meta_id 3112444

On April 29, 2026, the European Commission referred Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain, and Sweden to the Court of Justice of the European Union (CJEU) for failing to transpose and notify national measures implementing the Directive on the Resilience of Critical Entities (CER Directive). The CER Directive requires Member States to conduct regular risk assessments to identify critical entities and ensure they implement appropriate measures to protect the uninterrupted provision of essential services. It applies to key sectors including energy, transport, health, water, banking, and digital infrastructure. The directive adopts an all-hazards approach, covering natural and man-made risks such as terrorist attacks, cyber threats, criminal infiltration, and sabotage. It also establishes measures to identify and mitigate cross-border risks. Member States were required to transpose the CER Directive into their national legal orders by October 17, 2024. Most Member States have notified complete transposition; however, the seven referred Member States have not. The Commission sent letters of formal notice to these Member States in November 2024 and reasoned opinions in July 2025. In the absence of any notification of national transposing measures, the Commission is now referring them to the CJEU and requesting the Court impose financial sanctions on each Member State. The CER Directive forms part of the European Union's broader effort to strengthen resilience against hybrid threats and protect critical infrastructure. The infringement procedures reference numbers are: Bulgaria (INFR(2024)0258), France (INFR(2024)0275), Luxembourg (INFR(2024)0283), the Netherlands (INFR(2024)0289), Poland (INFR(2024)0291), Spain (INFR(2024)0271), and Sweden (INFR(2024)0297).