{"id":3209,"date":"2026-09-04T15:17:49","date_gmt":"2026-09-04T13:17:49","guid":{"rendered":"https:\/\/securitydefence.gr\/?p=3209"},"modified":"2026-09-07T12:31:36","modified_gmt":"2026-09-07T10:31:36","slug":"n-5236-2025-prothesmia-17-iouliou","status":"publish","type":"post","link":"https:\/\/securitydefence.gr\/en\/n-5236-2025-prothesmia-17-iouliou\/","title":{"rendered":"Law 5236\/2025: where implementation stands after the 17 July 2026 deadline"},"content":{"rendered":"

Law 5236\/2025 transposed Directive (EU) 2022\/2557 on the resilience of critical entities into Greek law and was published in Government Gazette A’ 175 on 10 October 2025. The law itself set 17 January 2026 for the National Strategy together with the risk assessment, and 17 July 2026 for the identification of critical entities. Neither date was met, and the account below sets out where implementation stands today, with a source for each item, as at 4 September 2026.<\/p>\n

What has happened so far<\/h4>\n

The General Secretariat for the Protection of Critical Entities was established on 21 March 2025 by Article 200 of Law 5187\/2025 (Government Gazette A’ 48), within the statute reorganising the Hellenic Police, almost seven months before the law that transposed the Directive. In October 2025, Law 5236\/2025 designated the Secretariat as the country’s competent authority and single point of contact. On 8 April 2026, the first inter-agency meeting of the organisations concerned was held at the Ministry of Citizen Protection, coordinated by the Secretary General for Public Order, as the Secretariat did not yet have a secretary general of its own.<\/p>\n

The post was filled in July 2026, when the appointment of the first Secretary General for the Protection of Critical Entities was signed on 10 July by joint decision of the Prime Minister and the Minister of Citizen Protection, and published on 13 July in Government Gazette Y.O.D.D. 1002, the series for senior public appointments. Under Article 24(4), critical entities are identified by a decision of that same Secretary General. The deadline was 17 July, four days after the appointment was published.<\/p>\n

The National Strategy, which Articles 5 and 6 required to be ready by 17 January 2026 together with the risk assessment, was six months late. The Government Council for National Security approved it on 23 July 2026, as provided for in Article 24(2). The text posted on the Ministry’s website on 4 August is marked \u03a3\u03a7\u0395\u0394\u0399\u039f, meaning draft, on every page, so an entity turning to the Strategy today is reading the draft.<\/p>\n

Two steps are still outstanding: the presidential decree on the organisation, structure and staffing of the Secretariat, which has not been issued, as the Secretariat’s own web page states, and the identification of critical entities, which has not been announced.<\/p>\n

What this means for an entity<\/h4>\n

The law does not impose obligations on entities from the date of its publication, but brings those obligations into effect in stages, in the order set out in Article 7.<\/p>\n

First, the Secretariat identifies which entities are critical. Within one month of that identification it notifies them, under Article 7(3). Ten months after notification the substantive obligations begin to apply, under Article 7(5), namely the risk assessment, the resilience plan and the measures in Chapter C.<\/p>\n

As no identification has been announced, there is no public indication that the ten-month period has begun. For an entity that is waiting, this means that no compliance deadline has expired yet. It also means that, once notification arrives, the ten months start to run. The criteria for falling within scope are already published, in Articles 7 and 8, so an entity can assess now whether it is likely to be identified as critical. \u2192 What the law provides for critical entities<\/a><\/p>\n

The infringement case<\/h4>\n

The deadline for transposing the Directive was 17 October 2024. On 27 November 2024, the European Commission sent Greece a letter of formal notice, and on 17 July 2025 a reasoned opinion, in case INFR(2024)0269. The reason was that no national transposition measures had been notified. The law was published less than three months after the reasoned opinion.<\/p>\n

Greece notified Law 5236\/2025 to the Commission, declaring transposition complete. The case, however, is still recorded as open in the Commission’s register of infringement decisions.<\/p>\n

Sources<\/h4>\n

The legislation cited above is available from the National Printing House, under the Government Gazette references given in the text. For the rest:<\/p>\n

Government Spokesperson’s announcement on the meeting of the Government Council for National Security, 23 July 2026<\/a><\/p>\n

National Strategy for the Resilience of Critical Entities 2026-2030, as posted by the Ministry of Citizen Protection<\/a><\/p>\n

General Secretariat for the Protection of Critical Entities, Ministry of Citizen Protection<\/a><\/p>\n

National transposition measures for Directive 2022\/2557, EUR-Lex<\/a><\/p>\n

Case INFR(2024)0269 in the European Commission’s register of infringement decisions<\/a><\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>","protected":false},"excerpt":{"rendered":"Law 5236\/2025 transposed Directive (EU) 2022\/2557 on the resilience of critical entities into Greek law and was published in Government Gazette A’ 175 on 10 October 2025. The law itself set 17 January 2026 for the National Strategy together with the risk assessment, and 17 July 2026 for the identification of critical entities. Neither date...","protected":false},"author":2,"featured_media":3214,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[203],"tags":[],"class_list":["post-3209","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-203"],"_links":{"self":[{"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/posts\/3209","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/comments?post=3209"}],"version-history":[{"count":3,"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/posts\/3209\/revisions"}],"predecessor-version":[{"id":3215,"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/posts\/3209\/revisions\/3215"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/media\/3214"}],"wp:attachment":[{"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/media?parent=3209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/categories?post=3209"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securitydefence.gr\/en\/wp-json\/wp\/v2\/tags?post=3209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}