Source: OJ L 333, 27.12.2022, pp. 164–198

Article 8 Critical entities in the banking, financial market infrastructure and digital infrastructure sectors

Summary What does Article 8 of the CER directive say?

Article 8 functions as a carve-out provision, establishing that certain critical entities are exempt from key obligations that apply to critical entities more broadly under this Directive.

Specifically, critical entities identified in the banking, financial market infrastructure, and digital infrastructure sectors (points 3, 4 and 8 of the Annex) are excluded from the cross-border consultation requirements of Article 11 and from the resilience obligations, incident notification rules, and supervision and enforcement provisions found in Chapters III, IV and VI.

This exemption exists because those sectors are already subject to equivalent obligations under other Union legal acts, notably DORA and NIS2.

Member States retain the ability to go further under national law, provided they stay within the bounds of applicable Union law.

Important points:

Member States are required to ensure that critical entities in the banking, financial market infrastructure, and digital infrastructure sectors are not subject to Article 11 or Chapters III, IV and VI of this Directive.
This article acts as an exception to the general obligations placed on critical entities throughout the Directive, reflecting that these sectors are governed by sector-specific Union rules.
Member States may adopt or maintain national provisions to achieve a higher level of resilience for these entities, as long as those provisions are consistent with applicable Union law.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

Member States shall ensure that Article 11 and Chapters III, IV and VI do not apply to critical entities that they have identified in the sectors set out in points 3, 4 and 8 of the table in the Annex. Member States may adopt or maintain provisions of national law to achieve a higher level of resilience for those critical entities, provided that those provisions are consistent with applicable Union law.

Relevant recitals

Recital 20 All-hazards approach of the NIS 2 directive

Directive (EU) 2022/2555 requires entities belonging to the digital infrastructure sector, which might be identified as critical entities under this Directive, to take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems and to notify significant incidents and cyber threats. Since threats to the security of network and information systems can have different origins, Directive (EU) 2022/2555 applies an all-hazards approach that includes the resilience of network and information systems, as well as the physical components and environment of those systems.

Given that the requirements laid down in Directive (EU) 2022/2555 in that regard are at least equivalent to the corresponding obligations laid down in this Directive, the obligations laid down in Article 11 and Chapters III, IV and VI of this Directive should not apply to entities belonging to the digital infrastructure sector in order to avoid duplication and unnecessary administrative burden. However, considering the importance of the services provided by entities belonging to the digital infrastructure sector to critical entities belonging to all other sectors, Member States should identify, based on the criteria and using the procedure provided for in this Directive, entities belonging to the digital infrastructure sector as critical entities. Consequently, the strategies, the Member State risk assessments and the support measures set out in Chapter II of this Directive should apply. Member States should be able to adopt or maintain provisions of national law to achieve a higher level of resilience for those critical entities, provided that those provisions are consistent with applicable Union law.

Recital 21 Exemptions for financial entities under the DORA regulation

Union financial services law establishes comprehensive requirements on financial entities to manage all risks they face, including operational risks, and to ensure business continuity. Such law includes Regulations (EU) No 648/2012(⁸), (EU) No 575/2013(⁹) and (EU) No 600/2014(¹⁰) of the European Parliament and of the Council and Directives 2013/36/EU(¹¹) and 2014/65/EU(¹²) of the European Parliament and of the Council. That legal framework is complemented by Regulation (EU) 2022/2554 of the European Parliament and of the Council(¹³), which lays down requirements applicable to financial entities to manage Information and Communication Technology (ICT) risks, including concerning the protection of physical ICT infrastructure. Since the resilience of those entities is therefore comprehensively covered, Article 11 and Chapters III, IV and VI of this Directive should not apply to those entities in order to avoid duplication and unnecessary administrative burden.

However, considering the importance of the services provided by entities in the financial sector to critical entities belonging to all other sectors, Member States should identify, based on the criteria and using the procedure provided for in this Directive, entities in the financial sector as critical entities. Consequently, the strategies, the Member State risk assessments and the support measures set out in Chapter II of this Directive should apply. Member States should be able to adopt or maintain provisions of national law to achieve a higher level of resilience for those critical entities provided that those provisions are consistent with applicable Union law.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.