Article
June 4, 2026
What does the CER Directive mean for pharma companies?
The EU Critical Entities Resilience (CER) Directive brings new expectations for pharmaceutical companies regarding resilience, continuity, and board-level accountability. This means shifting from compliance-led risk management to system-wide operational readiness to weather disruptions.
Contact our expert
Patrick Moloney
Global Director, Sustainability & Resilience Advisory
Pharmaceutical manufacturing has long been understood through the familiar lenses of quality, regulatory compliance, and patient safety. These remain essential, but they no longer capture the full picture.
Governments across Europe are increasingly focused on medicine security as a matter of strategic policy, sometimes explicitly linked to wider considerations of European autonomy. Regulators are placing greater weight on continuity and structural resilience in addition to product quality. Investors are paying closer attention to the financial materiality of disruption risk. Large hospital systems and procurement bodies are beginning to factor resilience into supplier evaluation and contracting.
This perspective is increasingly reflected in European regulation. Under the EU Critical Entities Resilience Directive (CER Directive), Member States are required to identify organisations whose disruption would significantly affect the provision of essential services, including in the health sector. Designation introduces formal obligations relating to risk assessment, resilience measures, incident notification and regulatory oversight, alongside, rather than replacing, existing Good Manufacturing Practice and pharmacovigilance requirements. For companies producing essential medicines, resilience increasingly influences regulatory relationships, capital investment priorities, insurability, and corporate reputation.
For boards, operations leaders, and supply chain executives, the central question is: can the organisation continue to manufacture and release critical medicines when its systems are under stress?
When medicine becomes critical infrastructure
Critical infrastructure is most commonly associated with the visible, physical systems that keep societies running: power generation and transmission, water and wastewater networks, transport corridors, ports and airports, and the telecommunications backbone. These sectors are considered critical because society depends on their continued operation. When they fail, the consequences are immediate, geographically far-reaching and often politically charged.
The same underlying logic applies to certain parts of the pharmaceutical sector, even though the connection is less visually obvious. Pharmaceutical manufacturing tends to sit well away from public view. Yet the products that emerge from these facilities are woven directly into the daily operation of hospitals, clinics and pharmacies, and into the treatment plans of millions of patients.
Consider what an extended interruption to the production of insulin, antibiotics, sterile injectables, vaccines, or oncology therapies could mean in practice. Hospitals might postpone elective surgeries because intensive care backup is uncertain. Doctors might be forced to ration treatment courses or switch patients to less effective substitutes. The impact of medicine shortages on public health outcomes could deteriorate within weeks, particularly for patients with chronic conditions or active cancer treatment.
Aided by the COVID-19 pandemic, medicine security has moved from being a niche topic discussed within ministries of health to a matter of strategic concern across European governments and is increasingly understood to be part of the infrastructure required to maintain societal continuity.
Global Director, Sustainability & Resilience Advisory
Definition of a Critical Entity
Under the Directive, a critical entity is defined as:
“A public or private entity that has been identified by a Member State as providing one or more essential services, the disruption of which would have significant consequences for public safety, security, health, or the economic or social well-being of people in that Member State.”
Learn more about the critical entities and the CER Directive:
Why pharmaceutical manufacturing is part of critical infrastructure thinking
The CER Directive explicitly includes the health sector within its scope, and this creates a clear legal basis for Member States to designate organisations whose operations are essential to the continuity of healthcare services, including specific organisations whose disruption would meaningfully affect society.
Designation is made by national authorities following national risk assessments, with competent authorities drawing on sector-specific knowledge and consultation with the entities concerned, helping determine whether disruption to that company would have a significant downstream effect on healthcare delivery and patient outcomes. That assessment may depend on several interlocking factors including:
Clinical importance of products
Indispensable medicines such as insulin, vaccines, and blood products are likely to be considered critical over commodity therapeutics.
Substitute availability
The societal significance is great if no meaningful substitutes exist e.g. if a product is biologic, complex to manufacture, or protected by exclusivity.
Supply concentration
When production is concentrated in a few approved global facilities, smaller manufacturers may be strategically vital to healthcare resilience.
Recovery time
Pharmaceutical production can take weeks or months to restart after incidents due to validation requirements, regulatory approval, and depleted stockpiles.
System-wide healthcare impact
Critical designation is likely if disruption limits hospital operations, treatment programmes, or triggers public health responses.
Clinical importance of products
Indispensable medicines such as insulin, vaccines, and blood products are likely to be considered critical over commodity therapeutics.
Substitute availability
The societal significance is great if no meaningful substitutes exist e.g. if a product is biologic, complex to manufacture, or protected by exclusivity.
Supply concentration
When production is concentrated in a few approved global facilities, smaller manufacturers may be strategically vital to healthcare resilience.
Recovery time
Pharmaceutical production can take weeks or months to restart after incidents due to validation requirements, regulatory approval, and depleted stockpiles.
System-wide healthcare impact
Critical designation is likely if disruption limits hospital operations, treatment programmes, or triggers public health responses.
Taken together, these factors suggest that criticality is determined by the perceived consequence of the medical product manufactured rather than by the company size of the manufacturer.
What “critical entity” designation means in practice
For a pharmaceutical company, designation as a critical entity does not replace any existing regulatory obligation. It adds a new and more strategic layer of resilience governance on top of the existing compliance architecture, without softening existing requirements.
Good Manufacturing Practice (GMP) remains foundational, with quality systems, validation protocols, change control procedures, and patient safety controls the operational bedrock of the business. The Qualified Person remains responsible for batch release and pharmacovigilance obligations remain in force.
What CER designation does is require organisations to look beyond compliance within individual functions and to assess, in a structured way, how disruption could propagate across the enterprise as a whole. It is concerned less with the integrity of a single process, or traditional quality risk management, and more with the resilience of the broader operating system.
Global Director, Sustainability & Resilience Advisory
The purpose of designating health sector critical entities is to ensure that companies genuinely understand the interdependencies arising from disruption and demonstrate, rather than merely assert, that they are able to maintain or restore operations when disruption occurs.
Disruption could arise in many forms: utility failure that affects product lines; a cyber incident that disables the manufacturing execution system; a shortage of a specific active pharmaceutical ingredient; sudden unavailability of specialist personnel; or unclear decision-making structures, particularly between site, regional, and corporate leadership, that prolong disruption long after the immediate technical problem has been resolved.
Strategic implications for boards and leadership teams
For pharmaceutical leadership, the implications of moving towards a critical infrastructure framing are significant, and they extend well beyond the technical content of the CER Directive itself.
- Resilience is becoming a board-level responsibility, not just an operational concern related to manufacturing or IT. It should be a recurring feature on board agendas, supported by clear metrics and assurance, rather than appearing only after major incidents.
- Capital allocation will likely need to prioritise resilience measures such as redundancy, backup systems, dual sourcing, inventory buffers, and manufacturing flexibility. This can be contrary to efficiency-driven network optimisation, making the balance between resilience and capital discipline a key strategic issue.
- Network design is becoming a strategic decision beyond conventional make-versus-buy and footprint analysis. Highly centralised production models may be efficient but can create significant continuity risks that boards must conciously acknowledge.
- Engagement with regulators will require a more strategic and proactive approach. Under the CER Directive, authorities increasingly expect substantive dialogue on resilience, and early engagement is likely to make supervisory interactions more manageable.
- Resilience is starting to influence insurance, financing, and reputation. Insurers, reinsurers, lenders, and investors are focusing more on business interruption exposures and continuity under stress. Companies that can answer these questions credibly are likely to be viewed more favourably by all stakeholder groups.
Questions boards should be asking
Which of our products are genuinely essential to healthcare continuity, and how confident are we in that assessment? Boards may not have a full working sense of which products are commercially important without a clear view of which are critical in a societal sense. The two lists overlap but are not identical.
- Where are our most significant single points of failure, across sites, suppliers, digital systems and key personnel, and what would it actually take to mitigate them? Single points of failure tend to be known by engineers and supply chain teams long before they reach the board. Surfacing them deliberately is one of the most useful things board oversight can do.
- How quickly could we credibly recover from a major disruption, such as a fire at a key site, a cyber attack on our manufacturing systems, or the loss of a critical supplier? Are those recovery times consistent with the clinical importance of the products affected, or is there a gap we have not yet confronted?
- Could we demonstrate our resilience capability to a competent authority in a way that goes beyond documentation to evidence of real operational readiness? If a CER Directive supervisor walked into the organisation tomorrow, what story would the evidence tell?
- Are we investing in resilience at a level that is consistent with our actual societal role, or are we under-investing because the consequences of disruption do not fall on us alone?
Why identification matters even without formal designation
The CER Directive will only impact a subset of companies that are formally designated as critical entities. The Directive is a targeted instrument, and the identification process will appropriately focus on the organisations whose disruption would matter most.
While the CER Directive does not apply in the United Kingdom, similar concerns around medicine security and operational resilience are increasingly relevant for UK manufacturers and the broader UK healthcare ecosystem, with which European supply chains remain deeply interconnected.
In this environment, resilience is becoming a defining component of operational excellence in the pharmaceutical sector. The companies that understand their critical dependencies, invest deliberately in mitigating them, and strengthen their ability to maintain supply continuity during disruption will be better positioned to protect patients, preserve trust with regulators and payers, and sustain long-term enterprise value.
Frequently asked questions
Explore more within Life Sciences and Pharma
Discover how Ramboll helps pharma and biopharma organisations develop advanced manufacturing sites that enhance market readiness and shorten time‑to‑market for new therapies.
Contact our expert
Global Director, Sustainability & Resilience Advisory
