On 17 September 2026, mononews.gr published a statement by the Secretary General for the Protection of Critical Entities, Spyridon Papageorgiou, made on the sidelines of a conference on resilience in the water cycle. The Ministry of Citizen Protection republished the text on its website on 19 September. The general framework of Law 5236/2025 and the progress of its implementation are set out in the article → Law 5236/2025: where implementation stands after the 17 July 2026 deadline.
The first list by the end of October
According to the publication, the process of identifying critical entities is under way. The Secretary General said that the aim is to have the list ready by the end of October 2026. The law had set the identification for 17 July 2026 (Article 7(1)).
Each entity that is identified is notified within one month (Article 7(3)). From the date of notification the entity’s deadlines begin to run: nine months for its risk assessment (Article 13(1)) and ten months until Chapter C starts to apply, with its measures and resilience plan (Article 7(5)).
The publication mentions about ten months of compliance from the moment an entity is identified as critical. In the law, the ten months are counted from notification, which takes place at the latest one month after identification.
Compliance tested in practice
Mr Papageorgiou stressed that plans must be turned into real operational capabilities, be tested through exercises and provide specific alternatives when a critical dependency is lost. He also pointed out that the key question is whether the measures have actually been implemented and whether they can work when needed, even when the report or the risk assessment has been automated.
The law requires critical entities to have and implement a resilience plan or an equivalent document (Article 14(3)). Staff familiarisation with the measures includes training, awareness material and exercises (Article 14(1)(f)). Where its duties require it, the General Secretariat requires entities to provide evidence of the actual implementation of the measures. This includes the results of an audit by an independent, certified auditor, whom the entity selects and pays for (Article 22(2)(b)).
The entity’s risk assessment covers all relevant natural and man-made risks. It also examines dependencies in two directions, which other services the entity depends on and which sectors depend on its own (Article 13(2)). The Secretary General suggested turning the question around. Instead of examining each threat separately, one asks what can lead, for example, to a power outage and which threats can cause the same result. In this way the risk assessment of a critical energy entity must cover all risks, from every category of threat.
On dependencies, Mr Papageorgiou noted that two suppliers of a strategic material from the same country can be affected at the same time by the same crisis, so the alternative is inadequate.
Supervision rests with the General Secretariat, which can impose administrative sanctions (Article 23) when a critical entity has not taken the required measures. In imposing sanctions the General Secretariat takes into account in particular the seriousness, repetition and duration of the infringement, the damage caused and the taking of remedial measures (Article 22(4)).
What else he said
The Secretary General explained that investments will be planned and carried out by the critical entity itself, while the General Secretariat sets the specifications.
According to the publication, the General Secretariat is planning a national resilience management platform, where critical information will be gathered and the dependencies between sectors will be mapped. Critical entities will feed the platform with data, and the central administration will monitor their compliance and the possible knock-on effects of a crisis. According to Mr Papageorgiou, the platform has been designed at local level and still needs development and suitable hosting before it goes live. The publication adds that the design also includes digital twins, meaning digital replicas of real facilities in which scenarios of failure, natural disaster or attack are tested without risk to the real infrastructure.
On anti-drone systems, the Secretary General said that for civilian critical entities to use active countermeasures, the existing legislative framework needs to be amended. The publication adds that countering drones combines surveillance, detection and protection means. Even infrastructure that already exists for other purposes, such as security cameras, can be fitted into a broader surveillance architecture.
Mapping an entity’s essential services and dependencies can be done before notification. The risk assessment due within the nine months will need it, as it examines dependencies. What the law provides for each obligation, and how we work, is on the page → Critical Entities Resilience.
Sources
The provisions of Law 5236/2025 are in Government Gazette A’ 175 of 10 October 2025, published by the National Printing House.
This text is for information only and does not constitute legal advice.
