Resilience is not just a question of technology, but also of the law 

In many organisations, resilience has become an integral part of strategic discussions. Particularly companies providing and maintaining critical infrastructure focus often on technical and organisational measures: robust infrastructures, clear processes and effective emergency plans. 

This is sensible and necessary. At the same time, practice shows that resilience cannot be understood solely as a technical concept. Legal frameworks also have a decisive influence on how capable an organisation actually is while exposed to exceptional situations. 

Current legislation within the EU and the United Kingdom even shows that resilience is increasingly becoming a legal obligation for corporate bodies. The EU Directive on the resilience of critical entities (CER Directive) and the NIS 2 Directive require operators of essential and important entities to implement comprehensive resilience measures. In the United Kingdom, the Network and Information Systems Regulations 2018 and subsequent regulations set comparable standards. Non-compliance can result in significant penalties, in some Member States, fines of up to 2% of the global annual turnover. 

Law as part of resilience concepts 

Resilient organisations are characterised less by perfect plans than by their ability to make appropriate decisions in the situation at hand. 

Many resilience and crisis concepts take legal aspects into account, but often in an auditing rather than a creative role. 

An integrated approach goes further: 

• Legal requirements are considered at an early stage 

• Decision-making processes are legally secure 

• Responsibilities are clearly defined, even for exceptional situations 

• Documentation and communication obligations are coordinated 

In this way, the law does not become an additional control point, but rather a stabilising element. 

Relevance for management and legal departments 

For managing directors and board members, resilience is a management and organisational responsibility. Legal clarity provides guidance and security for decisions, especially against the backdrop of harmonised EU requirements and parallel developments in the United Kingdom. 

For heads of legal departments, this opens up the opportunity to actively shape resilience: 

• through structured risk assessments in line with EU and UK requirements 

• through practical guidelines for exceptional situations 

• through the translation of regulatory requirements into manageable processes 

Both roles benefit from a common understanding of resilience. 

The interface makes the difference 

Resilience unfolds its full effect where technology, organisation and law intertwine – not as parallel disciplines, but as coordinated elements. 

Such an approach increase: 

• the consistency of decisions 

• transparency vis-à-vis supervisory authorities and stakeholders in different jurisdictions 

• internal confidence in dealing with exceptional situations 

The crucial question is therefore not: Is our resilience technically sufficient? 

But rather: Do our legal structures support organisational capacity to act across national borders? 

Resilience is therefore less an ad hoc issue but more an ongoing task. Its quality increases when legal issues are addressed early on and constructively, considering the different but increasingly harmonised requirements within in the EU and the UK. 

Do you have any questions on this topic? Please feel free to contact Oliver Huq here.