All EU Member States will be required, inter alia, to draw up a national strategy for critical infrastructure and to prepare national risk assessments. From the risk assessment, Member States must identify critical entities (e.g. companies or public authorities) using, inter alia, common EU criteria. At the same time, critical entities are required to implement certain technical and organisational measures to be monitored by Member States through competent authorities.

One of these measures is so-called employee safety management, including background checks on selected employee groups in critical units. These entities will be subject to enhanced supervision, in which the Commission may, inter alia, request the delivery of the risk assessment and implementation plan for the technical and organisational measures, and conduct advisory missions to assess those measures.

In other words, there is a requirement that a background check must, as a minimum, confirm the identity of the person subject to the background check.check the criminal records of that person for offenses that would be relevant to a particular position.

This could lead to sector-specific requirements, depending on how the sectoral authorities choose to design their implementing directives.