Europe's Missing Critical-Entity Register
The 17 July 2026 deadline has split the Union into a two-speed resilience regime.
Directive (EU) 2022/2557 gave Member States until 17 July 2026 to identify the critical entities operating across eleven sectors, and it is that step, not the transposition deadline that preceded it, on which the entire regime turns. Under Article 6, obligations become materially real only once the operator universe is identified, listed and notified: only then do risk assessment, resilience planning, incident notification and supervision become unavoidable in practice. A state can therefore have transposed the law, designated an authority and drafted guidance while still lacking a publicly verifiable answer to the most practical question in the system — which entities are actually in scope. Where that answer is legally uncertain, operationally incomplete or publicly unconfirmable, supervision fragments, procurement demand is deferred and resilience investment becomes uneven across the single market. The result is not a clean binary of compliance and non-compliance, but a two-speed European resilience regime with immediate consequences for operators, suppliers, regulators and capital allocators.
This report tests that proposition against the official record. It opens with a 27-state review anchored to the EUR-Lex transposition data, the two 2026 infringement packages and national primary sources, applying a 19 July cut-off and separating three things too often collapsed into one: notified transposition, an adopted national framework, and completed identification of critical entities. It then develops the analysis across four movements. The first sets out the strategic and institutional architecture, situating CER within the Preparedness Union Strategy, ProtectEU and the wider defence-and-security logic of civilian infrastructure. The second traces the legal, budgetary, programme and procurement mechanics, showing why identification, not transposition, activates the compliance burden and the funding chain behind it. The third maps the industrial, technological and corporate consequences for the supplier market that a completed register makes addressable. The fourth draws the decision-relevant implications for operators, boards, supervisors and investors navigating an uneven activation schedule.