The European critical infrastructure protection architecture was designed for a world that no longer exists. THE CER Directive 2022 identifies sectors, designates operators, imposes resilience obligations. It does what it sets out to do well. The problem is what it does not propose to do, and which is, in conditions of serious crisis, more decisive than what it regulates.
I wrote in this newspaper, at the beginning of the year, that when the infrastructure fails, the State fails. The argument focused on formally designated infrastructure, underinvested in, operated by listed companies under quarterly pressure, protected by regulation that penalizes little and demands less. But there is a layer prior to this problem, and more difficult to resolve: that of critical infrastructures that do not exist on the regulatory map because no one designated them, and that, in conditions of serious crisis, are as decisive as the electrical grid or telecommunications.
Covid destroyed this premise without room for ambiguity. Formal critical infrastructures held up. What failed was the layer that no one had mapped: personal protective equipment concentrated in a few Asian manufacturers, active pharmaceutical ingredients dependent on specific geographies, diagnostic reagents with single suppliers on a European scale. Pharmacies, which became operational nodes of the first-level health response, did not have resilience obligations, strategic reserves or validated continuity plans. They worked by the professional decision of their agents, not by system design.
The Portuguese mega-fires of 2017 and 2022 exposed the same problem in another configuration. The ability to sustain extended operations depended on private operators without an availability contract, pre-established protocol or guarantee of repeatability. It didn’t just fail in execution; failed in pre-structuring. And without pre-structuring, there is no resilience: there is improvisation.
There is also a dimension that the current architecture tends to underestimate: the Russian hybrid threat, not as a cyclical phenomenon, but as a structural constant of the European security environment. In a context in which coercion, sabotage, cyber intrusion, informational manipulation and pressure on logistics chains are part of the normal repertoire of strategic action, the relevance of an asset no longer arises only from the role it plays in the regular functioning of society. It also arises from the vulnerability it offers to an adversary interested in degrading the State’s response capacity and exploiting intersectoral frictions.
The problem does not lie in the existing regulation, but in its conceptual architecture. Criticality is treated as a binary and permanent attribute: an asset is, or is not, critical infrastructure. This approach ignores conditional criticality, the systemic relevance of actors whose centrality emerges depending on specific and measurable scenarios, such as the degree of market concentration, substitutability or logistical dependence. A dominant food distribution company is not, under normal conditions, critical infrastructure. It becomes one during a catastrophe that forces the prolonged confinement of populations. The same asset, radically different criticality depending on the context.
The inversion of the paradigm requires a principle that public policy rarely adopts in a consistent way: designing the system for the maximum credible crisis scenario, letting this architecture serve normality as a particular case. This implies expanding the universe of contingency responsibilities to the complete support ecosystem: distributors of essential goods, non-hospital healthcare providers, logistics operators with a dominant position, suppliers of control systems for their own designated infrastructures.
It also implies recognizing the intrinsically interministerial nature of the problem. National resilience does not fit into a guardianship. It requires effective coordination between ministries with responsibility for internal security, defense, health, economy and infrastructure, with authority that operates above sectoral boundaries and that has, in a logic of broad civil protection, its point of natural gravity.
It is precisely the type of horizontal reform that the current Executive has identified as a priority in the modernization of the State and which, here, finds concrete, measurable application within the European framework.
Portugal, with the transposition of the CER and from NIS2 still in progress, it has a rare window. But this window does not eliminate a structural fact: imposing contingency obligations without cost sharing generates underinvestment and merely formal compliance. Resilience is not decreed; finances itself. The solution is a pact: whoever integrates the national resilience system and internalizes effective costs receives effective compensation, fiscal, contractual or regulatory.
The question is not whether the current framework allows us to do more. Allow. The question is whether there is the will to do so before the next crisis.
There is no lack of evidence. It remains to be decided.
Write without applying the new Spelling Agreement
Leave a Reply