Critical Entities Resilience (v2)
The Critical Entities Resilience (CER) Directive (EU 2022/2557) aims to improve how essential service providers prevent, protect against, respond to, and recover from disruptive incidents.
This page explains what CER means for pharmaceutical and medical device manufacturers and wholesale distributors within the HPRA’s remit.
Which organisations must comply with CER?
Only organisations formally designated as critical entities have specific obligations under CER.
Within the HPRA’s remit, this may include organisations carrying out the following activities.
| Organisation activity | Activity as defined in legislation |
| Manufacturing basic pharmaceutical products and pharmaceutical preparations | Division 21 of Section C of Annex 1 to NACE Rev. 2 |
| Manufacturing medical devices on the public health emergency critical devices list | Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council of 25 January 202231, as amended |
| Holding a distribution authorisation | Title VII of the Medicinal Products Directive |
Who designates organisations as critical entities?
The HPRA designates organisations as critical entities in accordance with the legislation. If we need information to support this process, we will contact organisations directly.
How do organisations comply with CER?
An organisation identified as a critical entity must engage with the HPRA to strengthen the resilience of its services.
Requirements include:
- Appointing a contact person
- Notifying the HPRA of incidents
- Identifying and assessing risks that could disrupt essential services, including interdependencies and supply chain considerations
- Implementing proportionate technical, security, and organisational measures to prevent incidents
- Ensuring plans are in place to support continuity and recovery of essential services
- Ensuring appropriate training, exercising and learning from incidents
The exact requirements depend on the role of the critical entity and the essential service provided. The HPRA will publish guidance as implementation progresses.
How will the HPRA implement CER?
The HPRA is the competent authority for CER for specific activities associated with the supply of medicines and medical devices.
The HPRA's role includes:
- Cooperating with the Irish Single Point of Contact, other competent authorities, and other Member States
- Contributing to the National Risk Assessment of subsectors within our remit
- Identifying and notifying organisations designated as critical
- Overseeing resilience measures, including reviewing information provided by designated critical entities
- Supervising activities such as requests for information, inspections and other measures
Guidance and updates
The HPRA will update this page as CER implementation develops and new guidance becomes available.
For more information, visit the Government’s CER Regulations webpage.
Contact
If you have questions about CER within the HPRA’s remit, please contact us through our Contact Us page. Under Category, select "Other" and under Topic, select "Critical Entities Resilience".