Disaster Risk Management and Continuity of the State and Vital Services Law

For the purposes of this Law, the following terms have the meanings set out below: Council: the National Council for Disaster Risk Management and State Continuity. Centre: the National Centre for Disaster and Crisis Management, reorganised under this Law. Disaster: serious disruption to society or state institutions arising from a natural, human-induced, technological, biological or compound hazard, whose effects exceed the affected local authority’s ability to cope using its ordinary resources. Disaster risk: the possibility of human, material, economic or environmental losses or service disruption resulting from the interaction of a hazard with exposure, vulnerability and coping capacity. Disaster risk reduction: policies and measures aimed at preventing new risks, reducing existing risks, managing residual risks and strengthening resilience.

The term state continuity means the ability of public authorities and institutions to maintain their essential constitutional and legal functions during disruption and restore them to an acceptable level within specified periods. A vital service means any service, facility or system whose disruption seriously threatens life, health, security, public order, the economy, the environment or the state’s capacity to function. These include, at a minimum, electricity, water, sanitation, telecommunications, government digital services, health, emergency services, transport, fuel, payments, financial systems and essential supply chains, as specified by regulation.

This Law applies to all hazards regardless of their source, including floods, flash floods, drought, dust storms, fires, earthquakes, heatwaves, pollution, industrial, chemical, biological and radiological incidents, collapses, epidemics, widespread service outages, technological incidents and compound and cascading risks.

Covered entities shall adhere to prevention and anticipation, evidence-based decisions, proportionality, unified coordination, service continuity, transparency, accountability, non-discrimination, access to information, protection of groups most exposed to risk, building back better and avoiding transfer of risk between sectors or areas.

A disaster or activation of this Law does not in itself constitute declaration of a constitutional state of emergency or create exceptional powers to restrict rights and freedoms or suspend laws. Declarations of war or emergency and exceptional powers remain subject to the Constitution and the special legislation governing them.

Civil Defence Law No. (44) of 2013 remains in force for safety, prevention, firefighting, rescue, evacuation and civil defence activities. The General Directorate of Civil Defence remains the principal field-response agency within its remit. This Law complements those provisions in national risk governance, continuity, early warning, financing, recovery and intersectoral coordination.

This Law applies without prejudice to legislation governing public health, the environment, water, energy, transport, telecommunications, cybersecurity, data, banking, insurance, construction and urban planning, in a manner achieving the highest level of protection. Where preparedness or continuity requirements conflict, the more protective standard applies unless a special law expressly provides otherwise.

This Law applies to authorities, institutions, ministries, entities not affiliated with a ministry, governorates not incorporated into a region, public bodies, public companies and vital-service operators. It also applies to private entities and contractors insofar as their obligations concern prevention, response, continuity or recovery. Implementation shall respect the constitutional allocation of responsibilities among the federal government, regions and governorates.

A council called the National Council for Disaster Risk Management and State Continuity shall be established, chaired by the Prime Minister or their delegate and comprising the ministers and heads of relevant entities specified by regulation. Its membership shall include the authorities responsible for interior affairs, defence, health, the environment, water resources, electricity, transport, telecommunications, planning, finance, construction, housing, municipalities, government communications, national security, data management and digital services.

The Council shall approve national disaster risk management policy, the national strategy and implementation plan, the national risk assessment, designation of vital services and protection levels; review preparedness and continuity; coordinate response to national disasters; approve the recovery and reconstruction framework; and submit an annual report to the Council of Representatives.

The Council and Centre shall perform their tasks using existing structures and capabilities wherever possible. No executive or field structure parallel to the Civil Defence Directorate or sectoral ministries may be created unless a demonstrated jurisdictional gap cannot be addressed through coordination or reassignment of tasks.

The existing National Centre for Disaster and Crisis Management shall be reorganised as the Council’s executive and technical secretariat and the national common operational picture centre. The Council of Ministers shall determine its administrative affiliation and structure by decision, preventing duplication of command and ensuring its ability to coordinate all ministries, entities, regions and governorates.

The Centre shall operate a national operations room around the clock, consolidate risk and incident information, manage the national risk register, coordinate multisectoral response plans, support public warning, monitor continuity plans, prepare national exercises, manage the information-exchange platform and document lessons learned.

The Council shall establish a participatory national platform comprising representatives of government institutions, regions, governorates, universities, research centres, professional associations, the private sector, civil society organisations and the Red Crescent, as well as representatives of women, young people and persons with disabilities and experts. It shall provide consultation and review without exercising executive powers.

Every ministry, entity not affiliated with a ministry and vital-service operator shall appoint a risk-management and continuity focal point at an appropriate administrative level, responsible for updating the entity’s risk register and continuity plan and coordinating with the Centre.

Each governorate not incorporated into a region shall establish a local disaster risk management council chaired by the governor. It shall connect to the national coordination system and adopt a local risk plan, response plan and local-service continuity plan, without prejudice to the responsibilities of civil defence departments or other competent agencies.

The federal government shall coordinate with regional authorities through written arrangements for exchanging warnings, data and assistance, aligning alert levels and ensuring interoperability between operations centres, while respecting the constitutional powers of each level of government.

The Council shall establish a multidisciplinary scientific advisory committee of experts in earth sciences, climate, water, engineering, public health, the environment, economics, data, communications and continuity management. It shall review methodologies, assessments and models without replacing government responsibility for decisions.

On the Council’s proposal, the Council of Ministers shall approve a national disaster risk reduction strategy lasting no more than five years, aligned with development plans, climate adaptation and sectoral policies. It shall include measurable targets, responsibilities, timetables, funding sources and monitoring mechanisms.

In cooperation with competent authorities, the Centre shall prepare a national multi-risk assessment at least every three years and update it whenever risk patterns change substantially. It shall cover hazards, exposure, vulnerability, capacities, service interdependencies and compound and cascading scenarios.

A national risk register shall record risk classifications and levels, risk-owning entities, preventive measures, warning indicators and interdependencies. A public version shall be published after removing information whose disclosure would threaten security, safety or critical infrastructure.

Updatable national and local digital risk maps shall be prepared and linked to population, facility, vital-service, infrastructure and environmental data. They shall inform urban planning, project licensing, public investment, evacuation plans and shelter locations.

A unified database shall record disaster-related human, material, economic and environmental losses, service disruption and displacement, using a methodology comparable across time and geography and protecting personal and sensitive data.

Major public plans, strategies and projects shall not be approved before identifying relevant risks, how to reduce them and how to maintain public benefit during disruption. The Council of Ministers shall specify the thresholds for covered projects and assessment procedures proportionate to the risk.

Feasibility studies for vital public projects shall analyse climatic, natural and technological risks, life-cycle costs, protection options and operational alternatives. Lower construction costs shall not justify accepting unreasonable disruption or loss risks.

Competent authorities shall integrate risk maps and resilience standards into urban planning, land use, building codes and major-facility licensing. New vital facilities shall not be built in high-risk areas where a reasonable alternative exists; otherwise, specific, engineering-validated protective measures shall be required.

Owners of existing vital facilities in highly exposed areas shall prepare phased plans for protection, reinforcement, operational redundancy or partial or complete relocation, based on cost and risk analysis.

Governorates and local administrative units shall prepare risk assessments methodologically consistent with the national assessment, review them at least every two years and link them to local development plans, budgets and response.

The state shall support research and development, risk modelling and non-sensitive open data, and provide universities and researchers with regulated access to data needed for knowledge development, forecasting and prevention, in accordance with privacy and security laws.

A national multi-hazard early warning system shall link risk knowledge to monitoring, forecasting, warning issuance and dissemination, and community response. It shall operate around the clock through multiple channels with national coverage.

The regulation shall designate scientific and technical authorities empowered to issue each type of warning. No operational body may alter the technical warning’s content except to specify required actions or the scope of implementation.

The Council of Ministers shall adopt a unified national system of alert levels, colours and terminology, with meanings and actions for each level consistent across sectors and governorates and understandable to the public.

Where possible, warnings shall specify the expected hazard, area, timing, severity, potential impacts, most exposed groups, required action and next update time. They shall use clear, actionable language rather than abstract technical terminology.

Mobile messages, cell broadcast, government applications, digital platforms, radio, television, sirens, loudspeakers, local communications and any available means shall be used to ensure reach. The system must not depend on a single channel or internet connectivity alone.

Telecommunications providers shall transmit approved public warnings without charge to recipients, according to the technical specifications and priority established by law and the competent regulator, and shall periodically test warning-channel readiness.

Warnings shall be provided in formats accommodating persons with disabilities; in Arabic and Kurdish wherever required by the Constitution and applicable laws; and in additional formats or languages where locally needed or in areas receiving visitors and foreign workers.

Disaster-related misinformation shall be addressed through rapid publication of official information, evidence and corrections. This Law must not be used to criminalise criticism or restrict press freedom or opinion beyond limits established by a constitutionally compliant law.

Periodic national and local warning-channel tests shall be conducted, with public notification whenever a test might cause confusion. Message reach, dissemination time, comprehensibility and response shall be measured.

The warning system shall include alternative power and communications, backup centres and manual operating procedures for digital-system failures, and shall undergo realistic outage tests.

Competent authorities shall prepare scalable, operational response plans covering command, communications, resources, evacuation, shelter, rescue, health, security, logistics, service continuity, public information and initial recovery.

Incidents shall be classified at local, governorate and national levels according to their impact, required resources and expected disruption. Regulations shall establish escalation and de-escalation criteria to prevent delays in requesting support or unnecessary centralisation.

Unified command and joint inter-agency coordination shall apply. An incident commander shall be designated according to the incident’s nature and statutory responsibilities, while each entity retains its technical and administrative chain of command.

Participating entities shall provide the Centre with information needed for a common operational picture covering the situation, resources, needs, routes, disrupted facilities, warnings and key decisions, subject to information-classification and security levels.

Ministries, governorates and vital-service operators shall establish advance mutual-assistance agreements specifying resources available for mobilisation, request procedures, costs, responsibilities, insurance and command chains.

Armed forces support for civilian authorities during disasters may be requested under the Constitution and applicable laws, specifying the mission, duration, command arrangements and responsibility. Military support shall not displace civilian disaster management in civilian matters.

Evacuation plans shall be prepared in advance for risk-prone areas and vital facilities, specifying alternative routes, transport for people unable to move independently, safe assembly points and voluntary registration protecting personal data. Compulsory evacuation requires a lawful decision that is necessary and proportionate to protect life.

Shelter sites shall meet safety, water, sanitation, health, protection, privacy and accessibility standards. Specific protection arrangements shall be made for children, women, older persons and persons with disabilities, and exploitation, trafficking and violence shall be prevented.

The Ministry of Health shall coordinate health emergency plans, triage, referrals, laboratories, medical stocks, blood safety, epidemic response and hospitals’ ability to maintain services, linking these to the national warning and response system.

Entities shall determine minimum stocks of critical materials, their locations, rotation cycles and tracking and distribution arrangements, diversifying suppliers and avoiding a single point of failure for essential supplies.

Advance agreements may be concluded with the private sector to provide transport, heavy equipment, communications, temporary power, warehouses, engineering services and essential materials during disasters. Prices and procurement shall be subject to transparency, subsequent oversight and conflict-of-interest rules.

In cooperation with civil defence, the Red Crescent and competent authorities, the Centre shall maintain a register of volunteers and community teams and specify training, accreditation, insurance, safety and command arrangements. Volunteers shall not be assigned tasks requiring licences or technical competence they do not possess.

A national multisectoral drill shall take place at least once a year, with sectoral and local exercises according to risk levels. Every exercise or incident shall be followed by a lessons-learned report and corrective plan with defined responsibilities and deadlines.

A spokesperson or joint communications team shall provide regular updates on risks, actions, services, routes and assistance. Professional safety messages must be separated from political or partisan publicity.

The Council of Ministers shall maintain a register of essential government functions that must remain uninterrupted or be restored within maximum time limits. These shall include, at a minimum, constitutional leadership, security and safety, the judiciary and essential justice services, public finance and government payments, health, government communications, civil registration, identity and critical digital services.

The Council of Ministers shall maintain an updated schedule of vital sectors and services and inclusion criteria based on disruption impacts on life, health, security, the economy, population numbers, available alternatives and interdependencies with other services.

Every public entity and vital-service operator shall conduct a documented business impact analysis identifying critical processes, dependencies, resources, personnel, systems, suppliers, maximum acceptable downtime and recovery priorities.

Continuity plans shall specify a target service-recovery time and minimum acceptable performance for each vital service. Digital systems shall also have an acceptable data-recovery point consistent with the service’s nature and security and privacy requirements.

Continuity plans shall cover alternative command arrangements and sites, manual or offline operations where necessary, substitute personnel, backup communications and power, backups, supply chains and mechanisms prioritising the beneficiaries most at risk.

Federal and local authorities shall designate and equip alternative premises for essential government functions, periodically test relocation to them and ensure the ability to issue decisions, preserve records, sign documents and communicate securely when original premises are disrupted.

Public entities and vital-service operators shall retain protected backups of critical data and systems, separated logically or geographically according to risk. They shall periodically test actual restoration rather than merely establish that a backup exists.

Entities shall identify their services’ dependencies on electricity, telecommunications, fuel, water, transport, digital systems and external suppliers, and establish alternatives where one dependency creates a national or local single point of failure.

Competent authorities shall prioritise restoration of telecommunications networks, data centres and government digital services during disasters and ensure alternative channels for responders and the public, with regard to telecommunications law and related legislation.

Authorities and operators shall prepare plans to restore electricity, water, sanitation and fuel supplies according to public-safety priorities, hospitals, telecommunications, water plants, shelters and other vital services, publishing realistic restoration estimates wherever possible.

Health institutions shall identify services that must not stop, reserve emergency capacity, plans to redistribute patients, staff and stocks, and alternatives for interruptions to electricity, water, communications or medicine supplies.

The Central Bank and financial authorities shall coordinate continuity plans for payment, settlement, cash and critical banking services and establish emergency operational alternatives protecting financial stability and citizens’ access to their money and essential services.

Competent authorities shall identify goods and services whose prolonged interruption would cause widespread harm and establish monitoring, stockholding, alternatives, transport, distribution and anti-monopoly and anti-exploitation arrangements during disasters under competition and consumer-protection laws.

Vital-service continuity plans shall be tested at least once a year or following a substantial change in infrastructure or risks. Some tests must include an actual outage scenario or simulated transition to alternative systems.

Entities and vital-service operators shall submit annual preparedness reports to the competent regulator and the Centre using a unified template, identifying critical gaps and remediation plans. Aggregated indicators may be published without revealing sensitive security information.

Everyone has the right to timely official information needed to protect their life, health and property, including warnings, evacuation routes, shelters, pollution risks and service conditions, subject to narrow statutory exceptions protecting security and safety.

Protection, relief, evacuation, shelter and information shall be provided without discrimination. Priority shall reflect the severity of need and risk, not affiliation, influence, place of residence or any other unlawful basis.

Plans shall include specific measures for children, older persons, persons with disabilities, patients, pregnant women, displaced people, poor households, remote communities and people dependent on medical devices or continuous services.

Only data necessary for a specified lawful purpose shall be collected during disasters, with retention periods, access and sharing defined. Affected persons’ names, locations or health conditions may not be published without a legal basis or valid consent and only to the extent necessary.

Where digital systems prioritise cases, allocate assistance or assess damage, their fundamental criteria must be explainable, decisions subject to human review and incorrect data correctable. People without digital access must not be excluded.

Private assets or real estate may be used for response purposes only with legal authority and demonstrated necessity, documentation of the period of use and property condition, and fair compensation for damage or lost benefit, with a right to challenge before the courts.

A binding evacuation order shall specify its scope and duration, state its reasons, be proportionate to the risk and undergo periodic reassessment. It must not be used to change ownership or population composition or prevent return after the danger passes, except under law and, where applicable, a court judgment.

Competent authorities shall facilitate licensed humanitarian organisations’ work and exchange of information and resources under coordination, safety and accountability rules. Humanitarian assistance must not be obstructed for partisan or political reasons.

Accessible mechanisms shall receive affected persons’ complaints and reports of aid misuse, discrimination, corruption or gross negligence, protecting reporting persons under the law and referring violations to competent authorities.

Recovery planning shall begin alongside response rather than await the incident’s complete end. The Council shall designate a clear transition point from response command to recovery management while maintaining necessary services.

A unified methodology shall be used for rapid and then detailed damage, loss and needs assessments, distinguishing physical damage, economic losses, service disruption and social and environmental effects and preventing double counting of compensation.

Destroyed facilities and infrastructure shall not be restored to their previous vulnerability where improving resilience is feasible. Recovery projects shall comply with building codes, site requirements and protection against the hazard that caused the damage and reasonably foreseeable future risks.

Recovery shall prioritise restoring functions and services to residents. Safe temporary solutions may be used before permanent construction is completed, but must not become permanent, substandard substitutes.

The government shall establish published, uniform criteria for assessing damage to housing and property and determining assistance, considering ownership, lawful occupancy and difficulties proving documentation because of the disaster, with an independent grievance mechanism.

Recovery plans shall restore livelihoods, markets, schools, health services, transport and utilities and define temporary measures for people who lost their income because of the disaster, under social-protection and labour laws.

Lists of reconstruction projects, budgets, stages, implementing entities and contracts shall be published. Exceptional procurement shall be time-limited and subject to independent subsequent audit. A disaster must not be used to bypass integrity rules without documented necessity.

Within ninety days of the end of a national disaster’s acute phase, the Centre shall issue a public report on performance, losses, gaps, lessons learned and the corrective plan, protecting information whose disclosure would harm security, investigations or privacy.

The state shall provide advance financing for prevention, preparedness and continuity, rather than limiting expenditure to the aftermath of disasters. Entities shall include risk-reduction needs in their ordinary budgets and investment plans.

The federal budget shall include an emergency and disaster reserve whose size is determined annually according to risk assessment and the state’s fiscal capacity. It may be spent only under published rules defining permitted uses, delegated limits, documentation and audit.

A special account within the unified treasury accounts may be established to finance urgent disaster expenditure, receiving designated appropriations, legally accepted grants and insurance payments. It must not be used outside the purposes specified by law.

In cooperation with the Council, the Ministry of Finance shall prepare a disaster risk financing strategy combining reserves, emergency appropriations, insurance, risk-transfer instruments, advance financing and emergency borrowing where necessary, with regard to public debt and fiscal sustainability.

Procurement procedures may be simplified where urgent necessity threatens life or continuity of a vital service. The decision shall specify the exception’s reason, duration and scope; principal contracts shall be published within a reasonable period and undergo subsequent audit.

International grants and assistance shall be accepted under the Constitution and applicable laws and subject to registration, transparency and national coordination. Ownership of assets or equipment after response ends shall be clearly established.

Public entities shall assess the feasibility of insurance, insurance pooling or other risk-transfer instruments for vital assets and services that can be economically covered. Insurance is not a substitute for prevention and maintenance.

Funds allocated to disasters, response and recovery shall be subject to the Federal Board of Supreme Audit, Federal Commission of Integrity and parliamentary oversight within their respective mandates. An auditable record of expenditure and exceptional decisions shall be maintained.

The Council of Ministers shall issue regulations establishing minimum national standards for risk assessment, warning, continuity, operations centres, shelter, stocks and exercises. Sectoral standards may be more stringent according to the hazard’s nature.

The Centre shall establish a periodic preparedness audit programme for public entities and vital-service operators, implemented with the competent regulator without duplicate inspections or conflicting powers.

Where an audit reveals a substantial gap, the entity shall implement a corrective plan specifying action, responsibility and deadline. In cases of serious danger, the Council may request immediate measures to protect life or prevent widespread service disruption, within the law.

Gross negligence or unjustified refusal to perform a statutory preparedness or continuity duty constitutes a disciplinary violation by a public employee. Private operators are subject to measures and penalties under sectoral law or their licences. Criminal penalties require an express statutory provision.

The Council shall submit an annual report to the Council of Representatives covering national risks, strategy implementation, vital-service preparedness, reserve use, major exercise results and legislative recommendations. A public version shall be published.

Indicators shall include coverage of assessments, continuity plans and warnings; implementation rates for corrective actions; warning issuance times; vital-service restoration times; and continuity-test success rates, without turning indicators into formal targets disconnected from actual risk reduction.

The national strategy, public risk register, non-sensitive risk maps, aggregated preparedness reports, recovery results and public disaster expenditure shall be published under the Right of Access to Information Law upon its entry into force, or applicable rules.

Information whose publication reveals security details of vulnerabilities, vital facilities, protection plans or alternative sites shall be classified. Withholding shall be limited in scope and duration to what is necessary. Classification must not conceal administrative failure, spending or public harm.

Incidents shall be managed at the nearest level of government capable of handling them, escalating coordination and support when needs exceed local capacity. Federal support does not withdraw local jurisdiction except under a constitutional or statutory provision.

Support-request forms, terminology, alert levels, maps, communications channels and resource directories shall be harmonised as needed among federal authorities, governorates and regions, ensuring joint operations during incidents crossing administrative boundaries.

The Ministry of Foreign Affairs and competent authorities shall coordinate warnings, information and assistance with neighbouring states and international organisations for cross-border hazards, including water-related hazards, dust storms, epidemics, pollution, fires and radiological incidents, under agreements and the law.

The Council of Ministers shall establish advance procedures facilitating entry of international rescue teams, equipment and assistance when officially requested, including customs, visas, temporary recognition of qualifications, communications, transport and liability, without prejudice to security and sovereignty.

Iraq may provide teams or relief assistance to an affected state by decision of the competent authority, after verifying that national preparedness will not be impaired and specifying command, insurance and costs.

Within six months of this Law’s entry into force, the Council of Ministers shall issue a transitional plan identifying existing structures that will perform Council and Centre functions and transferring databases and coordination responsibilities without disrupting civil defence or existing operations rooms.

Within ninety days, the General Secretariat of the Council of Ministers shall list permanent committees, centres and cells with overlapping disaster, crisis and continuity responsibilities and propose merging or abolishing unnecessary bodies to prevent duplicate decisions and expenditure.

Public entities shall have twelve months to prepare or update risk registers, continuity plans and response plans under this Law. An extension of six months may be granted, with stated reasons, where substantial technical infrastructure or procurement is required.

Private entities designated as vital-service operators shall have no more than eighteen months to comply with business impact analysis, continuity planning and testing requirements, unless sectoral law prescribes a shorter period.

National disaster risk reduction and climate adaptation plans and strategies approved when this Law enters into force shall continue until reviewed and aligned with it. Enactment shall not suspend ongoing programmes consistent with its objectives.

When preparing regulations and instructions, the Council of Ministers shall implement this Law in coordination with the first amendment bill to Civil Defence Law No. (44) of 2013 or any subsequent amendment in force, avoiding duplicated provisions and preserving civil defence responsibilities for prevention, firefighting, rescue and safety.

The Council of Ministers shall issue implementing regulations within one year of publication. Ministries and competent entities may issue technical instructions within their remit after coordinating with the Centre, but must not create financial obligations or restrictions on rights without legal authority.

Any provision conflicting with this Law is repealed to the extent of the conflict. Civil Defence Law No. (44) of 2013 and sectoral legislation remain in force as provided by this Law.

Three years after commencement, the government shall review the Law’s effects on risk reduction, service continuity, overlapping responsibilities and costs, submitting its findings to the Council of Representatives with proposed amendments if necessary.

This Law shall enter into force ninety days after publication in the Official Gazette, except for obligations subject to specific transitional periods under this Law.