Critical Entities Resilience Directive (CER) Transposition in Malta

Introduction

On 7 March 2025, the Ministry for Home Affairs, Security and Employment launched a public consultation concerning Malta's transposition of Directive (EU) 2022/2557, known as the Critical Entities Resilience Directive (“CER”). The CER introduces comprehensive obligations aimed at enhancing the resilience of critical entities that underpin essential services crucial for societal and economic stability across the European Union (“EU”).

Background

The CER, repealing the previous Directive 2008/114/EC, expands its scope significantly to address a now-broader spectrum of risks, comprising of: naturally occurring risks and man-made risks, whether they are accidental or intentional. The scope of which entities are to be captured was also widened across multiple critical sectors.

Recognising that disruptions in critical services can have immense cascading effects, CER harmonises minimum requirements to ascertain uninterrupted service provision, enhance resilience, and especially improve cross-border cooperation between EU Member States.

Member States were meant to apply the measures transposing the CER into their national laws from 18 October 2024. Accordingly, Malta is currently late in transposing CER into its national laws and currently in default of article 26 of the CER.

Key Features of Malta’s Draft Transposition

Malta’s transposition, titled the Resilience of Critical Entities & Infrastructures (Identification, Designation and Protection) Order, 2024 (the “Local Draft”) closely mirrors the CER but naturally introduces local adaptations to align with the required national specificities.

Key local features that the draft introduces comprise, inter alia, of:

1. The designation of the Critical Infrastructure Protection Department as the national supervisory authority responsible for the implementation and oversight of CER.

• The development of a national strategy by 17 January 2026, updated every four years, incorporating risk assessments (Resilience Risk Assessments), cross-border and cross-sectoral dependencies, and governance frameworks.

• The creation of clear criteria for Malta’s identification of critical entities by 17 July 2026, considering factors such as the number of users impacted, cross-sectoral interdependencies, and potential disruptive effects on the economy and public safety.

• Explicit identification of the Malta Financial Services Authority as the sectoral competent authority responsible for banking, financial market infrastructure, and the Malta Communications Authority for the digital infrastructure sector.

• Robust supervisory powers, including on-site inspections, audits, and requests for information paired with enforcement measures that range from warnings and binding instructions to potential administrative fines of up to €10 million or 2% of total annual turnover.

Capture

The following sectors are captured:

• Energy;
• Transport;
• Banking;
• Financial Market Infrastructure;
• Health;
• Drinking water;
• Waste water;
• Digital Infrastructure;
• Public Administration
• Space; and
• Production, processing and distribution of food.

The public consultation on the draft transposition will remain open until 4 April 2025 with stakeholders encouraged to provide their feedback, which can be provided here.

--

Author: J.J. Galea

GTG stands ready to assist newly-captured stakeholders in navigating compliance obligations and understanding the impacts of the new framework. Contact us at info@gtg.com.mt for further information!