List of essential services

Commission Delegated Regulation (EU) 2023/2450

of 25 July 2023

supplementing Directive (EU) 2022/2557 of the European Parliament and of the Council

by establishing a list of essential services

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience means a critical entity’s ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident; of critical entities means a public or private entity which has been identified by a Member State in accordance with Article 6 as belonging to one of the categories set out in the third column of the table in the Annex; and repealing Council Directive 2008/114/EC(1)OJ L 333, 27.12.2022, p. 164., in particular Article 5(1) thereof,

Whereas:

Open full page
Recital 1 Purpose of the CER directive

Directive (EU) 2022/2557 aims at ensuring that services essential for the maintenance of vital societal functions or economic activities are provided in an unobstructed manner in the internal market and that the resilience means a critical entity’s ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident; of critical entities means a public or private entity which has been identified by a Member State in accordance with Article 6 as belonging to one of the categories set out in the third column of the table in the Annex; providing such services is enhanced.

Recital 2 Purpose of this delegated regulation

For that purpose and pursuant to Article 5(1) of Directive (EU) 2022/2557, the Commission is empowered to adopt a delegated act establishing a non-exhaustive list of essential services means a service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment; in the sectors and subsectors set out in the Annex to that Directive. The list is to be used by the competent authorities for the purpose of carrying out a risk assessment means the overall process for determining the nature and extent of a risk by identifying and analysing potential relevant threats, vulnerabilities and hazards which could lead to an incident and by evaluating the potential loss or disruption of the provision of an essential service caused by that incident; and thereafter the risk assessment means the overall process for determining the nature and extent of a risk by identifying and analysing potential relevant threats, vulnerabilities and hazards which could lead to an incident and by evaluating the potential loss or disruption of the provision of an essential service caused by that incident; is to be used for the purpose of identifying critical entities means a public or private entity which has been identified by a Member State in accordance with Article 6 as belonging to one of the categories set out in the third column of the table in the Annex;.

Recital 3 Non-exhaustive list of essential services

The list of essential services means a service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment; should be drawn up in a generic way, in order to accommodate Member States’ specificities such as size, population density, or geographic location. However, it should cover the essential services means a service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment; only of the categories of entities set out in the Annex to Directive (EU) 2022/2557. To that effect, only services provided by entities falling within those categories should be considered as essential services means a service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment;, as defined in Article 2, point (5), of Directive (EU) 2022/2557.

HAS ADOPTED THIS REGULATION:

  1. Article 1Subject matter
  2. Article 2Non-exhaustive list of essential services
  3. Article 3

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 25 July 2023.

For the Commission

The President

Ursula VON DER LEYEN

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod