Scope

European critical infrastructure Directive (2008/114/EC)

Evaluation findings

The evaluation found that the technological, economic, social, policy/political and environmental context in which critical infrastructure operates in Europe has changed considerably since the directive entered into force. While some threats (like insiders) are evolving, others (like unmanned aerial vehicles or artificial intelligence) are arguably new and not fully addressed in the current legislation. While the introduction of improved capabilities (such as 5G) will improve efficiencies in various critical infrastructure (CI) sectors, they may also exacerbate existing vulnerabilities or create new ones. In this and other related contexts, the implications of third-country ownership/control of critical infrastructure in Europe require careful monitoring.

The directive has been partially effective in establishing a common approach to the assessment of the need to improve the protection of European critical infrastructure due to the generality of some of the directive’s provisions, leaving room for different interpretations by Member States.

Therefore, there is clearly room for reflection at EU level on how to further enhance the protection of critical infrastructure in Europe, including that of the 94 European Critical Infrastructures that have been designated in the energy and transport sectors to date. While some elements of the directive remain useful, others are of limited value today and could be revisited with the aim of better achieving the directive’s objectives,for instance, considering shifting the focus of EU Critical Infrastructure Protection policy away from asset protection to one that accounts for interdependencies across a range of different sectors. The evaluation also points to the need to review the current scope of the EU’s Critical Infrastructure Protection policy framework and whether it should encompass additional sectors besides energy and transport.

On sustainability, several effects generated by the directive are likely to continue to exist if the directive would be repealed and not replaced. On the other hand, other effects (e.g. cross-border critical infrastructure protection discussions, reporting requirements) would likely cease.

The evaluation finds that there is continued support on the part of Member States for EU involvement in Critical Infrastructure Protection policy, and that there is some concern that the outright repeal of the directive might have negative effects concerning the protection of European Critical Infrastructures. Member States are keen to ensure that the EU’s engagement in the field continues to respect the principle of subsidiarity, supports critical infrastructure protection measures at national level and facilitates cross-border cooperation, including with third countries outside the Union.

Estimated savings and benefits

The directive generated EU benefits insofar as it achieved a common framework for the protection of European Critical Infrastructure that neither national or other European initiatives would otherwise have achieved, or that national or other EU initiatives could have achieved, but only through longer, costlier and less well-defined processes. In addition, certain spill-over effects such as increased critical infrastructure protection awareness and additional measures at national level were observed.

The evaluation found no conclusive evidence whether the results attributed to the directive have been achieved at a reasonable cost. While the costs associated with implementation appear to be limited, it was not possible to assess the directive’s regulatory burden on stakeholders. The lack of quantifiable data prevented making a sound assessment whether regulatory burden was brought by the directive.

Nevertheless, the evaluation showed that:

- The generality of the directive’s provisions created some costs for Member States, especially where the Critical Infrastructure Protection framework was poorly developed before 2008, and

- The directive generated some costs for critical infrastructure operators with a presence in multiple Member States due to different requirements for the content of operator security plans across Member States.

Which objective(s) does the Commission pursue?

The general objective of the initiative is to ensure the resilience of critical entities relying on infrastructure for the provision of their essential services in the internal market against all relevant non-cyber risk.

The specific objectives are the following:

• Ensure higher level of understanding of risks and interdependencies, as well as the means to address them;

• Ensure that all relevant operators of essential services in all relevant sectors are designated as critical;

• Ensure that the full spectrum of resilience is included in public policies and operational practice;

• Strengthen capacities and improve cooperation and communication between stakeholders.

The findings of the impact assessment suggest that the proposal should reduce the overall burden on Member States. Closer alignment with the essential services-oriented approach of the current Network and Information Security (NIS) Directive is likely to lead to reduced compliance costs over time.

Estimated savings and benefits

Concerning cost reductions, closer alignment with the essential services-oriented approach of the current network and information systems security Directive (NIS) is likely to lead to reduced compliance costs over time for Member States. For instance, the burdensome cross-border identification and designation process contained in the existing European critical infrastructure Directive would be replaced with an identification process similar as in the NIS Directive. On the basis of the risk assessment, Member States would identify critical entities, most of which are most likely already designated as operators of essential services per the current NIS Directive.

The proposed measures will also contribute to enhancing security. By taking measures to enhance their resilience, critical entities will be less likely to experience disruptions. Thus, the likelihood for disruptive incidents affecting negatively the provision of essential services in individual Member States and across Europe would be reduced. The importance of the resilience of critical entities is especially apparent in the 2022 context.

Reduced likelihood for disruptive incidents, together with the positive effects resulting from harmonising at Union level diverging national rules, would have a positive impact on businesses, including micro-enterprises and small and medium enterprises, and the overall health of the Union economy and the reliable functioning of the internal market.

Given the limitations created by the lack of available data and the sensitive nature of this policy area, the monetization and quantification of the benefits were not possible.