CER directive, Wwke
Critical entities resilience: the physical half of the package
NIS2 protects the network. The CER directive protects the site, the staff and the supply line behind it. And unlike NIS2, you do not decide whether it applies to you. A minister designates you.
In short
Directive (EU) 2022/2557 on the resilience of critical entities sits alongside NIS2. In the Netherlands it became the Wet weerbaarheid kritieke entiteiten, the Wwke, adopted on 7 July 2026 and in force from 15 August 2026 together with the Cyberbeveiligingswet. Anyone designated as a critical entity counts automatically as an Essential Entity under the Dutch NIS2 law.
Two directives, two different questions
NIS2 asks whether your digital risk management holds up: governance, incident handling, supply chain security, the ten measures in Article 21. CER asks whether the service itself stays standing when something physical goes wrong: sabotage, terrorism, natural hazards, accidents.
The difference that matters most in practice is who decides you are in. Under NIS2 you assess your own scope from sector and size. Under CER you do not. The responsible minister designates critical entities per sector, based on a sectoral risk assessment, and tells them confidentially. No designation means no obligations.
One letter, both regimes
A designation under the Dutch Wwke makes you an Essential Entity under the Cyberbeveiligingswet automatically. That is the heavier of the two supervisory regimes, and you arrive in it without ever having run a scope assessment yourself.
What a designation starts
A designation is not a label you can carry quietly. Two clocks start.
Your own risk assessment
Broad, covering everything that could disrupt the service: sabotage, terrorism, natural hazards, accidents.
Meet every obligation
The full set below, demonstrable rather than intended.
The obligations
- Appropriate physical measures against disruption of the service.
- Your direct suppliers mapped, because outages rarely start with you.
- Access control to sites, buildings and sensitive areas.
- Protection against natural and climate hazards.
- A crisis and continuity plan that goes beyond a document.
- Incident reporting.
- Information sharing with the authorities.
- A single point of contact reachable day and night.
Ten months sounds generous until you count what is inside it. Mapping suppliers runs through procurement, contracts and operations. Physical measures carry a purchasing cycle with lead times you do not control. And a contact point reachable day and night has to be staffed, not just named. That last one is what tends to slip, because it is a rota rather than a purchase.
What to do before a letter arrives
- Know whether you sit in a covered sector. The CER directive covers energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, and the production and distribution of food.
- Run your NIS2 scope assessment now. It applies regardless of any designation. If you already come out as an Essential or Important Entity, most of the governance work is done.
- Get your supplier inventory in order. It is the one item both regimes ask for, and the one with the longest lead time. Work you do now counts twice.
Frequently asked questions
What is the CER directive?
Directive (EU) 2022/2557 on the resilience of critical entities. It covers physical resilience: staying operational through sabotage, terrorism, natural hazards and accidents.
How does CER differ from NIS2?
NIS2 covers digital security and you assess your own scope. CER covers physical resilience and you are designated by a national authority.
How do I know if we are a critical entity?
You do not decide it. The responsible minister designates critical entities per sector based on a sectoral risk assessment and notifies them confidentially.
When does the Dutch Wwke apply?
From 15 August 2026. The Dutch senate adopted it on 7 July 2026 alongside the Cyberbeveiligingswet, with no separate transition period.
How long do we have after designation?
Nine months for your own broad risk assessment and ten months to meet every obligation.
Does a designation pull us into NIS2 as well?
In the Netherlands, yes. A critical entity under the Wwke is automatically an Essential Entity under the Cyberbeveiligingswet.
Find out where you stand
Start with the NIS2 scope check. Five minutes, no email address needed. If it puts you in scope, Burak will walk you through what a CER designation would add on top.