When an Iranian-made drone struck near RAF Akrotiri in Cyprus in March, inspectors fanned out to check the island's 2,500 registered civil shelters. They found blocked parking garages. Basements used for storage. Sites listed on the official safety app that could not be located at all. About 200 were simply unusable.
Cyprus is an extreme case, but it illustrates a continent-wide problem. Civil defence infrastructure built during the Cold War has been quietly crumbling for three decades. And the EU, whose treaty explicitly limits it to a support role on civil protection, is poorly placed to do much about it.
Poland has the most exposed position of any NATO state on the eastern flank — and perhaps the most honest accounting of what it faces. The country currently has about 1,000 shelters deemed fit for use, enough to protect at most 3% of its 37 million citizens. Finland, its northern ally with the longest NATO border with Russia, has a network of roughly 50,000 shelters capable of protecting at least 80% of its population.
The gap did not form overnight. For decades, NATO's eastern members assumed the Cold War threat had passed and redirected resources to other priorities. Poland, which spends close to 5% of GDP on military hardware, allocated almost nothing to civilian resilience. What finally forced the issue was a string of incidents: a suspected Kremlin-linked bombing of a Polish rail line, Russian drones entering Polish airspace, and a wide-scale hybrid warfare campaign targeting NATO's eastern flank.
Poland's Civil Protection and Defence Act came into force in early 2025. From 2026, developers are legally required to include bomb-shelter facilities in most new residential and commercial buildings. The government allocated PLN 16 billion — €3.8 billion — in the 2025 budget for shelter construction, with the bulk routed directly to municipalities. Warsaw announced plans to convert its metro system into a shelter accommodating 100,000 residents, with camp beds, drinking water and blankets.
Poland is also redirecting around PLN 26 billion in EU post-pandemic recovery funds toward dual-use infrastructure, including civil defence facilities, logistics corridors and cybersecurity assets. Poland's national security bureau head Sławomir Cenckiewicz put it directly: "We genuinely need to strengthen the resilience of civil society. Poland in recent years focused on modernising the armed forces and forgot about this." The country is studying Finland's model — which took 70 years to build and now covers the vast majority of its citizens.
Germany is moving in the same direction, starting from a different baseline. Bundesinnenminister Alexander Dobrindt announced a sweeping expansion of civil protection running to 2029: more than 1,000 specialised emergency vehicles, around 110,000 beds for field hospitals, an expanded national siren network and a new official map of shelter locations across the country — a total envelope of €10 billion.
The non-profit Berliner Unterwelten association, which manages some 20 former bunker and tunnel complexes beneath the capital, has begun preparing two of them as functioning shelters: the former civil protection facility at Gesundbrunnen and a Second World War-era bunker in Reinickendorf. Together they would accommodate about 2,000 people. As the association's director Kay Heyne noted: "Not much for a city like Berlin, but a start."
The EU's role is tightly circumscribed by treaty. Under Article 196 of the Treaty on the Functioning of the European Union, civil protection is a national competence. Brussels can assist and coordinate — but it cannot mandate shelter construction, set technical standards for bunkers or fund blast-resistant infrastructure directly.
What it does control is the rescEU reserve system: €196 million allocated to deployable shelter units across six member states, including modular housing, winterised containers and prefabricated camps. Poland is constructing six deployable container towns under the scheme at €35.5 million. Sweden holds the largest reserve — €40.4 million worth, capable of housing 36,000 people.
The critical limitation is purpose. These rescEU reserves are displacement infrastructure — modular units for people evacuated from disasters — not blast-resistant bunkers. They can shelter evacuees but cannot protect civilians in place during an attack. Any EU member state can request them through the EU Civil Protection Mechanism, but no treaty provision compels states to build the underlying permanent infrastructure.
The gap between Poland's 3% and Finland's 80% is a measure of how seriously successive European governments took the idea that war on the continent might return. For three decades, the answer was: not seriously at all. The countries moving fastest are those closest to the threat. The countries furthest away are still largely watching. Unless EU treaty provisions change — which requires unanimous agreement among all member states — Brussels will remain a spectator as member states race, individually and at speed, to work out what it actually costs to protect a civilian population when things go wrong.
