Resilient societies and liveability
Patrick Moloney
March 21, 2026
When infrastructure becomes critical
When one adjective indicates a fundamental change in what ownership, risk, and responsibility means.
In recent years, critical infrastructure systems have been subject to a series of disruptive events that have exposed their underlying fragility. Strategic energy assets have been abruptly taken offline, triggering immediate market reactions and wider geopolitical consequences. At the same time, extreme weather events have disrupted transport networks, water systems and power infrastructure simultaneously across multiple regions. These are not isolated failures but rather system-level events that signal something structural about the operating environment that infrastructure investors now operate in.
Something subtle (or indeed not so subtle…) is happening in the language of infrastructure investment, and it matters more than most investors may have yet recognised.
The word “critical” has migrated from being a general intensifier to occupying a precise, legally defined, and operationally consequential position in front of the word “infrastructure”.
It is important to note that this is not an article about regulatory compliance but rather about how a deeper shift in the nature of infrastructure is now being expressed through regulation. It is about what that linguistic and conceptual shift reveals about the nature of the assets in which infrastructure investors are placing capital, and what it demands of them in return.
The adjective that is now a name
For most of modern infrastructure finance, the investment thesis has been largely self-contained. Investors acquire essential assets, generate stable cash flows, manage operational risk, and rely on long holding periods to deliver returns. Disruption, in this model, is treated as an asset-level problem. The consequences of failure are primarily financial, and the tools for managing them are well-understood.
"Critical" infrastructure is something categorically different. The defining characteristic is not the importance of the asset to its owner, but the consequence of its failure to the systems around it. When a critical infrastructure asset fails, it cascades, causing disruption through interconnected systems such as energy into transport, transport into supply chains, and digital into everything. The failure of a single node becomes the degradation of a network, and the degradation of a network becomes a societal event.
“Critical” is not a description of how important an asset is. It is the description of what happens when it stops working"
This distinction is not semantic. It reflects a fundamental difference in how assets interact with the systems around them, and therefore a fundamental difference in how they should be assessed, managed, and valued. Some important structural characteristics below help to define what criticality means in practice.
- Non-substitutability: Services cannot be rerouted or replaced quickly. Any disruption creates immediate pressure on dependent systems.
- System dependency: Assets sit within interconnected networks e.g., energy, transport, water, and digital. Failure in one propagates through others.
- Societal reliance: Essential public functions depend on continued operation. Failure affects public safety, economic activity, and political confidence.
- Continuity expectation: Minimal tolerance for downtime exists even under extreme conditions. Restoration alone is insufficient, and continuity is the standard.
- State interest: Governments have a direct stake in performance. This introduces regulatory oversight, reporting obligations, and potential intervention.
These characteristics define not just how critical infrastructure behaves under disruption, but how it must be priced and governed across the investment lifecycle.
What the CER Directive tells us, and what it does not
In January 2023, the EU's Critical Entities Resilience Directive (EU) 2022/2557 came into force, requiring member states to identify critical entities across eleven sectors and to impose obligations relating to, for example, risk assessment, resilience planning and governance.
The Directive has not created criticality but rather it has recognised and formalised it. The underlying dynamics it addresses, such as system interdependency, cascading failure pathways, societal reliance, and state interest in continuity, are already structural features of modern infrastructure systems. What the Directive does is translate those realities into a regulatory framework, making explicit what had previously been implicit.
It practical terms, it does two things.
- It creates a formal process by which assets are designated as critical, with all the obligations that follow.
- More importantly for investors, it places resilience at the centre of what operators must demonstrate. An entity subject to the Directive must not only function under normal conditions but it now must maintain continuity under stress.
For infrastructure investors, the Directive's most important effect is signal it sends about where the regulatory and political centre of gravity is moving, and not the compliance need it creates. Across Europe, and increasingly beyond it, governments are coming to view critical infrastructure not as private assets that happen to perform public functions, but as public goods that happen to be privately owned. That shift in perspective has direct consequences for how ownership is understood, how performance is measured, and how accountability is assigned.
How criticality changes the investment model
For infrastructure investors, criticality alters the underlying logic of how assets are evaluated, managed, and valued over time. Traditional investment models are built on the assumption that risk can be contained, performance optimised, and disruption absorbed within the boundaries of the asset. Critical infrastructure does not behave that way.
The implications are structural. Criticality changes how risk is understood, how resilience is defined, how ownership is exercised, and how value is protected over long holding periods.
1. Risk is no longer contained within the asset
Infrastructure risk models are built around the asset itself, i.e. its age, condition, exposure to specific hazards and contractual protection. These models are effective when the consequences of failure are largely contained within the asset boundary. They are far less effective when the asset is embedded within a wider system of dependencies.
Critical infrastructure assets are, by definition, system embedded. A single node sits within multiple layers of interconnection, where disruption can propagate across sectors and geographies. Failure is no longer a discrete event but a trigger for wider system degradation. To continue to model risk at the asset level may underestimate both the likelihood and the consequence of disruption. The scenarios that matter most are those in which a localised failure leads to wider systemic impact. These require network-level analysis, dependency mapping, and an understanding of cascade pathways that are not yet standard in infrastructure due diligence.
2. Resilience is a performance standard rather than a cost
In infrastructure management, resilience is often framed as a defensive measure, such as hardening assets against known hazards, building redundancy, and maintaining emergency response capability. In this context, it is treated as a cost, justified by its ability to reduce the probability or severity of adverse events.
For critical infrastructure, resilience is not an adjunct to performance but rather a core component. The expectation is now that assets maintain continuity during disruptions rather than recover after failure. This distinction is fundamental. Assets that cannot demonstrate this capability will face increasing regulatory pressure, potential licence constraints, and ultimately questions about their long-term viability. From an investor perspective, this directly affects downside risk, capital allocation, and the durability of returns.
3.Ownership implies stewardship
When an asset is designated as critical, ownership carries an implicit public dimension. Investors are no longer simply providers of capital to a commercial operation. They are stewards of services on which societies and economies depend.
This introduces expectations that extend beyond contractual and regulatory compliance. It shapes how assets are operated in normal conditions, how disruption is managed, how information is shared with authorities, and how decisions are made when commercial and public interests are not perfectly aligned. The gap between how investors traditionally frame their role and how it is increasingly perceived by regulators and governments is not merely conceptual. It is a source of political, regulatory, and operational risk that can crystallise quickly under stress conditions.
4.Regulation is becoming a condition of operation
The CER Directive and the broader trajectory of critical infrastructure regulation point towards a shift in how regulation functions. It is no longer simply a set of compliance requirements but rather increasingly a framework through which the licence to operate is defined and maintained.
This shift is already visible in sectors undergoing structural transition, such as energy, and is emerging in others, including water and digital infrastructure. For investors, this changes the role of regulatory engagement. It needs to be treated as a strategic discipline, integrated into investment decision-making and asset management.
The maturity gap and why it matters now
There is a significant and underappreciated gap between the resilience maturity of most infrastructure portfolios and what genuine critical infrastructure operation requires. Most assets have adequate maintenance programmes, reasonable emergency response capabilities, and basic business continuity arrangements. Far fewer have integrated multi-hazard risk assessments that account for interdependencies and cascading failures. Fewer still have adaptive management frameworks that treat resilience as a dynamic capability requiring continuous investment, monitoring, and adjustment over time.
This gap can be understood in terms of four broad maturity levels. At the lower end, resilience is reactive and compliance-driven, with disruption managed on an ad-hoc basis. As maturity increases, processes become more structured but often remain siloed, with hazards assessed individually and interdependencies insufficiently understood. More advanced organisations adopt integrated, multi-hazard approaches supported by proactive monitoring, enabling a more credible regulatory posture and improved value protection. At the leading edge, resilience is embedded within governance and reporting, treated as a strategic capability, and managed as an adaptive system that evolves in response to emerging risks.
This maturity gap is largely invisible in current portfolio reporting. Resilience is not routinely treated as a performance metric, and cascade risk is rarely a standard line in due diligence. Regulatory evolution under frameworks such as CER is often tracked by legal and compliance teams, but less frequently integrated into investment committee discussions or asset-level performance reviews.
The consequence is that many infrastructure portfolios carry embedded resilience risk that is neither explicitly managed nor fully reflected in valuation. In financial terms, this represents unpriced downside exposure that is most likely to materialise under stress conditions, precisely when there is least capacity to absorb it.
Integrating criticality into investment practice
Criticality is not a regulatory category to be monitored at arm’s length. It is an investment lens that needs to be embedded across the full lifecycle, from acquisition through asset management to portfolio construction.
At the due diligence stage, the starting point is systemic position, not just asset condition. What does this asset depend on? What depends on it? How does failure propagate outward, and how do failures elsewhere propagate inward? These questions require dependency mapping and cascade risk analysis alongside the standard financial and technical review. The regulatory trajectory under frameworks such as CER should be assessed with the same rigour as revenue assumptions, including designation status, likely obligations, and the capital expenditure required for compliance. Where resilience maturity is low, this is not a manageable gap to be noted in the risk register but rather a capital requirement that should be reflected in acquisition pricing.
At the asset management stage, resilience needs to sit alongside EBITDA and operational efficiency as a reported performance metric. This requires the establishment of clear indicators, including continuity performance under stress events, progress against multi-hazard risk assessments, dependency exposure, and regulatory readiness. It also requires investment in adaptive capacity, specifically the internal capability to identify emerging threats early and respond before they escalate into incidents. Regulatory engagement should be active and strategic, rather than reactive.
At the portfolio level, the key question is systemic concentration, and conventional sector diversification does not fully address it. A portfolio spread across energy, transport, and digital assets may appear well diversified until the dependencies between those assets and the shared critical systems underpinning them are mapped. Portfolio-level dependency mapping should be more commonly carried out.
The obligation that comes with designation
Infrastructure investors have always operated in regulated environments, managed operational complexity, and navigated political risk. What is new is the formal designation of criticality and the chain of implications that follows from it.
Critical infrastructure behaves differently. It carries systemic risk, requires continuity under stress, and attracts sustained state interest. These characteristics reshape how assets need to be assessed, managed, and ultimately valued. They also reshape what investors are responsible for, whether or not they have historically framed it in those terms.
The CER Directive is one expression of this shift, but it is not the cause. The cause is structural. Infrastructure systems have become more interconnected, more exposed, and more consequential in their failure than the investment models built around them assumed.
Criticality is becoming a defining characteristic of the asset class itself. As such, it needs to be integrated into investment logic, shaping acquisition discipline, asset management rigour, and portfolio construction. In this context, resilience is not simply a compliance requirement, but a mechanism for value protection and differentiation.
Want to know more?
Patrick Moloney
Global Director, Sustainability Consulting & ESG
+45 51 61 66 46
FEATURED INSIGHTS
Investable infrastructure
Resilient societies
Policy-aligned, permit-certain, and performance-proven. Why policy and regulation increasingly determine the bankability of European infrastructure assets.
Private equity and resilience
Resilient societies
Private equity needs to broaden its understanding of resilience from a financial property to a system-level capability. Rather than treating resilience as an add-on to value creation or a subset of ESG, it should be built into the core structure of how funds are designed.
