NIS2 deals with cybersecurity of network and information systems. The Critical Entities Resilience (CER) Directive, 2022/2557, deals with non-cyber threats such as natural hazards, sabotage, terrorism, insider threats and public health emergencies. They cover many of the same sectors, and many organizations will fall under both.
Two directives, two jobs
A hospital can lose service because of ransomware or because of a flood. NIS2 is aimed at the first, CER at the second. The EU treats them as a pair for end-to-end operational resilience.
Who is covered
NIS2 applies by sector and size. CER is narrower: it applies only to entities that a Member State designates as critical. Designation depends on three things: the entity provides an essential service, it is located in that Member State, and an incident would significantly disrupt that service or other essential services.
Both are directives, so each Member State must write them into national law. The rules you face depend on your country's law, not only on the EU text.
Dates from the summary
A DLA Piper summary gives these dates:
- National resilience strategy due 17 January 2026.
- Critical entities designated by 17 July 2026.
- Commission guidelines on identifying critical entities published 11 September 2025.
The summary also lists duties for designated entities: a risk assessment within 9 months of notice, repeated every 4 years or sooner; resilience measures documented in a plan within 10 months; and incident notification generally within 24 hours of awareness, with a follow-up report within one month unless operationally unable to do so.
How they interact
Entities outside NIS2 scope, for example because of size, that are designated critical under CER fall within NIS2 automatically. Some organizations were therefore in both regimes before 17 July 2026.
A worked example
Take a regional hospital group. Under NIS2 thinking, the team asks whether ransomware could take the patient record system offline and whether suppliers are covered. Under CER thinking, the same team asks what happens if a flood, a fire or a sabotage attempt takes out the data center, a substation or a supply route. The two risk registers share a goal, which is keeping the service running, but the controls differ: segmentation and backups on one side, site protection, redundancy and staff screening on the other.
Seeing both on one page also avoids a quiet failure, where the cyber team assumes facilities has the physical side covered and facilities assumes the opposite.
Try it yourself
Click through it at your own pace, or open it full screen.
Look for how one control can serve more than one framework. Overlapping directives reward evidence that is collected once and reused.
What to do now
- Ask your national authority whether you have been designated.
- Split your risk register into cyber and physical, then check for gaps in both.
- Align the two incident clocks so one team handles both notices.
Safeguard offers compliance and evidence automation for cyber controls. It does not cover physical security measures.
Quick check
Does CER replace NIS2?
No. They address different threats and are meant to work together.
Is every NIS2 entity a CER critical entity?
No. CER applies only to entities a Member State designates as critical.
Sources
Last reviewed: 19 October 2026.
