Governing critical infrastructure resilience in the EuropeanUnion: the evolution of the legal framework

The study examines the reconfiguration of the European Union’s regulatory framework on the protection and resilience of critical infrastructures/entities, in the context of physical-digital interdependencies and the amplification of transboundary hybrid risks, assessing the transition from an approach centered on the protection of infrastructures as strategic assets to an integrated model oriented toward resilience and the continuity of essential services. In this regard, the study assesses the extent to which the current normative architecture - structured around Directive (EU) 2022/2557 on the resilience of critical entities (CER), Directive (EU) 2022/2555 on cybersecurity (NIS2), and Regulation (EU) 2024/2847 on the cyber resilience of products with digital elements (CRA) - establishes a coherent and complementary framework. The methodology adopted is legal-analytical, combining doctrinal analysis of hard law norms (directives and regulations) with soft law instruments (strategies, action plans, communications, and recommendations). The study’s main contribution lies in conceptualising the CER-NIS2-CRA triad as a three-level normative model: the resilience of entities and essential services, the governance of operational cyber risks, and the security of digital products “by design” throughout their life cycle. The analysis highlights both normative convergence toward systemic risk management and structural tensions that may affect operational coherence and uniform implementation at the EU level.