### (26) the commission should regularly monitor the functioning of the eu single window environment for customs to evaluate the performance of eu csw-certex and to ensure the efficient enforcement of union non-customs formalities covered by eu csw-certex. the commission should submit regular assessment reports on the functioning of the eu single window environment for customs to the european parliament and to the council. those reports should take stock of progress , identify areas for improvement and propose recommendations for the future in light of progress made towards an improved digital collaboration between customs and partner competent authorities involved in goods clearance to ensure simplified processes for economic operators and the efficient enforcement of union non-customs formalities. ### (26) the commission should regularly monitor the functioning of the eu single window environment for customs to evaluate the performance of eu csw-certex and to ensure the efficient enforcement of union non-customs formalities covered by eu csw-certex. the commission should submit regular (at least once every three years) assessment reports on the functioning of the eu single window environment for customs to the european parliament and to the council. those reports should take stock of progress , identify areas for improvement and propose recommendations for the future in light of progress made towards an improved digital collaboration between customs and partner competent authorities involved in goods clearance to ensure simplified processes for economic operators and the efficient enforcement of union non-customs formalities.


### this regulation establishes a european union single window environment for customs that provides an integrated set of interoperable electronic services at union and national level through the european union customs single window certificates exchange system to support interaction and information exchange between the national single window environments for customs and the union non-customs systems referred to in the annex. ### this regulation establishes a european union single window environment for customs that provides an integrated set of interoperable electronic services at union and national level through the european union customs single window certificates exchange system to support interaction and information exchange between the national single window environments for customs and the union non-customs systems referred to in part a and part b of annex i.


### it lays down rules for the national single window environments for customs and rules on digital administrative cooperation and information sharing within the european union single window environment for customs. ### it lays down rules for the national single window environments for customs and rules on digital administrative cooperation , digitalization , interoperability with non-customs systems referred to in annex i , and information sharing within the european union single window environment for customs.


### a european union single window environment for customs is hereby established. it shall include the european union customs single window certificates exchange system , national single window environments for customs and the union non-customs systems referred to in the annex. ### a european union single window environment for customs is hereby established. it shall include the european union customs single window certificates exchange system , national single window environments for customs and at least the union non-customs systems referred to in the annex.


### a european union single window environment for customs is hereby established. it shall include the european union customs single window certificates exchange system , national single window environments for customs and the union non-customs systems referred to in the annex. ### a european union single window environment for customs is hereby established. it shall include the european union customs single window certificates exchange system , national single window environments for customs and the union non-customs systems referred to in part a of annex i.


### processing of personal data in eu csw-certex ### processing of personal and non-personal data in eu csw-certex


### 1. the member states shall establish national single window environments for customs. each member state shall be responsible for the development , integration and operation of its single window environment for customs. ### 1. the member states shall establish national single window environments for customs on the basis of technical specifications provided by the commission in order to make them equivalent. each member state shall be responsible for the development , integration , interoperability with eu csw-certex and with non-customs systems listed in annex i , and operation of its single window environment for customs.


### 2. the national single window environments for customs shall enable the exchange of information and cooperation by electronic means between customs authorities , partner competent authorities and economic operators for the purposes of compliance with and efficient enforcement of customs legislation and the union non-customs formalities listed in the annex. ### 2. the national single window environments for customs shall enable the exchange of information in a standardised way and the cooperation by electronic means between customs authorities , partner competent authorities , and economic operators and the maritime national single windows established by regulation (eu) 2019/1239 , whenever applicable , for the purposes of compliance with and efficient enforcement of customs legislation and the union non-customs formalities listed in the annex


### 1. for each of the union non-customs formalities listed in the annex , eu csw-certex shall enable information to be exchanged between the national single window environments for customs and the relevant union non-customs systems for the following purposes: ### 1. for each of the union non-customs formalities listed in the annex , eu csw-certex shall enable information to be exchanged in a standardised way between the national single window environments for customs and the relevant union non-customs systems for the following purposes:


### aligning customs and non-customs terminology where possible , and identifying the customs procedures for which the supporting documents can be used based on the administrative decisions of the partner competent authority indicated in the supporting documents; ### promoting the re-use of date while aligning customs and non-customs terminology where possible , and identifying the customs procedures for which the supporting documents can be used based on the administrative decisions of the partner competent authority indicated in the supporting documents;


### allowing economic operators to submit the relevant information required for the fulfilment of the applicable customs formalities and union non-customs formalities; ### allowing economic operators to submit in a standardised way the relevant information required for the fulfilment of the applicable customs formalities and union non-customs formalities;


### costs of eu csw-certex , work programme , and monitoring and reporting ### costs of eu csw-certex , work programme , and monitoring , reviewing and reporting


### the commission shall , by means of implementing acts , adopt a work programme to support the implementation of the provisions of this regulation related to the connection of the union non-customs systems referred to in the annex to eu csw-certex and the integration of the respective union non-customs formalities. the work programme shall be kept up to date. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 22(2). ### the commission shall , by means of implementing acts , adopt a work programme to support the implementation of the provisions of this regulation related to the connection of the union non-customs systems referred to in the annex to eu csw-certex and the integration of the respective union non-customs formalities. the work programme shall be reviewed and kept up to date regularly to assess and improve overall progress in applying the provisions of this regulation. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 22(2).


### monitoring and reporting ### monitoring , reviewing and reporting


### 1. the commission shall regularly monitor the functioning of the european union single window environment for customs. ### 1. the commission shall regularly monitor the functioning of the european union single window environment for customs. the commission shall regularly review the status of the systems listed in parts b and c of annex i with a view to assessing their progress towards compliance with the rules laid down in articles 10 to 15. if the commission concludes that a system listed in parts b or c of annex i complies with the applicable rules laid down in articles 10 to 15 , it shall adopt a delegated act as mentioned in article 3(1a) integrating the system into part a of annex i.


### 1. the commission shall regularly monitor the functioning of the european union single window environment for customs. ### 1. the commission shall regularly monitor the functioning of the european union single window environment for customs , namely , its impact on smes and the environment. the commission shall also provide timely guidance related to adequate updates and other modifications , as well as appropriate training needed for a better interface to be put in place with eu csw-certex.


### 2. the commission shall regularly evaluate the performance of eu csw-certex. ### 2. the commission shall regularly evaluate the performance of eu csw-certex and keep it updated , performing the necessary modifications for it to accommodate not only new technological developments , but also other non-customs systems that can be interfaced with it.


### article 8(3) , point (c) , article 11 , article 13(1) , (2) and (3) , article 14 and article 15(1) and (2) shall apply from 1 january 2031. ### article 8(3) , point (c) , article 11 , article 13(1) , (2) and (3) , article 14 and article 15(1) and (2) shall apply from 1 january 2028.


### (1) council directive 2008/114/ec17 provides for a procedure for designating european critical infrastructures in the energy and transport sectors , the disruption or destruction of which would have significant cross-border impact on at least two member states. that directive focused exclusively on the protection of such infrastructures. however , the evaluation of directive 2008/114/ec conducted in 201918 found that due to the increasingly interconnected and cross-border nature of operations using critical infrastructure , protective measures relating to individual assets alone are insufficient to prevent all disruptions from taking place. therefore , it is necessary to shift the approach towards ensuring the resilience of critical entities , that is , their ability to mitigate , absorb , accommodate to and recover from incidents that have the potential to disrupt the operations of the critical entity. ### (1) council directive 2008/114/ec17 provides for a procedure for designating european critical infrastructures in the energy and transport sectors , the disruption or destruction of which would have significant cross-border impact on at least two member states. that directive focused exclusively on the protection of such infrastructures. however , the evaluation of directive 2008/114/ec conducted in 201918 found that due to the increasingly interconnected and cross-border nature of operations using critical infrastructure , protective measures relating to individual assets alone are insufficient to prevent all disruptions from taking place. therefore , it is necessary to shift the approach towards ensuring the resilience of critical entities , that is , their ability to mitigate , absorb , accommodate to and recover from incidents that have the potential to disrupt the operations of the critical entity , thereby endangering the democratic , social , and economic life in one or more member states.


### (1) council directive 2008/114/ec17 provides for a procedure for designating european critical infrastructures in the energy and transport sectors , the disruption or destruction of which would have significant cross-border impact on at least two member states. that directive focused exclusively on the protection of such infrastructures. however , the evaluation of directive 2008/114/ec conducted in 201918 found that due to the increasingly interconnected and cross-border nature of operations using critical infrastructure , protective measures relating to individual assets alone are insufficient to prevent all disruptions from taking place. therefore , it is necessary to shift the approach towards ensuring the resilience of critical entities , that is , their ability to mitigate , absorb , accommodate to and recover from incidents that have the potential to disrupt the operations of the critical entity. ### (1) council directive 2008/114/ec17 provides for a procedure for designating european critical infrastructures in the energy and transport sectors , the disruption or destruction of which would have significant cross-border impact on at least two member states. that directive focused exclusively on the protection of such infrastructures. however , the evaluation of directive 2008/114/ec conducted in 201918 found that due to the increasingly interconnected and cross-border nature of operations using critical infrastructure , protective measures relating to individual assets alone are insufficient to prevent all disruptions from taking place. therefore , it is necessary to shift the approach towards ensuring the resilience of critical entities , that is , their ability to mitigate , absorb , accommodate to and recover from incidents that have the potential to disrupt the operations of the critical entity endangering the overall economic and social well-being of citizens.


### (2) despite existing measures at union19 and national level aimed at supporting the protection of critical infrastructures in the union , the entities operating those infrastructures are not adequately equipped to address current and anticipated future risks to their operations that may result in disruptions of the provision of services that are essential for the performance of vital societal functions or economic activities. this is due to a dynamic threat landscape with an evolving terrorist threat and growing interdependencies between infrastructures and sectors , as well as an increased physical risk due to natural disasters and climate change , which increases the frequency and scale of extreme weather events and brings long-term changes in average climate that can reduce the capacity and efficiency of certain infrastructure types if resilience or climate adaptation measures are not in place. moreover , relevant sectors and types of entities are not recognised consistently as critical in all member states. ### (2) despite existing measures at union19 and national level aimed at supporting the protection of critical infrastructures in the union , the entities operating those infrastructures are not adequately equipped to address current , potential and anticipated future risks to their operations that may result in disruptions of the provision of services that are essential for the performance of vital societal functions or economic activities. this is due to an increasingly challenging security environment , with multi-faceted threats the union is facing in a highly multipolar world with unreliable global actors , a dynamic threat landscape with an evolving terrorist threat and growing global interdependencies between infrastructures and sectors , as well as an increased physical risk due to natural disasters and climate change , which increases the frequency and scale of extreme weather events and brings long-term changes in average climate that can reduce the capacity and efficiency of certain infrastructure types if resilience or climate adaptation measures are not in place. moreover , relevant sectors and types of entities are not recognised consistently as critical in all member states.


### (3) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , banking , financial market infrastructure , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. these interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks. ### (3) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , banking , financial market infrastructure , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. these interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability - high impact risks and the crucial importance to secure our supply chain of inter alia raw materials , chemicals , pharmaceutical products , that are essential to many critical infrastructure sectors.


### (3) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , banking , financial market infrastructure , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. these interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks. ### (3) those growing interdependencies are the result of an increasingly cross-border and interdependent network of service provision using key infrastructures across the union in the sectors of energy , transport , banking , financial market infrastructure , digital infrastructure , drinking and waste water , health , certain aspects of public administration , as well as space in as far as the provision of certain services depending on ground-based infrastructures that are owned , managed and operated either by member states or by private parties is concerned , therefore not covering infrastructures owned , managed or operated by or on behalf of the union as part of its space programmes. innovation and technology advancements contribute to the creation of new forms and types of infrastructure systems that use innovations aimed at reducing costs and increasing efficiency and may have implications on risk and resilience. these interdependencies mean that any disruption , even one initially confined to one entity or one sector , can have cascading effects more broadly , potentially resulting in far-reaching and long-lasting negative impacts in the delivery of services across the internal market. the covid-19 pandemic has shown the vulnerability of our increasingly interdependent societies in the face of low-probability risks and the capital importance of raw materials , chemical , pharmaceutical and manufacturing industries and of products that are essential to many critical infrastructure sectors.


### (8) given the importance of cybersecurity for the resilience of critical entities and in the interest of consistency , a coherent approach between this directive and directive (eu) xx/yy of the european parliament and of the council20 [proposed directive on measures for a high common level of cybersecurity across the union; (hereafter “nis 2 directive”)] is necessary wherever possible. in view of the higher frequency and particular characteristics of cyber risks , the nis 2 directive imposes comprehensive requirements on a large set of entities to ensure their cybersecurity. given that cybersecurity is addressed sufficiently in the nis 2 directive , the matters covered by it should be excluded from the scope of this directive , without prejudice to the particular regime for entities in the digital infrastructure sector. ### (8) given the importance of cybersecurity for the resilience of critical entities and in the interest of consistency , a coherent approach between this directive and directive (eu) xx/yy of the european parliament and of the council20 [proposed directive on measures for a high common level of cybersecurity across the union; (hereafter “nis 2 directive”)] is necessary. in view of the higher frequency and particular characteristics of cyber risks and the growing number of cyber attacks and cyber enabled incidents led by hostile state and non state actors , the nis 2 directive imposes comprehensive requirements on a large set of entities to ensure their cybersecurity. given that cybersecurity is addressed sufficiently in the nis 2 directive , the matters covered by it should apply coherently and consistently with this directive , whenever possible and necessary.


### (11) the actions of member states to identify and help ensure the resilience of critical entities should follow a risk-based approach that targets efforts to the entities most relevant for the performance of vital societal functions or economic activities. in order to ensure such a targeted approach , each member state should carry out , within a harmonised framework , an assessment of all relevant natural and man-made risks that may affect the provision of essential services , including accidents , natural disasters , public health emergencies such as pandemics , and antagonistic threats , including terrorist offences. when carrying out those risk assessments , member states should take into account other general or sector-specific risk assessment carried out pursuant to other acts of union law and should consider the dependencies between sectors , including from other member states and third countries. the outcomes of the risk assessment should be used in the process of identification of critical entities and to assist those entities in meeting the resilience requirements of this directive. ### (11) the actions of member states to identify and help ensure the resilience of critical entities should follow a risk-based approach that targets efforts to the entities most relevant for the performance of vital societal functions or economic activities. in order to ensure such a targeted approach , each member state should carry out , within a harmonised framework , an assessment of all relevant natural and man-made risks that may affect the provision of essential services , including accidents , natural disasters , public health emergencies such as pandemics , and antagonistic threats , including terrorist offences , foreign interferences and malicious disinformation campaigns , as well as cbrn threats. when carrying out those risk assessments , member states should take into account other general or sector-specific risk assessment carried out pursuant to other acts of union law , especially under decision no 1313/2013/eu of the european parliament and the council1a and should consider the dependencies between sectors , including from other member states and third countries. the outcomes of the risk assessment should be used in the process of identification of critical entities and to assist those entities in meeting the resilience requirements of this directive.


### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities. therefore , criteria to identify critical entities should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is as detailed and specific as possible , relevant information and , in any event , the list of essential services , the number of critical entities identified for each sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied. ### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities in the relevant existing national sectors and subsectors on their territory listed in the annex. therefore , common criteria , based on minimum indicators and methodologies for each sector and sub-sector to identify critical entities should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is as detailed and specific as possible , relevant information and , in any event , the list of essential services , the number of critical entities identified for each existing national sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied.


### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities. therefore , criteria to identify critical entities should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is as detailed and specific as possible , relevant information and , in any event , the list of essential services , the number of critical entities identified for each sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied. ### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities. therefore , common criteria to identify critical entities , based on minimum indicators and methodologies for each sector and sub-sector , should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is as detailed and specific as possible , relevant information and , in any event , the list of essential services , the number of critical entities identified for each sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied.


### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities. therefore , criteria to identify critical entities should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is as detailed and specific as possible , relevant information and , in any event , the list of essential services , the number of critical entities identified for each sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied. ### (12) in order to ensure that all relevant entities are subject to those requirements and to reduce divergences in this respect , it is important to lay down harmonised rules allowing for a consistent identification of critical entities across the union , while also allowing member states to reflect national specificities. therefore , common criteria , based on minimum indicators and methodologies for each sector and sub-sector to identify critical entities should be laid down. in the interest of effectiveness , efficiency , consistency and legal certainty , appropriate rules should also be set on notification and cooperation relating to , as well as the legal consequences of , such identification. in order to enable the commission to assess the correct application of this directive , member states should submit to the commission , in a manner that is detailed , specific , comparable and standardized , relevant information and , in any event , the list of essential services , the number of critical entities identified for each sector and subsector referred to in the annex and the essential service or services that each entity provides and any thresholds applied.


### (17) in order to facilitate cross-border cooperation and communication and to enable the effective implementation of this directive , each member state should , without prejudice to sector-specific union legal requirements , designate , within one of the authorities it designated as competent authority under this directive , a single point of contact responsible for coordinating issues related to the resilience of critical entities and cross-border cooperation at union level in this regard. ### (17) in order to facilitate cross-border cooperation and communication and to enable the effective implementation of this directive , each member state should , without prejudice to sector-specific union legal requirements , designate , within one of the authorities it designated as competent authority under this directive , a single point of contact responsible for coordinating issues related to the resilience of critical entities and cross-border cooperation at union level in this regard. the single point of contact should also liaise , and coordinate all communication , with the competent authorities of its member state , with the single points of contact of other member states , with the critical entities resilience group established by this directive and with the single points of contacts of entities identified as critical entities under this directive. to that end , the single points of contact should use efficient , secured , standardised and harmonised reporting channels.


### (19) member states should support critical entities in strengthening their resilience , in compliance with their obligations under this directive , without prejudice to the entities’ own legal responsibility to ensure such compliance. member states could in particular develop guidance materials and methodologies , support the organisation of exercises to test their resilience and provide training to personnel of critical entities. moreover , given the interdependencies between entities and sectors , member states should establish information sharing tools to support voluntary information sharing between critical entities , without prejudice to the application of competition rules laid down in the treaty on the functioning of the european union. ### (19) member states should support critical entities in strengthening their resilience , in compliance with their obligations under this directive , without prejudice to the entities’ own legal responsibility to ensure such compliance. member states could in particular provide financial resources , develop guidance materials and methodologies , support the organisation of exercises to test their resilience and provide training to personnel of critical entities. moreover , given the interdependencies between entities and sectors , member states should establish information sharing tools to support voluntary information sharing between critical entities , without prejudice to the application of competition rules laid down in the treaty on the functioning of the european union.


### (20) in order to be able to ensure their resilience , critical entities should have a comprehensive understanding of all relevant risks to which they are exposed and analyse those risks. to that aim , they should carry out risks assessments , whenever necessary in view of their particular circumstances and the evolution of those risks , yet in any event every four years. the risk assessments by critical entities should be based on the risk assessment carried out by member states. ### (20) in order to be able to ensure their resilience , critical entities should have a comprehensive understanding of all relevant risks to which they are exposed and analyse those risks. to that aim , they should carry out risks assessments , whenever necessary in view of their particular circumstances and the evolution of those risks , yet in any event every four years. the risk assessments by critical entities should be based on the risk assessment carried out by member states and on common specifications and methodologies established for each sector covered. they should include minimum indicators , in order to avoid further divergences between member states , and contingency protocols.


### (20) in order to be able to ensure their resilience , critical entities should have a comprehensive understanding of all relevant risks to which they are exposed and analyse those risks. to that aim , they should carry out risks assessments , whenever necessary in view of their particular circumstances and the evolution of those risks , yet in any event every four years. the risk assessments by critical entities should be based on the risk assessment carried out by member states. ### (20) in order to be able to ensure their resilience , critical entities should have a comprehensive understanding of all relevant risks to which they are exposed and analyse those risks. to that aim , they should carry out risks assessments , whenever necessary in view of their particular circumstances and the evolution of those risks , yet in any event every four years. the risk assessments by critical entities should be based on the risk assessment carried out by member states , using a common methodology established for each sector covered.


### (24) the risk of employees of critical entities misusing for instance their access rights within the entity’s organisation to harm and cause damage is of increasing concern. that risk is exacerbated by the growing phenomenon of radicalisation leading to violent extremism and terrorism. it is therefore necessary to enable critical entities to request background checks on persons falling within specific categories of its personnel and to ensure that those requests are assessed expeditiously by the relevant authorities , in accordance with the applicable rules of union and national law , including on the protection of personal data. ### (24) the risk of employees of critical entities misusing for instance their access rights within the entity’s organisation to harm and cause damage is of increasing concern. that risk is exacerbated by the growing phenomenon of radicalisation leading to violent extremism and terrorism. it is therefore necessary to enable critical entities to request background checks on persons falling within specific categories of its personnel and to ensure that those requests are assessed expeditiously by the relevant authorities , in accordance with the applicable rules of union and national law , including on the protection of personal data , in particular in full respect of regulation (eu) 2016/679.


### (24) the risk of employees of critical entities misusing for instance their access rights within the entity’s organisation to harm and cause damage is of increasing concern. that risk is exacerbated by the growing phenomenon of radicalisation leading to violent extremism and terrorism. it is therefore necessary to enable critical entities to request background checks on persons falling within specific categories of its personnel and to ensure that those requests are assessed expeditiously by the relevant authorities , in accordance with the applicable rules of union and national law , including on the protection of personal data. ### (24) the risk of misuse of the access rights within the critical entity’s organisation to harm and cause damage is of increasing concern , especially in the context of growing foreign interference , malicious disinformation and radicalisation which could lead to violent extremism and terrorism. it is therefore necessary to enable critical entities to request background checks on persons falling within specific categories of its personnel , while fully respecting their fundamental rights , labour law and data protection and privacy , ruling out any discrimination of biased recruitment procedures , and to ensure that those requests are assessed expeditiously by the relevant authorities , in accordance with the applicable rules of union and national law , including on the protection of personal data.


### (25) critical entities should notify , as soon as reasonably possible under the given circumstances , member states’ competent authorities of incidents that significantly disrupt or have the potential to significantly disrupt their operations. the notification should allow the competent authorities to respond to the incidents rapidly and adequately and to have a comprehensive overview of the overall risks that critical entities face. for that purpose , a procedure should be established for the notification of certain incidents and parameters should be provided for to determine when the actual or potential disruption is significant and the incidents should thus be notified. given the potential cross-border impacts of such disruptions , a procedure should be established for member states to inform other affected member states via single points of contacts. ### (25) critical entities should notify , as soon as reasonably possible under the given circumstances and in any case within 24 hours after having become aware of an incident , member states’ competent authorities of incidents that significantly disrupt or have the potential to significantly disrupt their operations. critical entities should also notify the users of their services of incidents , their consequences and , if possible , any safety measures or remedies that could be taken. the notification should allow the competent authorities to respond to the incidents rapidly and adequately and to have a comprehensive overview of the overall risks that critical entities face. for that purpose , a procedure should be established for the notification of certain incidents and parameters should be provided for to determine when the actual or potential disruption is significant and the incidents should thus be notified. given the potential cross-border impacts of such disruptions , a procedure should be established for member states to inform other affected member states via single points of contacts.


### (25) critical entities should notify , as soon as reasonably possible under the given circumstances , member states’ competent authorities of incidents that significantly disrupt or have the potential to significantly disrupt their operations. the notification should allow the competent authorities to respond to the incidents rapidly and adequately and to have a comprehensive overview of the overall risks that critical entities face. for that purpose , a procedure should be established for the notification of certain incidents and parameters should be provided for to determine when the actual or potential disruption is significant and the incidents should thus be notified. given the potential cross-border impacts of such disruptions , a procedure should be established for member states to inform other affected member states via single points of contacts. ### (25) critical entities should notify , as soon as reasonably possible under the given circumstances , member states’ competent authorities of incidents that significantly disrupt or have the potential to significantly disrupt their operations. the notification should allow the competent authorities to respond to the incidents rapidly and adequately and to have a comprehensive overview of the overall risks that critical entities face. the notification should also trigger , where appropriate , an information to users or citizens potentially affected , with clear safety and security guidance. for that purpose , a procedure should be established for the notification of certain incidents and parameters should be provided for to determine when the actual or potential disruption is significant and the incidents should thus be notified. given the potential cross-border impacts of such disruptions , a procedure should be established for member states to inform other affected member states via single points of contacts.


### (2) “resilience” means the ability to prevent , resist , mitigate , absorb , accommodate to and recover from an incident that disrupts or has the potential to disrupt the operations of a critical entity; ### (2) “resilience” means the ability to prevent , resist , mitigate , manage , absorb , accommodate to and recover from an incident that disrupts or has the potential to disrupt the operations of a critical entity;


### (3) “incident” means any event having the potential to disrupt , or that disrupts , the operations of the critical entity; ### (3) “incident” means any event which results in a disruption of essential services or essential infrastructure or the destruction of essential infrastructure and has a significant cross-sectoral or cross-border effect on the delivery of those services in one or more member states as a result of the failure to maintain the operations of that critical entity;


### (3) “incident” means any event having the potential to disrupt , or that disrupts , the operations of the critical entity; ### (3) “incident” means any event which results in a disruption of essential services or the destruction of essential infrastructure and has a significant cross-sectoral or cross-border effect on the delivery of essential services in one or more member states as a result of the failure to maintain the operations of a critical entity;


### (3) “incident” means any event having the potential to disrupt , or that disrupts , the operations of the critical entity; ### (3) “incident” means any natural or man-made event which has the potential to jeopardize the security , to disrupt the delivery of essential services or the destruction of essential infrastructure in one or more member states as the results of failure to maintain the operations of that critical entity;


### (5) “essential service” means a service which is essential for the maintenance of vital societal functions or economic activities; ### (5) “essential service” means a service which is essential for the wellbeing of citizens and the maintenance of vital societal functions or economic activities and proper functioning of the internal market and the disruption of which would have a significant cross-sectoral or cross-border effect on the provision of that service , in on one or more member states;


### (5) “essential service” means a service which is essential for the maintenance of vital societal functions or economic activities; ### (5) “essential service” means a service which is essential for the wellbeing of the people and for the maintenance of vital societal functions or economic activities , public safety , protecting the environment or the rule of law;


### (5) “essential service” means a service which is essential for the maintenance of vital societal functions or economic activities; ### (5) “essential service” means a service which is essential for the maintenance of vital societal and democratic functions , economic activities , public safety and the rule of law;


### (7) “risk assessment” means a methodology to determine the nature and extent of a risk by analysing potential threats and hazards and evaluating existing conditions of vulnerability that could disrupt the operations of the critical entity. ### (7) “risk assessment” means a methodology to determine the nature and extent of a risk by assessing the extent of potential threats and hazards against the resilience of the critical entity , analysing existing conditions of vulnerability that could facilitate the disruption of operations of the critical entity and evaluating the potential adverse effect the disruption of operations could have on the provision of essential services.


### (7) “risk assessment” means a methodology to determine the nature and extent of a risk by analysing potential threats and hazards and evaluating existing conditions of vulnerability that could disrupt the operations of the critical entity. ### (7) “risk assessment” means a methodology to determine the nature and extent of a risk by assessing the extent of potential threats and hazards against the resilience of a critical entity , analysing existing conditions of vulnerability that could facilitate the disruption of operations of the critical entity and evaluating the potential adverse effect the disruption of operations could have on the provision of essential services.


### 1. competent authorities designated pursuant to article 8 shall establish a list of essential services in the sectors referred to in the annex. they shall carry out by [three years after entry into force of this directive] , and subsequently where necessary , and at least every four years , an assessment of all relevant risks that may affect the provision of those essential services , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11. ### 1. competent authorities designated pursuant to article 8 shall establish a list of essential services in the sectors referred to in the annex. they shall carry out by [three years after entry into force of this directive] , and subsequently where necessary , and at least every four years , an assessment , based on common specifications and methodologies containing specific indicators established for each sector covered , of all relevant risks that may affect the provision of those essential services , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11. the assessments shall include a minimum number of indicators , in order to avoid divergences between member states.


### 6. for the purposes of chapter iv , member states shall ensure that critical entities , following the notification referred in paragraph 3 , provide information to their competent authorities designated pursuant to article 8 of this directive on whether they provide essential services to or in more than one third of member states. where that is so , the member state concerned shall notify , without undue delay , to the commission the identity of those critical entities. ### 6. for the purposes of chapter iv , member states shall ensure that critical entities , following the notification referred in paragraph 3 , provide information to their competent authorities designated pursuant to article 8 of this directive on whether they provide essential services to or in more than three member states. where that is so , the member state concerned shall notify , without undue delay , to the commission the identity of those critical entities.


### 1. member states shall support critical entities in enhancing their resilience. that support may include developing guidance materials and methodologies , supporting the organisation of exercises to test their resilience and providing training to personnel of critical entities. ### 1. member states shall support critical entities , including financially , in order to enhance their resilience. that support may include developing guidance materials and methodologies , supporting the organisation of exercises to test their resilience and providing training to personnel of critical entities.


### 1. member states shall support critical entities in enhancing their resilience. that support may include developing guidance materials and methodologies , supporting the organisation of exercises to test their resilience and providing training to personnel of critical entities. ### 1. member states and when necessary the commission , shall support critical entities , including financially , in enhancing their resilience. that support may include developing guidance materials and methodologies , supporting the organisation of exercises to test their resilience and providing training to personnel of critical entities.


### ensure adequate employee security management , including by setting out categories of personnel exercising critical functions , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12; ### ensure adequate staff security management , including by setting out categories of personnel exercising critical functions , in compliance with applicable training requirements and qualifications , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12;


### ensure adequate employee security management , including by setting out categories of personnel exercising critical functions , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12; ### ensure adequate staff security management , including by setting out categories of personnel exercising critical functions , establishing access rights to sensitive areas , facilities and other infrastructure , and to sensitive information as well as identifying specific categories of personnel in view of article 12 , while fully complying with sectoral and labour law;


### raise awareness about the measures referred to in points (a) to (e) among relevant personnel. ### raise awareness about the measures referred to in points (a) to (e) among relevant personnel and include them through social dialogue into the definition , set up and follow up of those measures.


### 1. member states shall ensure that critical entities may submit requests for background checks on persons who fall within certain specific categories of their personnel , including persons being considered for recruitment to positions falling within those categories , and that those requests are assessed expeditiously by the authorities competent to carry out such background checks. ### 1. member states shall ensure that critical entities may submit requests for background checks on persons who fall within certain specific categories of their personnel , including persons being considered for recruitment to positions falling within those categories , and that those requests are assessed expeditiously by the authorities competent to carry out such background checks. the background checks shall be proportionate and strictly limited to what is necessary and relevant for the fulfilment of the duties of the concerned personnel.


### 1. member states shall ensure that critical entities may submit requests for background checks on persons who fall within certain specific categories of their personnel , including persons being considered for recruitment to positions falling within those categories , and that those requests are assessed expeditiously by the authorities competent to carry out such background checks. ### 1. member states shall ensure that critical entities may submit requests for proportionate background checks on persons who fall within certain specific categories of their personnel , including persons being considered for recruitment to positions falling within those categories , and that those requests are assessed expeditiously by the public authorities competent to carry out such background checks. those checks shall be proportionate and strictly limited to what is necessary and relevant for the fulfilment of the duties of the concerned personnel , while fully respecting sectoral and labour law.


### 1. member states shall ensure that critical entities notify without undue delay the competent authority of incidents that significantly disrupt or have the potential to significantly disrupt their operations. notifications shall include any available information necessary to enable the competent authority to understand the nature , cause and possible consequences of the incident , including so as to determine any cross-border impact of the incident. such notification shall not make the critical entities subject to increased liability. ### 1. member states shall ensure that critical entities notify without undue delay the competent authority of incidents that significantly disrupt or have the potential to significantly disrupt their operations. an initial notification shall be submitted within 24 hours after having become aware of the incident , followed by a final detailed report not later than one month thereafter. notifications shall include any available information necessary to enable the competent authority to understand the nature , cause and possible consequences of the incident , including so as to determine any cross-border impact of the incident. such notification shall not make the critical entities subject to increased liability.


### 2. an entity shall be considered a critical entity of particular european significance when it has been identified as a critical entity and it provides essential services to or in more than one third of member states and has been notified as such to the commission pursuant to article 5(1) and (6) , respectively. ### 2. an entity shall be considered a critical entity of particular european significance when it has been identified as a critical entity and it provides essential services to or in more than three member states and has been notified as such to the commission pursuant to article 5(1) and (6) , respectively.


### 2. upon request of one or more member states , or at its own initiative , and in agreement with the member state where the infrastructure of the critical entity of particular european significance is located , the commission shall organise an advisory mission to assess the measures that that entity put in place to meet its obligations pursuant to chapter iii. where needed , the advisory missions may request specific expertise in the area of disaster risk management through the emergency response coordination centre. ### 2. upon request of one or more member states , or at its own initiative , and after informing the member state where the infrastructure of the critical entity of particular european significance is located , the commission shall organise an advisory mission to assess the measures that that entity put in place to meet its obligations pursuant to chapter iii. where needed , the advisory missions may request specific expertise in the area of disaster risk management through the emergency response coordination centre.


### 2. the critical entities resilience group shall be composed of representatives of the member states and the commission. where relevant for the performance of its tasks , the critical entities resilience group may invite representatives of interested parties to participate in its work. ### 2. the critical entities resilience group shall be composed of representatives of the member states , the commission and the european parliament. where relevant for the performance of its tasks , the critical entities resilience group shall invite representatives of the relevant entities to participate in its work.


### 2. the critical entities resilience group shall be composed of representatives of the member states and the commission. where relevant for the performance of its tasks , the critical entities resilience group may invite representatives of interested parties to participate in its work. ### 2. the critical entities resilience group shall be composed of representatives of the member states and the commission. where relevant for the performance of its tasks , the critical entities resilience group may invite representatives of interested parties to participate in its work , encouraging the active involvement of smes and civil society and trade unions for worker-related aspects such as training.


### (7) certain sectors of the economy such as energy and transport are already regulated or may be regulated in the future by sector-specific acts of union law that contain rules related to certain aspects of resilience of entities operating in those sectors. in order to address in a comprehensive manner the resilience of those entities that are critical for the proper functioning of the internal market , those sector-specific measures should be complemented by the ones provided for in this directive , which creates an overarching framework that addresses critical entities’ resilience in respect of all hazards , that is , natural and man-made , accidental and intentional. ### (7) certain sectors of the economy such as energy and transport are already regulated or may be regulated in the future by sector-specific acts of union law that contain rules related to certain aspects of resilience of entities operating in those sectors. in order to address in a comprehensive manner the resilience of those entities that are critical for the proper functioning of the internal market , those sector-specific measures should be complemented by the ones provided for in this directive , which creates an overarching framework that addresses critical entities’ resilience in respect of all hazards , that is , natural and man-made , accidental and intentional. resilience of energy infrastructures is integral to growth and production across the union , in particular it contributes to reduce energy poverty , ensuring a decent standard of living and to energy security.


### 1. by [three years and three months after entry into force of this directive] member states shall identify for each sector and subsector referred to in the annex , other than points 3 , 4 and 8 thereof , the critical entities. ### 1. by [three years and three months after entry into force of this directive] member states shall identify for each sector and subsector referred to in the annex , other than points 3 , 4 and 8 thereof , the critical entities , when applicable.


### 1. by [three years and three months after entry into force of this directive] member states shall identify for each sector and subsector referred to in the annex , other than points 3 , 4 and 8 thereof , the critical entities. ### 1. by [three years and three months after entry into force of this directive] member states , based on common guidelines issued by the commission , shall identify for each sector and subsector referred to in the annex , other than points 3 , 4 and 8 thereof , the critical entities.


### 2. each member state shall , within the competent authority , designate a single point of contact to exercise a liaison function to ensure cross-border cooperation with competent authorities of other member states and with the critical entities resilience group referred to in article 16 (‘single point of contact’). ### 2. each member state shall , within the competent authority , designate a single point of contact to exercise a liaison function to ensure cross-border cooperation with competent authorities of other member states , with the commission and with the critical entities resilience group referred to in article 16 (‘single point of contact’).


### 3. member states shall establish information sharing tools to support voluntary information sharing between critical entities in relation to matters covered by this directive , in accordance with union and national law on , in particular , competition and protection of personal data. ### 3. member states shall establish information sharing tools to support voluntary information sharing between critical entities , with the aim of increasing knowledge sharing and increased transparency within and between sectors , in relation to matters covered by this directive , in accordance with union and national law on , in particular , competition and protection of personal data.


### member states shall ensure that critical entities assess within six months after receiving the notification referred to in article 5(3) , and subsequently where necessary and at least every four years , on the basis of member states’ risk assessments and other relevant sources of information , all relevant risks that may disrupt their operations. ### member states shall ensure that critical entities assess within twelve months after receiving the notification referred to in article 5(3) , and subsequently where necessary and at least every four years , on the basis of member states’ risk assessments and other relevant sources of information , all relevant risks that may disrupt their operations.


### the commission shall organise the programme of an advisory mission , in consultation with the members of the specific advisory mission and in agreement with the member state where the infrastructure of the critical entity or the critical entity of european significance concerned is located. ### the commission shall organise the programme of an advisory mission , in consultation with the members of the specific advisory mission and the member state where the infrastructure of the critical entity or the critical entity of european significance concerned is located.


### the commission shall periodically review the functioning of this directive , and report to the european parliament and to the council. the report shall in particular assess the impact and added value of this directive on ensuring the resilience of critical entities and whether the scope of the directive should be extended to cover other sectors or subsectors. the first report shall be submitted by [six years after the entry into force of this directive] and shall assess in particular whether the scope of the directive should be extended to include the food production , processing and distribution sector. ### the commission shall periodically review the functioning of this directive , and report to the european parliament and to the council. the report shall in particular assess the impact and added value of this directive on ensuring the resilience of critical entities and whether the scope of the directive should be extended to cover other sectors or subsectors. the first report shall be submitted by [two years after the entry into force of this directive] and shall assess in particular how the scope of the directive should be extended to include the food production , processing and distribution sector.


### 5. health ### 5. health


### 9. public administration ### 9. public administration and democratic institutions


### (29) in order to achieve the objectives of this directive , and without prejudice to the legal responsibility of member states and critical entities to ensure compliance with their respective obligations set out therein , the commission should , where it considers it appropriate , undertake certain supporting activities aimed at facilitating compliance with those obligations. when providing support to member states and critical entities in the implementation of obligations under this directive , the commission should build on existing structures and tools , such as those under the union civil protection mechanism and the european reference network for critical infrastructure protection. ### (29) in order to achieve the objectives of this directive , and without prejudice to the legal responsibility of member states and critical entities to ensure compliance with their respective obligations set out therein , the commission should , where it considers it appropriate , undertake certain supporting activities aimed at facilitating compliance with those obligations. when providing support and training to member states and critical entities in the implementation of obligations under this directive , the commission should build on existing structures and tools , such as those under the union civil protection mechanism and the european reference network for critical infrastructure protection , or the european security and defence college , which can contribute to the development of a common european security culture.


### 1. competent authorities designated pursuant to article 8 shall establish a list of essential services in the sectors referred to in the annex. they shall carry out by [three years after entry into force of this directive] , and subsequently where necessary , and at least every four years , an assessment of all relevant risks that may affect the provision of those essential services , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11. ### 1. competent authorities designated pursuant to article 8 shall establish a list of essential services in the sectors referred to in the annex. they shall carry out by [three years after entry into force of this directive] , and subsequently where necessary , and at least every four years , an assessment based on a common methodology and indicators established for each specific sector covered , of all relevant risks that may affect the provision of those essential services , with a view to identifying critical entities in accordance with article 5(1) , and assisting those critical entities to take measures pursuant to article 11.


### ensure adequate physical protection of sensitive areas , facilities and other infrastructure , including fencing , barriers , perimeter monitoring tools and routines , as well as detection equipment and access controls; ### ensure adequate physical protection of sensitive areas , facilities and other infrastructure , including fencing , barriers , perimeter monitoring tools and routines , as well as detection equipment and access controls , while fully respecting data protection and privacy regulations and complying with sectoral and labour law;


### 4. each advisory mission shall consist of experts from member states and of commission representatives. member states may propose candidates to be part of an advisory mission. the commission shall select and appoint the members of each advisory mission according to their professional capacity and ensuring a geographically balanced representation among member states. the commission shall bear the costs related to the participation in the advisory mission. ### 4. each advisory mission shall consist of experts from member states and of commission representatives. member states may propose candidates to be part of an advisory mission. the commission shall select and appoint the members of each advisory mission according to their professional capacity , diverse background and ensuring a geographically and gender balanced representation among member states. the commission shall bear the costs related to the participation in the advisory mission.


### 2. the critical entities resilience group shall be composed of representatives of the member states and the commission. where relevant for the performance of its tasks , the critical entities resilience group may invite representatives of interested parties to participate in its work. ### 2. the critical entities resilience group shall be composed of representatives of the member states and the commission. where relevant for the performance of its tasks , the critical entities resilience group may invite representatives of interested parties to participate in its work , ensuring a diverse participation of stakeholders , and notably trade unions.


### (4) as regulation (eu) no 531/2012 expires on 30 june 2022 , the aim of this regulation is to recast it while introducing new measures to increase transparency , including on the use of value added services in roaming and ensure a genuine rlah experience in terms of quality of service and access to emergency services while roaming. the duration of this new regulation is set for 10 years , until 2032 , to provide certainty in the market and minimise regulatory burden while introducing a mechanism for intervening at wholesale level in the interim if market developments so require. ### (4) as regulation (eu) no 531/2012 expires on 30 june 2022 , the aim of this regulation is to extend the application of the abolition of roaming charges and recast the regulation while introducing new measures to increase transparency and consumer protection , including on the use of value added services in roaming , use of non-terrestrial networks in roaming on vessels and aircrafts , and ensure a genuine rlah experience in terms of quality of service and access to emergency services while roaming. the duration of this new regulation is extended , with review periods of two years to provide certainty in the market and minimise regulatory burden , which should include a mechanism for intervening at retail and wholesale level if market developments so require.


### (4) as regulation (eu) no 531/2012 expires on 30 june 2022 , the aim of this regulation is to recast it while introducing new measures to increase transparency , including on the use of value added services in roaming and ensure a genuine rlah experience in terms of quality of service and access to emergency services while roaming. the duration of this new regulation is set for 10 years , until 2032 , to provide certainty in the market and minimise regulatory burden while introducing a mechanism for intervening at wholesale level in the interim if market developments so require. ### (4) as regulation (eu) no 531/2012 expires on 30 june 2022 , the aim of this regulation is to recast it while introducing new measures to better protect consumers , increase transparency , including on the use of value added services in roaming and ensure a genuine rlah experience in terms of quality of service and access to emergency services while roaming. this regulation should be revised every two years to provide certainty in the market and minimise regulatory burden while introducing a mechanism for intervening at wholesale level in the interim if market developments so require.


### (8) a common , harmonised approach should be employed for ensuring that users of terrestrial public mobile communication networks when travelling within the union do not pay excessive prices for union-wide roaming services , thereby enhancing competition concerning roaming services between roaming providers , achieving a high level of consumer protection and preserving both incentives for innovation and consumer choice. in view of the cross-border nature of the services concerned , this common approach is needed so that roaming providers can operate within a single coherent regulatory framework based on objectively established criteria. ### (8) a common , harmonised approach should be employed for ensuring that users of public mobile communication networks when travelling within the union do not pay excessive prices for union-wide roaming services , thereby enhancing competition concerning roaming services between roaming providers , achieving a high level of consumer protection and preserving both incentives for innovation and consumer choice. in view of the cross-border nature of the services concerned , this common approach is needed so that roaming providers can operate within a single coherent regulatory framework based on objectively established criteria.


### (9) the widespread use of internet-enabled mobile devices means that data roaming is of great economic significance. this is relevant for both users and providers of applications and content. in order to stimulate the development of this market , charges for data transport should not impede growth , in particular considering that the deployment of 5g networks and services is expected to grow steadily . ### (9) the widespread use of internet-enabled mobile devices means that data roaming is of great economic significance. this is a decisive criterion for both users and providers of applications and content. in order to stimulate the development of this market , charges for data transport should not impede growth or negatively affect customers’ roam-like-at-home experience , in particular considering that the deployment of 5g networks and services is expected to grow steadily.


### (9) the widespread use of internet-enabled mobile devices means that data roaming is of great economic significance. this is relevant for both users and providers of applications and content. in order to stimulate the development of this market , charges for data transport should not impede growth , in particular considering that the deployment of 5g networks and services is expected to grow steadily . ### (9) the widespread use of internet-enabled mobile devices means that data roaming is of great economic significance. this is relevant for both users and providers of applications and content. in order to stimulate the development of this market , charges for data transport should not impede growth , in particular considering that the deployment of 5g networks and services including internet of things solutions is expected to grow steadily. notes the increased level of uncertainty the covid-19 pandemic brought to the predictability of future volumes of roaming traffic.


### (9) the widespread use of internet-enabled mobile devices means that data roaming is of great economic significance. this is relevant for both users and providers of applications and content. in order to stimulate the development of this market , charges for data transport should not impede growth , in particular considering that the deployment of 5g networks and services is expected to grow steadily . ### (9) the widespread use of internet-enabled mobile devices means that data roaming is of great economic significance. this is a decisive criterion for both users and providers of applications and content. in order to stimulate the development of this market , charges for data transport should not adversely affect the way consumers experience roaming as if at home , nor impede growth , in particular considering that the development and deployment of 5g networks and services is expected to grow steadily .


### (10) directive 2002/19/ec of the european parliament and of the council60 , directive 2002/20/ec of the european parliament and of the council61 , directive 2002/21/ec of the european parliament and of the council62 , directive 2002/22/ec of the european parliament and of the council63 and directive 2002/58/ec of the european parliament and of the council64 aimed to create an internal market for electronic communications within the union while ensuring a high level of consumer protection through enhanced competition. those directives were repealed by directive (eu) 2018/1972 of the european parliament and of the council65 . directive (eu) 2018/1972 aims to stimulate investment in and take-up of very high capacity networks in the eu as well as to set new spectrum rules for mobile connectivity and 5g. directive (eu) 2018/1972 also ensures that all citizens have access to affordable communication , including the internet. it increases consumer protection and security for users and facilitates regulatory intervention. ### (10) directive 2002/19/ec of the european parliament and of the council60 , directive 2002/20/ec of the european parliament and of the council61 , directive 2002/21/ec of the european parliament and of the council62 , directive 2002/22/ec of the european parliament and of the council63 and directive 2002/58/ec of the european parliament and of the council64 aimed to create an internal market for electronic communications within the union while ensuring a high level of consumer protection through enhanced competition. except for directive2002/58/ec , those directives were repealed by directive (eu) 2018/1972 of the european parliament and of the council65 . directive (eu) 2018/1972 aims to stimulate investment in and take-up of very high capacity networks in the eu as well as to set new spectrum rules for mobile connectivity and 5g. directive (eu) 2018/1972 also aims to contribute to the development of the internal market and promotes the interests of eu citizens. for example , it ensures that all citizens have access to affordable communication , including the internet. it increases consumer protection and security for users and facilitates regulatory intervention.


### (19) in accordance with article 109 of directive (eu) 2018/1972 , all end-users should have access to emergency services , free of charge , through emergency communications to the most appropriate public safety answering point (psap). member states are also required to ensure that access for end-users with disabilities to emergency services is available through emergency communications and is equivalent to that enjoyed by other end-users. it is for the member states to determine the type of emergency communications that are technically feasible to ensure roaming customers access to emergency services. in order to ensure that roaming customers have access to emergency communications under the conditions laid down in article 109 of directive (eu) 2018/1972 , visited network operators should inform the roaming provider through the wholesale roaming agreement about what type of emergency communications are mandated under national measures in the visited member state. in addition , wholesale roaming agreements should include information on the technical parameters for ensuring access to emergency services , including for roaming customers with disabilities , as well as for ensuring the transmission of caller location information to the most appropriate psap in the visited member state. such information should allow the roaming provider to identify and provide the emergency communication and the transmission of caller location free of charge. ### (19) the united nations convention on the rights of persons with disabilities (un crpd) requires its parties to take appropriate measures to ensure that persons with disabilities have access , on an equal basis with others , to information and communications technologies and systems. directive (eu) 2018/1972 aims to ensure the provision throughout the union of good quality , affordable , publicly available services through effective competition and choice , to deal with circumstances in which the needs of end-users , including those with disabilities in order to access the services on an equal basis with others , are not satisfactorily met by the market and to lay down the necessary end-user rights. in accordance with article 109 of directive (eu) 2018/1972 , all end-users should have access to emergency services , free of charge , through emergency communications to the most appropriate public safety answering point (psap). member states are also required to ensure that access for end-users with disabilities to emergency services is available through emergency communications and is equivalent to that enjoyed by other end-users. consequently , emergency communications are a means of communication that includes not only voice communications services , but also sms , messaging , video or other types of communications , for example real time text , total conversation and relay services. it is for the member states to determine the type of emergency communications that are technically feasible to ensure roaming customers access to emergency services. in order to ensure that roaming customers have access to emergency communications under the conditions laid down in article 109 of directive (eu) 2018/1972 , visited network operators should inform the roaming provider through the wholesale roaming agreement about what type of emergency communications are mandated under national measures in the visited member state. in addition , wholesale roaming agreements should include information on the technical parameters for ensuring access to emergency services , including for roaming customers with disabilities , as well as for ensuring the transmission of caller location information , including handset-derived information , to the most appropriate psap in the visited member state. such information should allow the roaming provider to identify and provide the emergency communication and the transmission of caller location free of charge.


### (28) roaming customers should , to the greatest extent possible , be able to use the retail services that they subscribe to and benefit from the same level of quality of service as at home , when roaming in the union. to that end , roaming providers should take the necessary measures to ensure that regulated retail roaming services are provided under the same conditions as if such services were consumed domestically. in particular , the same quality of service should be offered to customers when roaming , if technically feasible. ### (28) roaming customers should be able to use the retail services that they subscribe to and benefit from the same level of quality of service as at home , when roaming in the union. to that end , roaming providers should take the necessary measures to ensure that regulated retail roaming services are provided under the same conditions as if such services were consumed domestically. in particular , the same quality of service should be guaranteed to customers when roaming , if technically feasible.


### (29) roaming providers should be able to apply a ‘fair use policy’ to the consumption of regulated retail roaming services provided at the applicable domestic retail price. the ‘fair use policy’ is intended to prevent abusive or anomalous usage of regulated retail roaming services by roaming customers , such as the use of such services by roaming customers in a member state other than that of their domestic provider for purposes other than periodic travel. roaming providers should , in cases of force majeure caused by circumstances such as pandemics or natural catastrophes which involuntarily extend the period of temporary stay of the roaming customer in another member state , consider extending the applicable fair use allowance for an appropriate period , upon a justified request by the roaming customer . any fair use policy should enable the roaming provider’s customers to consume volumes of regulated retail roaming services at the applicable domestic retail price that are consistent with their respective tariff plans. ### (29) roaming providers should be able to apply a ‘fair use policy’ to the consumption of regulated retail roaming services provided at the applicable domestic retail price in very limited circumstances. the ‘fair use policy’ should only address abusive or anomalous usage of regulated retail roaming services by roaming customers. roaming providers should , in cases of force majeure caused by circumstances such as pandemics or natural catastrophes which involuntarily extend the period of temporary stay of the roaming customer in another member state , extend the applicable fair use allowance for an appropriate period. any fair use policy should enable the roaming provider’s customers to consume volumes of regulated retail roaming services at the applicable domestic retail price that are consistent with their respective tariff plans.


### (35) a contract which includes any type of regulated retail roaming service should specify the characteristics of that regulated retail roaming service , including the expected level of quality of service. the provider should make available information on relevant factors that can affect the quality of service , such as availability of certain technologies , coverage or variation due to external factors such as topography. ### (35) a contract which includes any type of regulated retail roaming service should specify the characteristics of that regulated retail roaming service , including the expected level of quality of service. those specifications should include clear and comprehensible information about the level of quality of service the operator must guarantee towards consumers. the provider should also make available information on relevant factors that can further affect the quality of service , including speed , latency , availability of certain technologies , coverage or variation due to external factors such as topography. those specifications should be provided in line with berec’s retail roaming guidelines.


### (36) roaming customers and home operators sometimes unwittingly incur large bills as a result of the lack of transparency on the numbers used for value added services across the union and on the wholesale prices charged for value added services. communications to certain numbers which are used for providing value added services , for example , premium-rate numbers , freephone numbers or shared cost numbers , are subject to particular pricing conditions at the national level. this regulation should not apply to the part of the tariff that is charged for the provision of value added services but only to the tariffs for the connection to such services. neverthelss , the rlah principle might create an expectation for end-users that communications to such numbers while roaming should not incur any increased cost in comparison to the domestic situation. however , this is not always the case when roaming. end-users are confronted with increased costs , even when they call numbers that are free when called domestically. this could erode customers’ confidence in using their phones when roaming and could result in bill shocks , thus having a negative impact on a genuine rlah experience. this is mainly caused , at retail level by the insufficient level of transparency on the higher charges which can be incurred because of communications to value added services numbers. therefore measures should be introduced to increase the transparency on the conditions for communications to value added services numbers. to that end , roaming customers should be informed in their contract and notified and warned , in a timely manner and free of charge , that communications to value added services numbers in roaming can entail additional charges. ### (36) roaming customers and home operators sometimes unwittingly incur large bills as a result of the lack of transparency and appropriate regulation on the numbers used for value added services across the union and on the wholesale prices charged for value added services. communications to certain numbers which are used for providing value added services , for example , premium-rate numbers , freephone numbers or shared cost numbers , are subject to particular pricing conditions at the national level. communications to such numbers while roaming should not incur any increased cost in comparison to the domestic situation. however , this is not always the case when roaming. end-users are confronted with increased costs , even when they call numbers that are free when called domestically. this could erode customers’ confidence in using their phones when roaming and could result in bill shocks , thus having a negative impact on a genuine rlah experience. this is mainly caused , at retail level by the insufficient level of regulation and the lack of transparency on the higher charges which can be incurred because of communications to value added services numbers. therefore measures should be introduced to protect consumers and increase the transparency on the conditions for communications to value added services numbers and to ensure that customers that are roaming within the union will pay the same amount as local customers for value-added services and ensure that customers keep paying the same price as at home when resorting to value-added services from their home country when travelling within the union. to that end , roaming customers should be informed in their contract and notified and warned upfront , in a timely , user-friendly manner and free of charge , when communications to value added services numbers in roaming can entail additional charges and applicable cut-off limit , which consumers can opt-out from.


### (43) in order to improve the transparency of retail prices for roaming services and to help roaming customers make decisions on the use of their mobile devices while abroad , providers of mobile communication services should supply their roaming customers with information free of charge on the roaming charges applicable to them when using roaming services in a visited member state. since certain customer groups might be well informed about roaming charges , roaming providers should provide a possibility to easily opt-out from this automatic message service. in addition , roaming customers should be provided with a text message including a link to a web page giving detailed information about the types of services (calls and sms) that may be subject to increased costs. moreover , providers should actively give their customers , provided that the latter are located in the union , on request and free of charge , additional information on the per-minute , per-sms or per-megabyte data charges (including vat) for the making or receiving of voice calls and also for the sending and receiving of sms , mms and other data communication services in the visited member state. ### (43) in order to improve the transparency of retail prices for roaming services and to help roaming customers make decisions on the use of their mobile devices while abroad , providers of mobile communication services should supply their roaming customers with information free of charge on the roaming charges applicable to them when using roaming services in a visited member state. in order to ensure a high level of protection for consumers , the home operator should also inform roaming customers of any additional charges that may apply for resorting to value-added services and the applicable cut-off limit to prevent bill-shocks. such information should be provided as soon as the consumer enters another member state and also when the roaming customer tries to reach a value-added service. in addition , providers of mobile communication services should inform consumers of the use of non-terrestrial networks on aircrafts or vessels and the cut-off limit that applies to protect them from bill-shocks. such information should be provided as soon as the mobile device connects to such non-terrestrial networks. roaming providers should provide a possibility to easily opt-out from this automatic message service without unduly subverting or impairing consumers’ autonomy , decision-making , or choice. in addition , roaming customers should be provided free of charge with a text message including a link to access , free of charge , a web page giving detailed information about the types of services that may be subject to increased costs. moreover , providers should actively give their customers , provided that the latter are located in the union , on request and free of charge , additional information on the per-minute , per-sms or per-megabyte data charges (including vat) for the making or receiving of voice calls and also for the sending and receiving of sms , mms and other data communication services in the visited member state.


### (44) this regulation should in relation to regulated retail roaming services lay down specific transparency requirements aligned with the specific tariff and volume conditions applicable following the abolition of the retail roaming surcharges . in particular , provision should be made for roaming customers to be notified , in a timely manner and free of charge , of the applicable fair use policy , when the applicable fair use volume of regulated voice , sms or data roaming services is fully consumed , of any surcharge , and of accumulated consumption of regulated data roaming services. ### (44) this regulation should in relation to regulated retail roaming services lay down specific transparency requirements aligned with the specific tariff and volume conditions applicable following the abolition of the retail roaming surcharges. in particular , provision should be made for roaming customers to be notified , in a timely and user-friendly manner and free of charge , of the applicable fair use policy , before and when the applicable fair use volume of regulated voice , sms or data roaming services is fully consumed , of any surcharge , and of accumulated consumption of regulated data roaming services and for using non-terrestrial networks in aircrafts and vessels such as boats or ferries.


### (45) customers living in border regions should not receive unnecessarily high bills due to inadvertent roaming. roaming providers should therefore take reasonable steps to protect customers against incurring roaming charges while they are located in their member state. this should include adequate information measures in order to empower customers to actively prevent such instances of inadvertent roaming. national regulatory authorities should be alert to situations in which customers face problems with paying roaming charges while they are still located in their member state and should take appropriate steps to mitigate the problem. ### (45) customers living in border regions should not receive unnecessarily high bills due to inadvertent roaming , including when connecting to non-terrestrial networks on aircrafts or vessels. roaming providers should ensure customers are effectively protected against incurring roaming charges while they are located in their member state. this should include an opt-in mechanism to roam in a network outside of the union and adequate and timely and clear information measures in order to protect and empower customers to actively prevent such instances of inadvertent roaming , including cut-off limits. national regulatory authorities should be alert to situations in which customers face problems with paying roaming charges while they are still located in their member state and should take appropriate steps to mitigate the problem.