EXPLANATORY MEMORANDUM

1.CONTEXT OF THE DELEGATED ACT

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC 1 (CER Directive) entered into force on 16 January 2023. The CER Directive aims at ensuring that services essential for the maintenance of vital societal functions or economic activities are provided in an unobstructed manner in the internal market and that the resilience of critical entities providing such services is enhanced.

The CER Directive lays down obligations for critical entities, with the objective of enhancing their resilience and establishes rules on the supervision of critical entities, enforcement and identification of critical entities of particular European significance. It also establishes common rules for cooperation between Member States and reporting on the application of the Directive.

In particular, the CER Directive provides for obligations on Member States to carry out risk assessments and identify those critical entities that provide essential services. In this context, pursuant to Article 5 of the CER Directive and in accordance with the conditions laid down in Article 23 of the Directive, the Commission is empowered to adopt a delegated act by by 17 November 2023 in order to supplement the Directive, by establishing a list of essential services in the sectors and subsectors set out in the Annex to the Directive. This list will be used by competent authorities, in accordance with the CER Directive, for the purpose of conducting risk assessments and thereafter to identify critical entities pursuant to the Directive.

In light of the minimum harmonisation approach of the Directive and the list’s non-exhaustive nature, Member States could, in compliance with EU law, complement it with additional essential services at national level, in particular in order to take into account national specificities in the provision of essential services.

The Council Recommendation on a Union-wide coordinated approach to strengthen the resilience of critical infrastructure 2  invites the Commission to timely adopt this delegated act.

2.CONSULTATIONS PRIOR TO THE ADOPTION OF THE ACT

The Commission carried out appropriate consultations during its preparatory work on this delegated act, including at expert level with Member State representatives. Moreover, in accordance with the principles laid down in the Inter-Institutional Agreement of 13 April 2016 on Better Law-Making 3 , in order to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council received all the documents at the same time as Member States' experts, and their experts, in an observer capacity, have systematically had access to and attended the meetings of the Commission expert group dealing with the preparation of the delegated act.

A first formal consultation of Member States’ experts took place on 25 January 2023 in the framework of the group established by the CER Directive – the Critical Entities Resilience Group (CERG). The Member States were invited for feedback on a draft text, both at the meeting and subsequently in writing.

A second formal consultation took place on 20 March in the framework of the CERG. The consolidated version of this delegated act was sent to Member States on 1 June 2023 and incorporated, as appropriate, relevant comments.

The minutes and agenda of the meetings were published in the Register of Expert Groups (REGEXP) in line with the principle of transparency and good administration.

In addition, for a period of four weeks, the draft was published on the Commission ‘Have your say’ website for public feedback. This period ended on 29 June 2023 and resulted in ten feedbacks received from citizens, private and public entities, including associations, which were taken into consideration, where relevant and within scope. Most notably, Article 2(2)(c)(ii) was amended so as to remove the reference to ‘security services’ as an example of services provided by managing bodies of ports, including their port facilities.

3.LEGAL ELEMENTS OF THE DELEGATED ACT

This delegated act is adopted on the basis of the empowerment given to the Commission in Article 5(1) of the CER Directive, in accordance with Article 290 TFEU, and according to the conditions laid down in Article 23 of the CER Directive.

This delegated act establishes a non-exhaustive list of essential services that private or public entities listed in the third column of the Annex to the Directive (“Category of entities”) provide in the sectors and subsectors set out in that Annex. The list of essential services must be read in close conjunction with this 3rd column, since only services provided by those specific entities as defined in the legislation laid down in that 3rd column would be considered as essential services. In addition, this list must be read taking into consideration the definition of essential services pursuant to Article 2(5) of the CER Directive. In accordance with this article, essential services are services which are crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment.

In terms of sectors covered, this list covers essential services in the following sectors: energy, transport, digital infrastructure, banking, financial market infrastructure, health, drinking water, waste water, public administration, space and production, processing and distribution of food.

As noted above, Member States may complement this list with additional essential services at national level. Pursuant to Article 7(2)(a) of the CER Directive, Member States shall submit to the Commission without undue delay the list of essential services where there are any additional essential services as compared to the list laid down in this delegated act.

COMMISSION DELEGATED REGULATION (EU) …/...

of 25.7.2023

supplementing Directive (EU) 2022/2557 of the European Parliament and of the Council by establishing a list of essential services

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC 4 , in particular Article 5(1) thereof,

Whereas:

(1)Directive (EU) 2022/2557 aims at ensuring that services essential for the maintenance of vital societal functions or economic activities are provided in an unobstructed manner in the internal market and that the resilience of critical entities providing such services is enhanced.

(2)For that purpose and pursuant to Article 5(1) of Directive (EU) 2022/2557, the Commission is empowered to adopt a delegated act establishing a non-exhaustive list of essential services in the sectors and subsectors set out in the Annex to that Directive. The list is to be used by the competent authorities for the purpose of carrying out a risk assessment and thereafter the risk assessment is to be used for the purpose of identifying critical entities. 

(3)The list of essential services should be drawn up in a generic way, in order to accommodate Member States’ specificities such as size, population density, or geographic location. However, it should cover the essential services only of the categories of entities set out in the Annex to Directive (EU) 2022/2557. To that effect, only services provided by entities falling within those categories should be considered as essential services, as defined in Article 2, point (5), of Directive (EU) 2022/2557.

(4)More generally, the list of essential services should be used in the light of all the relevant provisions of Directive (EU) 2022/2557. This includes the definition of essential services as services that are crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment, as well as the definition of a public administration entity and the provisions on that Directive’s scope. Pursuant to Article 1(6) of Directive (EU) 2022/2557, public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement, including investigation, detection and prosecution of criminal offences are excluded.

(5)Consequently, the economic activities listed, on a non-exhaustive basis, in this delegated Regulation, should only be considered essential services, for the purpose of this delegated Regulation and Directive (EU) 2022/2557, where they qualify as essential services as defined in that Directive.

HAS ADOPTED THIS REGULATION:

Article 1

Subject matter

This Regulation establishes, pursuant to Article 5(1) of Directive (EU) 2022/2557, a non-exhaustive list of essential services, as defined in Article 2, point (5) of that Directive, in the sectors and subsectors set out in the Annex to that Directive.

Article 2

Non-exhaustive list of essential services

The non-exhaustive list of essential services referred to in Article 1 shall be as follows:

(1)energy sector: 

(a)electricity subsector: 

(I)supply of electricity (electricity undertakings);

(II)operation, maintenance and development of an electricity distribution system (distribution system operators);

(III)operation, maintenance and development of an electricity transmission system (transmission system operators);

(IV)generation of electricity (producers);

(V)nominated electricity market operator service (nominated electricity market operators);

(VI)demand response (electricity market participants);

(VII)aggregation of electricity (electricity market participants);

(VIII)energy storage (electricity market participants);

(b)district heating and cooling subsector: provision of district heating or district cooling (operators of district heating or district cooling);

(c)oil subsector:

(I)oil transmission (operators of oil transmission pipelines);

(II)production of oil (operators of oil production);

(III) refinement and treatment of oil (operators of oil refining and treatment facilities);

(IV) oil storage (operators of oil storage);

(V)management of oil stocks, including emergency stocks and specific oil stocks (central stockholding entities); 

(d)gas subsector:

(I)supply of gas (supply undertaking);

(II)distribution of gas (distribution system operators);

(III)transmission of gas (transmission system operators);

(IV)storage of gas (storage system operators);

(V)operation of a liquified natural gas (LNG) system (LNG system operators);

(VI)production of natural gas (natural gas undertakings);

(VII)purchase of natural gas (natural gas undertakings);

(VIII)refinement and treatment of natural gas (operators of natural gas refining and treatment facilities);

(e)hydrogen subsector:

(I)production of hydrogen (operators of hydrogen production);

(II)storage of hydrogen (operators of hydrogen storage);

(III)transmission of hydrogen (operators of hydrogen transmission);

(2)transport sector: 

(a)air subsector:

(I)air transport services used for commercial purposes (passenger and cargo) (air carriers);

(II)operation, management and maintenance of airports and of airport network infrastructure (airport managing bodies);

(III)air traffic control services (traffic management control operators);

(b)rail subsector:

(I)railway transport services (passenger and freight) (railway undertakings);

(II)operation, management and maintenance of railway infrastructure, including passenger stations, freight terminals, railway yards and traffic control centres  (infrastructure managers);

(III)operation, management and maintenance of railway service facilities (operators of service facilities);

(IV)operation, management and maintenance of rail traffic management, control-command and signalling as well as telecommunication installations and systems used for control-command and signalling (infrastructure managers);

(c)water subsector:

(I)inland, sea and coastal water transport services (passenger and freight) (inland, sea and coastal passenger and freight water transport companies);

(II)operation, management and maintenance of port and port facilities, and operation of works and equipment within ports, including bunkering, cargo-handling, mooring, passenger services, collection of ship-generated waste and cargo residues, pilotage and towage (managing bodies of ports and entities operating works and equipment contained within ports );

(III)vessel traffic services (operators of vessel traffic services);

(d)road subsector:

(I)traffic management control, including aspects related to road network planning, control and management services, excluding traffic management or the operation of intelligent transport systems where they are not an essential part of the general activity of public entities (road authorities); 

(II)Intelligent Transport Systems services (operators of Intelligent Transport Systems);

(e)public transport subsector: public passenger transport services by rail and other track-based modes and by road (public service operators);

(3)banking sector:

(I)taking deposits (credit institutions);

(II)lending (credit institutions);

(4)financial market infrastructure sector:

(I)operation of a trading venue (operators of trading venues);

(II)operation of clearing systems (central counterparties);

(5)health sector:

(I)provision of healthcare services (healthcare providers);

(II)analysis performed by a European Union reference laboratory (EU Reference laboratories);

(III)research and development of medicinal products (entities carrying out research and development activities of medicinal products);

(IV)manufacturing of basic pharmaceutical products and of basic pharmaceutical preparations (entities manufacturing basic pharmaceutical products and pharmaceutical preparations);

(V)manufacturing of medical devices considered as critical during a public health emergency (entities manufacturing medical devices);

(VI)distribution of medicinal products (entities holding a distribution authorisation);

(6)drinking water sector: drinking water supply and drinking water distribution excluding distribution of water for human consumption where that service is a non-essential part of the general activity of distributors distributing other commodities and goods (suppliers and distributors of water intended for human consumption);

(7)waste water sector: waste water collection, treatment and disposal excluding collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water where they are not an essential part of the general activities of undertakings (undertakings collecting, disposing of or treating urban waste water, domestic waste water and industrial waste water);

(8)digital infrastructure sector:

(I)provision and operation of internet exchange point service (providers of Internet Exchange Points);

(II)provision of domain name system (DNS) service excluding services related to root name servers (DNS service providers);

(III)operation and administration of top-level domain (TLD) name registries (TLD name registries);

(IV)provision of cloud computing services (providers of cloud computing services);

(V)provision of data centre service (providers of data centre services);

(VI)provision of content delivery networks (providers of content delivery networks);

(VII)provision of trust services (trust service providers);

(VIII)provision of publicly available electronic communications services (providers of electronic communications services);

(IX)provision of public electronic communications networks (providers of public electronic communications networks);

(9)public administration sector: services provided by public administration entities within the meaning of Article 2, point (10), of Directive (EU) 2022/2557, of central governments as defined by Member States in accordance with national law (public administration entities of central governments);

(10)space sector: operation of ground-based infrastructure owned, managed and operated by Member States or by private parties that support the provision of space-based services, excluding providers of public electronic communication networks (operators of ground-based infrastructure);

(11)production, processing and distribution of food sector (food businesses which are engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing):

(I)large-scale industrial food production and processing;

(II)food supply chain services, including storage and logistics;

(III)food wholesale distribution. 

Article 3

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 25.7.2023

(1)    OJ L 333, 27.12.2022, p. 164.

(2)    OJ 2023/C 20/01, p. 1-11.

(3)    OJ L 123, 12.5.2016, p. 1.

(4)    OJ L 333, 27.12.2022, p. 164.