Critical Entities Resilience Law
For a properly functioning society some services are essential,
including energy, drinking water and healthcare.
Organisations critical to these services must be resilient to physical threats,
such as terrorism, sabotage, and natural disasters.
This is why the European Union adopted the Critical Entities Resilience Directive – the CER.
In the Netherlands, this directive is being implemented into national law as the Critical Entities Resilience Law.
The Dutch Ministry of Health, Welfare and Sport designates critical entities within the healthcare sector.
Critical entities are organisations that are essential for healthcare services.
Think of healthcare providers, EU reference laboratories, organisations conducting pharmaceutical research,
pharmaceutical companies, manufacturers of key medical devices during emergencies,
and organisations holding a distribution authorization for medicines.
First, the Ministry conducts a risk assessment for the healthcare sector,
and determines the criteria for designating critical entities.
These critical entities will be designated once the law takes effect in 2026,
with a final deadline of 17 July 2026.
If an organisation is designated as a critical entity,
it will have 10 months to comply with the legal requirements.
Critical entities have a duty of care.
This means they must conduct a risk assessment.
Based on the risks identified, organisations must take measures to prevent, mitigate, and manage physical incidents.
For example, they must develop crisis management plans or implement access security measures.
Critical entities also have an obligation to report.
Serious physical incidents must be reported within 24 hours through an incident reporting portal.
The Dutch Health and Youth Care Inspectorate supervises critical entities within the healthcare sector.
Critical entities must also protect themselves against digital threats.
This is why they must also comply with the Cyber Security Law.
This way, the healthcare sector will be more resilient to physical and digital threats.
If you want to learn more about the Critical Entities Resilience Law,
visit datavoorgezondheid.nl/weerbaarheid