Source: OJ L 333, 27.12.2022, pp. 164–198

Current language: EN

Article 17 Identification of critical entities of particular European significance


Summary What does Article 17 of the CER directive say?

This article establishes a distinct, elevated category of critical entity: those of "particular European significance." Building on the identification process in Article 6, it creates an additional layer of classification for entities whose reach extends across six or more Member States.

The article sets out the process by which such an entity is identified — through a chain of reporting from the entity to its national competent authority, then to the Commission, followed by a consultation process before a formal designation is made.

Once designated, the entity falls under the specific obligations set out in Chapter IV of the directive.

Important points:

  • If you provide essential services to or in six or more Member States, you must inform your national competent authority of this fact following your initial identification as a critical entity.
  • The Commission, following consultations with relevant national authorities and the entity itself, is responsible for making the formal designation of "particular European significance."
  • The obligations of Chapter IV apply to a designated entity from the date it receives the formal notification of that designation.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. An entity shall be considered a critical entity of particular European significance where it:

      1. has been identified as a critical entity pursuant to Article 6(1);

      2. provides the same or similar essential services to or in six or more Member States; and

      3. has been notified pursuant to paragraph 3 of this Article.

    1. Member States shall ensure that a critical entity, following the notification referred to in Article 6(3), informs its competent authority where it provides essential services to or in six or more Member States. In such a case, Member States shall ensure that the critical entity informs its competent authority of the essential services it provides to or in those Member States and of the Member States to which or in which it provides such essential services. Member States shall notify the Commission, without undue delay, of the identity of such critical entities and of the information they provide under this paragraph.

    2. The Commission shall consult the competent authority of the Member State which identified a critical entity as referred to in the first subparagraph, the competent authority of other Member States concerned and the critical entity in question. During those consultations, each Member State shall inform the Commission where it deems that the services provided to that Member State by the critical entity are essential services.

    1. Where the Commission establishes, on the basis of the consultations referred to in paragraph 2 of this Article, that the critical entity concerned provides essential services to or in six or more Member States, the Commission shall notify that critical entity, through its competent authority, that it is considered a critical entity of particular European significance and inform that critical entity of its obligations under this Chapter and the date from which those obligations apply to it. Once the Commission informs the competent authority of its decision to consider a critical entity as a critical entity of particular European significance, the competent authority shall forward that notification to that critical entity without undue delay.

    1. This Chapter shall apply to the critical entity of particular European significance concerned from the date of receipt of the notification referred to in paragraph 3 of this Article.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod