The Compliance Gap: Why Most CER-Covered Sites Aren’t Ready for 2027
The EU’s Critical Entities Resilience (CER) framework has a simple premise: if a site underpins everyday life, it should be resilient enough to keep functioning through disruption. Yet as 2027 approaches, a stubborn compliance gap is emerging across the eleven covered sectors—not because organisations don’t care, but because resilience is harder than policy language makes it sound. Many operators have strong security programs, mature safety practices, or robust business continuity plans, but CER expects something broader: a defensible, end-to-end capability to anticipate, withstand, respond to, and recover from a widening set of hazards, including those that cross physical, cyber, human, and supply chain boundaries. The gap is less about intent than about translation—turning existing controls into an integrated resilience system that can be evidenced, exercised, and improved.
One reason the gap persists is that CER compliance is not a single project with a clean finish line. It is an operating model. It requires that risks are identified and managed in a repeatable way; that dependencies are mapped and monitored; that incident response and crisis management are coordinated; and that lessons learned actually feed back into governance and investment. Many sites approach resilience in silos—security protects the perimeter, IT protects the network, operations keep production moving, procurement chases cost, and communications prepares statements after something happens. CER pushes these functions into the same room. That cultural shift is often the slowest component, especially in organisations that have grown through mergers, expanded across borders, or inherited mixed maturity levels from site to site.
The hazard landscape is another accelerant of non-readiness. Resilience planning that once focused on fires, floods, and power outages now has to contend with complex combinations: cyber incidents that impair physical operations, insider threats that exploit process gaps, geopolitical shocks that break supply lines, and extreme weather events that cascade into telecoms failures and transport disruption. CER’s sector-wide lens implicitly assumes that operators understand not only what could go wrong on-site, but what could go wrong around them—upstream suppliers, downstream distributors, shared infrastructure, and mutual dependencies with other essential services. Most organisations have some of this knowledge in people’s heads; fewer have it captured, validated, and kept current.
Across the eleven sectors, the same structural challenges repeat, but they show up in different disguises. In energy, resilience is often strong at the engineering level—redundancy, maintenance regimes, safety management—but weaker where cyber-physical interdependencies live. Control systems may be segmented on paper yet rely on remote access, third-party support, or legacy equipment that complicates patching and monitoring. Grid operators and fuel suppliers also depend on telecoms, transport, and workforce availability in ways that can be underestimated until an incident forces uncomfortable improvisation.
In transport, the core issue is usually complexity at scale. Airports, ports, rail networks, and road operators manage sprawling ecosystems of tenants, contractors, and technology providers. Resilience is not only about the operator’s own systems but about how quickly a multi-stakeholder site can coordinate decisions under stress. Exercises often test a single scenario; CER-aligned readiness demands routine testing of cross-organisational handoffs: who has authority to close an area, how rerouting decisions are made, how passenger communications are synchronised, and how law enforcement and emergency services integrate with operational command.
In banking and financial market infrastructures, preparedness is frequently advanced in cyber security and operational risk management, but CER can expose blind spots around physical continuity and concentration risk. A perfectly resilient data centre means little if a single facilities contractor, a single cash logistics provider, or a single telecom route becomes the real point of failure. Furthermore, many firms have strong playbooks for IT incidents but less mature arrangements for extended building denial, regional evacuation, or simultaneous disruption across multiple third parties.
In health, the gap is often a matter of bandwidth and governance. Hospitals and laboratories run on tight margins, chronic staffing shortages, and dense regulatory obligations. They may have emergency plans for mass-casualty events, but resilience in the CER sense asks for systematic management of dependencies: pharmaceuticals, oxygen, sterile supplies, medical device maintenance, laboratory reagents, and digital services that support diagnostics and patient administration. The challenge is not recognizing the need; it’s sustaining the documentation, training, and testing cadence required to prove readiness without pulling too much capacity away from care delivery.
In drinking water and waste water, operators tend to have mature safety and process controls, yet vulnerabilities can cluster around power dependence, chemical supply chains, remote telemetry, and aging infrastructure. Many sites can manage a pump failure; fewer have thoroughly rehearsed prolonged power loss combined with restricted site access, limited chemical deliveries, or cyber interference with monitoring. CER forces a hard look at what “minimum service” truly means and how quickly it can be restored under compounded constraints.
In digital infrastructure, readiness can be deceptively high. Data centres and cloud-adjacent operators typically excel at redundancy and uptime engineering. The compliance gap appears when resilience is treated as purely technical availability rather than a broader capability that includes crisis governance, supplier continuity, staff safety, and transparent coordination with customers and public authorities. Where staffing models rely heavily on remote operations or highly specialized contractors, surge capacity during a regional disruption can become the weak link.
In public administration, the challenge is often fragmentation. Responsibilities are distributed across agencies, budgets are annual, and decision rights can be unclear during crises. Many public entities have emergency plans but struggle to maintain an auditable resilience management system that persists beyond political cycles and leadership changes. The result is a reliance on heroic effort during incidents rather than repeatable, practiced procedures that meet CER expectations.
In space, resilience depends on long supply chains, scarce components, and specialized knowledge. Satellite operations and ground segment services can be technically robust yet operationally brittle when a small number of vendors or expert teams become single points of failure. Business continuity plans may exist, but CER-style dependency mapping and recovery planning for niche suppliers and constrained manufacturing capacity is often immature.
In food, resilience tends to focus on quality, safety, and traceability, with strong recall procedures but thinner preparation for systemic disruption. Processing sites may have limited cold chain redundancy, high dependence on seasonal labor, and narrow supplier options for packaging, additives, or feedstock. CER readiness in food is not only about avoiding contamination; it’s about ensuring continuity when transport routes close, energy prices spike, or cyber incidents affect production scheduling and logistics.
In chemical, operators usually have well-developed process safety and emergency response, but CER pushes beyond plant-level safety into organisational resilience: third-party maintenance, specialized spare parts, hazardous material transport, and the coordination of security, safety, and cyber controls. The compliance gap often appears in governance—separate regimes for safety and security that don’t share risk assessments, exercises, or incident reporting pathways.
The most common underlying gap across sectors is evidence. Many sites “do resilience” in practice but cannot demonstrate it consistently. Plans exist but are out of date. Exercises occur but don’t produce tracked improvements. Risk assessments are performed but not connected to funded remediation roadmaps. Supplier risks are acknowledged but not quantified or contractually addressed. CER readiness is as much about being able to show a coherent, maintained system as it is about having individual controls in place.
Another frequent gap is dependency realism. Organisations map their critical processes but stop short of mapping the enabling conditions those processes rely on: specific telecom paths, specific maintenance skills, specific chemicals, specific security providers, specific access routes, and specific decision-makers. When stress hits, these “hidden dependencies” determine outcomes. CER effectively requires organisations to replace comforting generalities—“we have backup power,” “we have alternate suppliers,” “we can fail over”—with validated facts: how long the backup lasts under load, whether fuel replenishment is guaranteed, whether the alternate supplier has capacity during a regional surge, and whether failover is regularly tested end to end.
Finally, there is the human factor. Resilience is executed by people under pressure, often with incomplete information. Yet many programmes still treat training as compliance theatre and exercises as checkbox events. CER’s implicit standard is operational competence: staff know their roles, escalation paths are clear, and decision-making is practiced across functions and with external partners. In most organisations, achieving that level of fluency requires rethinking how incident response, crisis management, and business continuity fit together—not as binders on shelves, but as a living routine.
Closing the compliance gap before 2027 will hinge on turning fragmented good practice into an integrated resilience capability. That means governance that can drive cross-functional action, risk assessments that capture real dependencies, exercises that test uncomfortable scenarios, and remediation plans that are funded and tracked. It also means accepting that resilience is not a department—it’s a discipline that links engineering, cyber security, operations, procurement, HR, and communications into one coherent system. The sites that get there won’t just meet a directive; they’ll be measurably better prepared for the disruptions that are already arriving.