Governing Critical Infrastructure Resilience In The European Union: The Evolution And Limits Of The Institutional Framework

The study examines the transformation of the European Union’s (EU) governance framework in the field of critical infrastructure resilience, in the context of the proliferation of hybrid risks characterized by physical-digital interdependencies. Starting from the premise that contemporary threats can no longer be conceptualized as distinct phenomena, the study explores how the new normative instruments - particularly Directives (EU) 2022/2557 (CER) and (EU) 2022/2555 (NIS2) - respond to a risk landscape characterized by systemic interdependencies and cascading effects. Methodologically, the study combines an institutional and legal analysis of the European architecture for the protection and resilience of critical infrastructures with a functional assessment based on hypothetical hybrid crisis scenarios. This approach enables the identification of persistent operational gaps between sectoral responsibilities, levels of governance, and coordination mechanisms. The study’s main contribution lies in proposing an integrated analytical framework for assessing the EU’s capacity to manage interconnected physical-digital risks, while highlighting the limitations of the current fragmented governance model. The study argues that, despite recent normative advances, the resilience of critical infrastructures remains constrained by a deficit in operational coordination and by insufficient integration between cybersecurity policies, civil protection, and crisis management. In conclusion, the study underscores the need to strengthen forms of hybrid governance capable of overcoming traditional sectoral divisions and enabling a systemic approach to complex risks at the European level.