Critical Infrastructure Protection and Crisis Resilience Act

The Act on the Protection of Infrastructure Critical to Society and on the Improvement of Resilience will take effect on 1 July 2025. This law imposes duties on businesses that provide essential services and on other entities deemed to be critical within the time frame set by an EU Directive.

The principal duties of a critical entity concern risk assessment, a resilience plan, and measures to ensure resilience. Any anomalies that may disrupt the provision of essential services must also be reported.

The Russian invasion of Ukraine and changes in the security environment have further increased the need to protect critical infrastructure and strengthen its resilience. The Act seeks to enhance national security and the resilience of society.

National plan to guide operations

The Ministry of the Interior will be responsible for generally coordinating, steering and developing operations, with responsible ministries discharging statutory functions within their respective fields.

Operations will be guided by a national plan that the Government is due to approve in January 2026. The national risk assessment will also be revised at this time to satisfy the new statutory requirements. The national plan and risk assessment will be key elements in implementing the new law.

The legislation will govern eleven fields of operation: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and the production, processing and distribution of food. The ministries responsible for each field of operation will identify and specify the critical entities in their sector by no later than 17 July 2026.

The national legislation responds to an EU Directive

The national legislation is based on the Critical Entities Resilience Directive (CER Directive) of the European Parliament and Council that took effect in 2023.

The Directive requires EU Member States to use harmonised procedures to define and identify entities that are critical to the functioning of society and to improve their resilience. This will also improve the preparedness of the EU and its Member States for wide-ranging influencing activities, such as hybrid threats.

Senior Specialist Annina Ceder 
Ministry of the Interior, National Security Unit
Tel.: +358 29 548 8262, email: [email protected]