Risk Convergence in Critical Infrastructure Governance in the European Union

A Qualitative Framework for Integrated Multi Domain Risk Oversight

Abstract

The critical infrastructure sectors of the European Union (EU) face growing cross‑functional cyber, physical, operational, and human‑factor threats. With the increased pace of digitalisation, the effects of such risks spread across organisations, creating systemic vulnerabilities that challenge conventional governance models. This paper analyses the causes and effects of risk convergence and proposes an organised governance model to support integrated multi‑domain control. The study adopts a qualitative conceptual methodology based on academic literature, EU regulatory frameworks, industry reports, and documented incidents. Thematic analysis was used to identify recurring themes of risk convergence, supported by cross‑document comparison. Regulatory triangulation ensured alignment with NIS2, CER, GDPR, DORA, and the Cyber Resilience Act. Five patterns of risk convergence were identified: cyber‑physical interdependencies, operational‑cyber propagation, human‑factor amplification, regulatory‑risk misalignment, and organisational fragmentation. These patterns reveal governance vulnerabilities that undermine resilience and complicate compliance. The paper proposes a hybrid governance system comprising structural, operational, and assurance layers. This study presents one of the earliest governances‑focused models tailored to converged risk environments in EU critical infrastructure. It incorporates recent academic insights (2022–2024), sector‑specific examples, and regulatory expectations, offering practical guidance for policymakers and operators seeking to enhance resilience in complex socio‑technical systems.