Critical Entities Resilience
The Critical Entities Resilience (CER) Directive aims to improve how providers of essential services prevent, protect against, respond to, and recover from disruptive incidents.
This page explains what CER means for pharmaceutical and medical device manufacturers and wholesale distributors within the HPRA’s remit.
Which organisations must comply with CER?
Only organisations formally designated as critical entities have specific obligations under CER.
Within the HPRA’s remit, this may include organisations carrying out the following activities.
| Activity | Activity as defined in legislation | |
| 1 | Manufacturing basic pharmaceutical products and pharmaceutical preparations | Division 21 of Section C of Annex 1 to NACE Rev. 2 |
| 2 | Manufacturing medical devices on the public health emergency critical devices list | Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council of 25 January 202231, as amended |
| 3 | Holding a distribution authorisation | Title VII of the Medicinal Products Directive |
Who designates organisations as critical entities?
The HPRA identifies critical entities within its remit in accordance with the legislation. If we need information to support this process, we will contact organisations directly.
How do organisations comply with CER?
An organisation identified as a critical entity must engage with the HPRA to strengthen the resilience of the service it provides.
Requirements include:
- Appointing a contact person
- Identifying and assessing risks that could disrupt essential services, including interdependencies and supply chain considerations
- Implementing proportionate technical, security, and organisational measures in place to prevent incidents
- Ensuring plans are in place to support continuity and recovery of the essential service in the event of an incident
- Notifying the HPRA of incidents
- Ensuring training, exercising, and learning from incidents
The exact requirements depend on the role of the critical entity and the essential service provided. The HPRA will publish guidance as implementation progresses.
How does the HPRA implement CER?
Under the European Union (Resilience of Critical Entities) Regulations 2024, the HPRA is the competent authority for CER for specific activities associated with the supply of medicines and medical devices.
The HPRA’s role includes:
- Cooperating with the Minister for Defence, Ireland’s Single Point of Contact for CER, other competent authorities, and other Member States
- Contributing to the National Risk Assessment of subsectors within our remit
- Engaging with organisations that may fall within scope
- Identifying and notifying entities designated as critical
- Overseeing resilience measures, including reviewing information provided by designated critical entities
- Supervising activities, including requests for information, inspections and other measures
Guidance and updates
The HPRA will update this page as CER implementation progresses and as guidance becomes available. For further information, please refer to the Government’s CER webpage.
Contact
If you have a query on CER in relation to activities within the HPRA’s remit, please submit a query through our contact form. Under Category, select "Other" and under Topic, select "Critical Entities Resilience".