Baltic bellwether: How to boost the EU’s civil preparedness

The Baltic incursion scenario. It is the spring of 2028. Russia, having used an uneasy 2026 ceasefire to recover economically and militarily from its war on Ukraine, launches a limited incursion into an Estonian border town. This is not a grand offensive by any means—just a small, calculated operation designed to probe the credibility of NATO’s and the EU’s collective defence commitments. Vladimir Putin did not have to send troops across the Pyrenees to rattle Europe, as Spanish prime minister Pedro Sánchez once put it. Nor did the move from the Kremlin require a major mobilisation: it took just a modest deployment to test NATO, one that Putin can easily reverse to prevent full-scale escalation.

Path one: safe not sorry. Europe is prepared. Its governments and people heeded the many warnings in 2024 and 2025 that Russia could be ready to act again in two to five years. The EU used this “window of vulnerability” to bolster Europe’s military readiness and its preparedness across society. Defence spending rose. Supply chains were shored up. Critical infrastructure was hardened. Hospitals, schools, transport systems and utilities developed the capacity to withstand shocks. So, allied forces respond quickly and in unison to Russia’s incursion. Daily life continues largely undisturbed across the EU, despite Russian sabotage attempts. Estonian hospitals and schools remain open and functioning, and essential supplies—water, food, energy—continue to flow. The population calmly follows well-rehearsed emergency protocols. Europe writ large holds firm, and Russia pulls back.

Path two: sorry not safe. Europe is not prepared. The EU remained true to tendency—hoping for the best until the worst happened. Governments made vague promises to increase their defence budgets, but a lack of clear timelines resulted in business as usual. Companies ignored contingency planning; operators of critical services failed to audit their vulnerabilities. Populations were complacent and left uninformed and unaware of emergency protocols. Russia’s incursion catches the continent off-guard. The military response is delayed and disjointed. Across the Baltics, energy supplies are disrupted and communications break down under the onslaught of Russian cyberattacks. Hospitals are overwhelmed and unfit to function in wartime conditions. All down the EU’s eastern flank, evacuations are panicked and poorly coordinated. In the absence of public messaging, societies begin to descend into unrest.

*

These scenarios, as with any others, are not predictions, but hypothetical versions of infinite unknowable futures. One thing is more certain, however: were an EU country to face an attack, the continent’s civil preparedness—the capacity of institutions and society to endure a foreign attack and cope with its fallout—would prove just as vital as its military readiness.

Civil preparedness

In March 2024, the European Commission launched its Preparedness Union Strategy. The document outlines 30 key actions to embed a “preparedness by design” ethos across EU policies. These include the creation of a “crisis hub” to improve coordination across existing structures, minimum preparedness criteria for essential services, strategic stockpiles of critical materials, regular EU-wide emergency drills and even the integration of crisis education into school curricula. It was launched almost in conjunction with the EU’s white paper for European defence, to stress the need for the bloc to pair military capacity-building with collective resilience.

In a recent policy brief for ECFR, I argued the EU should go further; it should adopt a binding legal act—an EU Preparedness Act—to align European rules and procedures with the realities of a time between peace and war, but also to prepare the bloc for other emergencies. The recent blackout in the Iberian Peninsula underlined the need for such a framework. That unwelcome stress-test revealed alarming shortfalls—in government readiness, utility resilience and household self-sufficiency—and the imperative for the EU to act faster in dealing with unforeseen circumstances. This holds whether the emergency is a technological breakdown, a natural disaster, or a conventional or hybrid attack.

Absent EU-wide legislation, the Nordic and Baltic states are leading the way. In Lithuania, hospitals are installing generators, building shelters, converting basements into underground operating theatres and conducting mass-casualty drills; health facilities in Estonia are stockpiling medical supplies, and distributing bulletproof vests and satellite phones to emergency medical teams. Preparations are under way, too, for the possibility of mass evacuations. The interior ministers of Estonia, Latvia and Lithuania recently committed to develop joint evacuation plans that ensure vulnerable groups are not left behind, as well as to streamline the exchange of information. This came after a joint declaration in May from eight EU interior and civil protection ministers, which called for urgent measures to strengthen civil protection, preparedness and resilience—nationally and at the EU level.

Institutional preparedness

The EU and member state governments need to prime their institutions—both public and private—to respond to the extraordinary

The EU and member state governments need to prime their institutions—both public and private—to respond to the extraordinary. This should involve clear and tested protocols on how to act in case of emergency or when presented with credible threats.

Every member state should put in place a robust system of civil emergency planning. This is a methodology first developed by NATO, which refers to it as “readiness”. NATO’s planning involves several subcommittees in charge of preventing disruption and ensuring continuity in the functioning of energy, transport, communications, health, food and water. Member states should learn from this and set up their own teams to anticipate and manage emergencies across vital sectors.

Public authorities will also have to create strategic reserves and ensure the stockpiling of critical goods, such as medical supplies, protective equipment or certain critical raw materials. In a 2024 report, Finland’s former president Sauli Niinistö foresaw a common European framework to coordinate this endeavour. Such a framework would be the most effective way for member states to proceed; it would enable them to rely on each other in case of need. Moreover, decentralised stockpiles that operate as a net are less vulnerable.

Civil protection agencies need to have secure emergency communication channels—especially when conventional networks fail. They also need public information systems, available at all times, to transmit clear and regular messages with safety precautions or reassurances. This will help prevent popular unrest and turmoil in the event of an emergency.

Private operators of critical infrastructure—for instance, energy grids, telecoms and food distribution chains—bear serious responsibilities. To protect their activities, they need to set firewalls, reinforce security and install backups, as well as establish emergency protocols, adopt contingency plans and conduct regular stress tests. This should aim to ensure the continuity or restoration of the services they provide. To do so, they will have to anticipate risks and proactively build resilience. It will not be enough to merely react when disaster strikes.

The EU’s Critical Entities Resilience directive has been in force since 2023. The aim of this framework is precisely to enhance the ability of these entities to overcome unforeseen disruptions and safeguard the constant provision of key services. It obliges member states to conduct regular risk assessments; while operators of critical infrastructure must take technical, security and organisational measures to ensure preparedness and notify governments of any incidents. This is underpinned by close cooperation between operators and national and European authorities. As the Niinistö report suggests, the EU should now expand the scope of this framework to the defence industrial base and to account for potential armed aggression.

Societal preparedness

Citizens and communities play an extremely important role in addressing crises. When the population is well prepared, well-stocked with critical supplies and well-trained to deal with emergencies, the likelihood of national resilience increases considerably.

It is therefore difficult to understand the often uneasy and sceptical reactions on social media to a recent video from Hadja Lahbib, the European commissioner in charge of preparedness and crisis management, in which she calls on every European citizen to prepare an emergency kit with essential goods to last 72 hours. Some political leaders also responded with accusations of fear-mongering. This line of argument totally misses the point. Such recommendations are not alarmist. In the current geopolitical and security landscape, they are prudent.

Several member states have similar guidelines. France, for instance, calls on its citizens to have a survival kit that includes food, water, medicines, a portable radio, a flashlight, spare batteries, chargers, cash, copies of important documents including medical prescriptions, spare keys, warm clothes and basic tools such as utility knives. The Nordic and Baltic states go further, distributing survival guides among the population. These range from simple flyers to extremely detailed booklets with precise instructions on household preparedness.

One other vital tool for societal preparedness is regular simulations and emergency drills in workplaces and schools. These should acknowledge meeting points, evacuation routes and the best places to shelter. Such exercises educate people on what to do in a crisis and help prevent panic, thereby contributing to a more resilient society.

The path taken

The EU and its member states should treat the next two years as an opportunity to reinforce their collective backbone. In a crisis, resilience cannot be improvised—it must have been built in advance. Europeans thus have some control over whether they may be heading for “safe not sorry” or “sorry not safe” (whatever Putin decides to do or not do). And it is better to be safe than sorry, indeed.