On 22 September 2026, the European Commission presented a foresight study on the EU’s future disaster resilience. The announcement highlights capabilities such as early warning, cross-border cooperation and continuity of essential services, alongside emerging technologies. A foresight study is not a forecast that particular disasters will occur, nor a new obligation imposed on every business. Its practical value for corporate leaders is the invitation to describe resilience as a capability that can be examined, rather than a reassuring adjective. [1]
For the cyber component of a wider continuity exercise, the NCSC’s structured exercise guidance is a useful operational reference. Its value lies in discussion and follow-up, not in providing a badge that an organisation can use as proof of complete preparedness. [2]
Start with the service people rely on
A company may describe its infrastructure, technology or geographic reach as resilient. Customers experience something more concrete: the availability of a service when conditions become difficult. Define which functions are essential, who depends on them and what interruption would mean. A logistics operator, for example, should distinguish a delayed shipment from the loss of information customers need to plan around that delay. This is a hypothetical illustration, not a measured case. Communications becomes more useful when it starts with the user’s decision, rather than repeating the organisation’s internal description of its assets.
Map dependencies before promising independence
Most services rely on other organisations for energy, connectivity, transport, staffing or specialist support. A credible continuity account identifies critical dependencies and the arrangements for managing them. It should not imply that owning several sites removes all shared risks. Different locations may still depend on the same supplier or communications system. For an international company establishing a French operation, the map should include the relationship between headquarters, local management and outsourced providers. The public version need not expose sensitive infrastructure details, but it should accurately reflect the limits of the company’s control and the safeguards it can demonstrate.
Make cross-border handovers explicit
An incident can begin in one country and affect customers in another before headquarters understands the full picture. Establish who informs the French team, who can contact local stakeholders and how information is reconciled across time zones. A single global approval route may be too slow for practical service updates. Conversely, uncoordinated local statements can create contradictory explanations. Agree a common incident record and delegated authority for defined messages. The process should allow local teams to describe verified effects without speculating about causes. That distinction supports both speed and accuracy during the period when information remains incomplete.
Technology needs an operating context
The Commission’s announcement discusses emerging technologies within a wider capability approach. [1] Businesses should apply the same discipline to their own claims. A sensor, digital twin or AI tool is useful only in relation to a decision and a response process. Explain what it detects, who interprets the signal and what happens next. Do not imply that purchasing a tool establishes organisational readiness. A technical system can identify a problem while a governance gap prevents action. The communications story should therefore include people, procedures and escalation, not only the technology that looks most impressive in a demonstration.
Test the promise under an inconvenient scenario
A useful exercise should challenge at least one assumption that makes the standard plan comfortable. Introduce a supplier outage, an unavailable spokesperson or a failure of the usual customer channel. Ask teams to maintain a reliable public record while operational choices evolve. Measure whether people know what to do, how quickly contradictions are corrected and whether vulnerable users can obtain information. An exercise is not proof that a company will perform perfectly in a real crisis. It is evidence that the company has tested a process, identified weaknesses and assigned corrective work to accountable owners.
Report improvement without declaring invulnerability
A resilience update can describe completed actions, unresolved dependencies and the next test. Avoid the claim that a business is fully protected from disruption. Stakeholders are better served by a clear account of what the organisation can maintain and how it will communicate when limits are reached. Where service commitments change after a review, explain the practical implications to customers and staff. Do not let a reputational desire for reassurance conceal an operational restriction. Trust grows when people can plan using accurate information, even when that information includes uncertainty or an acknowledged weakness.
What the board should request
Ask for a service-dependency map, a tested escalation process, a stakeholder information plan and evidence that lessons from exercises have been implemented. The communications component should connect the operational plan to the decisions people outside the crisis team need to make. Belief System supports crisis preparation and leadership communication across markets, working with operational and specialist teams. The September study provides a timely framework for asking better questions; it does not validate a particular company’s resilience. The objective is a precise, examinable promise about continuity, supported by procedures that can be updated as the organisation learns.