Critical Entities Resilience
The Critical Entities Resilience (CER) Directive (EU 2022/2557) aims to strengthen the ability of providers of essential services to prevent, protect against, respond to, and recover from disruptive incidents.
This page explains what CER means for pharmaceutical and medical device manufacturers and wholesale distributors within the HPRA’s remit.
Further background information on CER and its implementation in Ireland is available on the Government’s Critical Entities Resilience (CER) Regulations webpage.
Who may be in scope?
Only organisations (or entities) that are formally designated as critical entities will have specific obligations under CER.
Within the HPRA’s remit, entities that may be in scope include those:
- Manufacturing basic pharmaceutical products and pharmaceutical preparations as referred to in Division 21 of Section C of Annex 1 to NACE Rev. 2.
- Manufacturing medical devices on the public health emergency critical devices list, within the meaning of Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council of 25 January 202231, as amended.
- Holding a distribution authorisation within the meaning of Title VII of the Medicinal Products Directive.
The HPRA’s role in CER
Under the European Union (Resilience of Critical Entities) Regulations 2024, the HPRA is designated the Competent Authority for CER in relation to specific activities associated with the supply of medicines and medical devices.
The HPRA’s role includes:
- Cooperating with the Irish Single Point of Contact, other Competent Authorities, and other Member States, where relevant.
- Participating in and contributing to the National Risk Assessment of the risks with subsectors within our remit.
- Engaging with organisations that may fall within scope of CER activities under our remit.
- Identifying and notifying entities which are designated as critical within our remit
- Overseeing relevant resilience measures, including reviewing information provided by designated critical entities.
- Carrying out supervision activities in line with legislation, which may include requests for information, inspections, and other supervisory measures, where appropriate.
The identification of critical entities is carried out in accordance with legislation. Where the HPRA requires information to support this process, we will contact the organisations directly.
What will designated critical entities need to do?
Where an organisation is identified as a critical entity, it will be required to engage with the HPRA to strengthen the resilience of the service it provides.
Requirements, as set out in legislation, include:
- Appointing a liaison for engagement with HPRA and any other relevant national authorities.
- Carrying our risk assessment to identify risks that could disrupt the provision of the essential service, including interdependencies and supply chain considerations.
- Putting proportionate technical, security, and organisational measures in place to prevent incidents.
- Having arrangements in place to support continuity and recovery of the essential service in the event of an incident.
- Notifying the HPRA of incidents, if or when they occur.
- Ensuring appropriate training, exercising, and learning from incidents.
The nature and extent of these requirements will depend on the role of the critical entity and the essential service provided. Further guidance will be made available as implementation progresses.
Guidance and updates
The HPRA will update this page as CER implementation progresses and as guidance becomes available. For further information, please refer to the Government’s Critical Entities Resilience (CER) Regulations webpage.
Contact
If you have a query on CER in relation to activities within the HPRA’s remit, please contact us through our Contact Us page.