004, and entities operating works and equipment contained within ports\n\n—\n\nOperators of vessel traffic services (VTS) as defined in Article 3, point (o), of Directive 2002/59/EC of the European Parliament and of the Council (10)\n\n(d)\n\nRoad\n\n—\n\nRoad authorities as defined in Article 2, point (12), of Commission Delegated Regulation (EU) 2015/962 (11) responsible for traffic management control, excluding public entities for whom traffic-management or the operation of intelligent transport systems is a non-essential part of their general activity\n\n—\n\nOperators of Intelligent Transport Systems as defined in Article 4, point (1), of Directive 2010/40/EU of the European Parliament and of the Council (12)\n\n(e)\n\npublic transport\n\n—\n\nPublic service operators as defined in Article 2, point (d), of Regulation (EC) No 1370/2007 of the European Parliament and of the Council (13)\n\n3.\n\nBanking\n\n—\n\nCredit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013\n\n4.\n\nFinancial market infrastructure\n\n—\n\nOperators of trading venues as defined in Article 4, point (24), of Directive 2014/65/EU\n\n—\n\nCentral counterparties (CCPs) as defined in Article 2, point (1), of Regulation (EU) No 648/2012\n\n5.\n\nHealth\n\n—\n\nHealthcare providers as defined in Article 3, point (g), of Directive 2011/24/EU of the European Parliament and of the Council (14)\n\n—\n\nEU reference laboratories as referred to in Article 15 of Regulation (EU) 2022/2371 of the European Parliament and of the Council (15)\n\n—\n\nEntities carrying out research and development activities of medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC of the European Parliament and of the Council (16)\n\n—\n\nEntities manufacturing basic pharmaceutical products and pharmaceutical preparations as referred to in Section C division 21 of NACE Rev. 2\n\n—\n\nEntities manufacturing medical devices considered as critical during a public health emergency (‘public health emergency critical devices list’) within the meaning of Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council (17)\n\n—\n\nEntities holding a distribution authorisation as referred to in Article 79 of Directive 2001/83/EC\n\n6.\n\nDrinking water\n\n—\n\nSuppliers and distributors of water intended for human consumption as defined in Article 2, point (1)(a), of Directive (EU) 2020/2184 of the European Parliament and of the Council (18), excluding distributors for which distribution of water for human consumption is a non-essential part of their general activity of distributing other commodities and goods\n\n7.\n\nWaste water\n\n—\n\nUndertakings collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water as defined in Article 2, points (1), (2) and (3), of Council Directive 91/271/EEC (19), excluding undertakings for which collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water is a non-essential part of their general activity\n\n8.\n\nDigital infrastructure\n\n—\n\nProviders of internet exchange points as defined in Article 6, point (18), of Directive (EU) 2022/2555\n\n—\n\nDNS service providers as defined in Article 6, point (20), of Directive (EU) 2022/2555, excluding operators of root name servers\n\n—\n\ntop-level-domain name registries as defined in Article 6, point (21), of Directive (EU) 2022/2555\n\n—\n\nProviders of cloud computing services as defined in Article 6, point (30), of Directive (EU) 2022/2555\n\n—\n\nProviders of data centre services as defined in Article 6, point (31), of Directive (EU) 2022/2555\n\n—\n\nProviders of content delivery networks as defined in Article 6, point (32), of Directive (EU) 2022/2555\n\n—\n\nTrust service providers as defined in Article 3, point (19), of Regulation (EU) No 910/2014 of the European Parliament and of the Council (20)\n\n—\n\nProviders of public electronic communications networks as defined in Article 2, point (8), of Directive (EU) 2018/1972 of the European Parliament and of the Council (21)\n\n—\n\nProviders of electronic communications services as defined in Article 2, point (4), of Directive (EU) 2018/1972 insofar as their services are publicly available\n\n9.\n\nPublic administration\n\n—\n\nPublic administration entities of central governments as defined by Member States in accordance with national law\n\n10.\n\nSpace\n\n—\n\nOperators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks as defined in Article 2, point (8), of Directive (EU) 2018/1972\n\n11.\n\nProduction, processing and distribution of food\n\n—\n\nFood businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 of the European Parliament and of the Council (22) which are engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing\n\n(1)  Directive (EU) 2019/944 of the European Parliament and of the Council of 5 June 2019 on common rules for the internal market for electricity and amending Directive 2012/27/EU (OJ L 158, 14.6.2019, p. 125).\n\n(2)  Regulation (EU) 2019/943 of the European Parliament and of the Council of 5 June 2019 on the internal market for electricity (OJ L 158, 14.6.2019, p. 54).\n\n(3)  Directive (EU) 2018/2001 of the European Parliament and of the Council of 11 December 2018 on the promotion of the use of energy from renewable sources (OJ L 328, 21.12.2018, p. 82).\n\n(4)  Council Directive 2009/119/EC of 14 September 2009 imposing an obligation on Member States to maintain minimum stocks of crude oil and/or petroleum products (OJ L 265, 9.10.2009, p. 9).\n\n(5)  Directive 2009/73/EC of the European Parliament and of the Council of 13 July 2009 concerning common rules for the internal market in natural gas and repealing Directive 2003/55/EC (OJ L 211, 14.8.2009, p. 94).\n\n(6)  Directive 2009/12/EC of the European Parliament and of the Council of 11 March 2009 on airport charges (OJ L 70, 14.3.2009, p. 11).\n\n(7)  Regulation (EU) No 1315/2013 of the European Parliament and of the Council of 11 December 2013 on Union guidelines for the development of the trans-European transport network and repealing Decision No 661/2010/EU (OJ L 348, 20.12.2013, p. 1).\n\n(8)  Regulation (EC) No 549/2004 of the European Parliament and of the Council of 10 March 2004 laying down the framework for the creation of the single European sky (the framework Regulation) (OJ L 96, 31.3.2004, p. 1).\n\n(9)  Directive 2012/34/EU of the European Parliament and of the Council of 21 November 2012 establishing a single European railway area (OJ L 343, 14.12.2012, p. 32).\n\n(10)  Directive 2002/59/EC of the European Parliament and of the Council of 27 June 2002 establishing a Community vessel traffic monitoring and information system and repealing Council Directive 93/75/EEC (OJ L 208, 5.8.2002, p. 10).\n\n(11)  Commission Delegated Regulation (EU) 2015/962 of 18 December 2014 supplementing Directive 2010/40/EU of the European Parliament and of the Council with regard to the provision of EU-wide real-time traffic information services (OJ L 157, 23.6.2015, p. 21).\n\n(12)  Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010 on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport (OJ L 207, 6.8.2010, p. 1).\n\n(13)  Regulation (EC) No 1370/2007 of the European Parliament and of the Council of 23 October 2007 on public passenger transport services by rail and by road and repealing Council Regulations (EEC) Nos 1191/69 and 1107/70 (OJ L 315, 3.12.2007, p. 1).\n\n(14)  Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross–border healthcare (OJ L 88, 4.4.2011, p. 45).\n\n(15)  Regulation (EU) 2022/2371 of the European Parliament and of the Council of 23 November 2022 on serious cross-border threats to health and repealing Decision No 1082/2013/EU (OJ L 314, 6.12.2022, p. 26).\n\n(16)  Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the community code relating to medicinal products for human use (OJ L 311, 28.11.2001, p. 67).\n\n(17)  Regulation (EU) 2022/123 of the European Parliament and of the Council of 25 January 2022 on a reinforced role for the European Medicines Agency in crisis preparedness and management for medicinal products and medical devices (OJ L 20, 31.1.2022, p. 1).\n\n(18)  Directive (EU) 2020/2184 of the European Parliament and of the Council of 16 December 2020 on the quality of water intended for human consumption (OJ L 435, 23.12.2020, p. 1).\n\n(19)  Council Directive 91/271/EEC of 21 May 1991 concerning urban waste water treatment (OJ L 135, 30.5.1991, p. 40).\n\n(20)  Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73).\n\n(21)  Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communication Code (OJ L 321, 17.12.2018, p. 36).\n\n(22)  Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety (OJ L 31, 1.2.2002, p. 1).\n\n////////////////////////$(document).ready(function(){generateTOC(true,'', 'Top','false');scrollToCurrentUrlAnchor();});",
+      "chapter": "VIII"
+    }
+  ],
+  "definitions": [
+    {
+      "term": "critical entity",
+      "definition": "a public or private entity which has been identified by a Member State in accordance with Article 6 as belonging to one of the categories set out in the third column of the table in the Annex;",
+      "article": "2"
+    },
+    {
+      "term": "resilience",
+      "definition": "a critical entity's ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident;",
+      "article": "2"
+    },
+    {
+      "term": "incident",
+      "definition": "an event which has the potential to significantly disrupt, or that disrupts, the provision of an essential service, including when it affects the national systems that safeguard the rule of law;",
+      "article": "2"
+    },
+    {
+      "term": "critical infrastructure",
+      "definition": "an asset, a facility, equipment, a network or a system, or a part of an asset, a facility, equipment, a network or a system, which is necessary for the provision of an essential service;",
+      "article": "2"
+    },
+    {
+      "term": "essential service",
+      "definition": "a service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment;",
+      "article": "2"
+    },
+    {
+      "term": "risk",
+      "definition": "the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;",
+      "article": "2"
+    },
+    {
+      "term": "risk assessment",
+      "definition": "the overall process for determining the nature and extent of a risk by identifying and analysing potential relevant threats, vulnerabilities and hazards which could lead to an incident and by evaluating the potential loss or disruption of the provision of an essential service caused by that incident;",
+      "article": "2"
+    },
+    {
+      "term": "standard",
+      "definition": "a standard as defined in Article 2, point (1), of Regulation (EU) No 1025/2012 of the European Parliament and of the Council (30);",
+      "article": "2"
+    },
+    {
+      "term": "technical specification",
+      "definition": "a technical specification as defined in Article 2, point (4), of Regulation (EU) No 1025/2012;",
+      "article": "2"
+    },
+    {
+      "term": "public administration entity",
+      "definition": "an entity recognised as such in a Member State in accordance with national law, not including the judiciary, parliaments or central banks, which complies with the following criteria: (a) it is established for the purpose of meeting needs in the general interest and does not have an industrial or commercial character; (b) it has legal personality or is entitled by law to act on behalf of another entity with legal personality; (c) it is financed, for the most part, by the State authorities or by other central-level bodies governed by public law, is subject to management supervision by those authorities or bodies, or has an administrative, managerial or supervisory board, more than half of whose members are appointed by the State authorities or by other central-level bodies governed by public law; (d) it has the power to address to natural or legal persons administrative or regulatory decisions affecting their rights in the cross-border movement of persons, goods, services or capital.",
+      "article": "2"
+    }
+  ]
+}