The EU Shelter Market: Current State, Threats and Outlook

Executive summary

Europe’s shelter market is moving from neglect to rapid, politically driven expansion. For roughly three decades after the Cold War, most EU states let their civil protection infrastructure decay. Since 2022, and sharply since the drone incursions of 2025–2026, governments, businesses and households have started to reverse that.

The main conclusions of this report:

• Demand is policy-led, not yet market-led. The strongest drivers are national programs (Germany, Poland, the Baltics, Finland) and EU-level strategy, rather than organic private demand. The EU itself has very limited power to mandate or fund permanent shelters, so the market is fragmented into 27 national regimes.
• The dominant design philosophy is shifting from deep Cold War bunkers to dual use, “everyday” shelters: parking garages, tunnels, metro stations, reinforced basements and modular units. This favors retrofit, engineering, ventilation/filtration, power and communications suppliers over pure heavy-concrete builders.
• The threat picture has changed. Cheap drones, missiles, hybrid sabotage and cyber-attacks now matter as much as the traditional nuclear-era threat model. Shelters that protect against blast but not against drones, power loss or cyber failure are no longer adequate.
• AI is the main new risk multiplier. It lowers the cost of reconnaissance, targeting, swarm coordination, cyber intrusion and disinformation, and it turns shelter registries and building control systems into potential targets.
• Biggest uncertainty: no authoritative EU-wide market size figure exists in the sources reviewed for this report. Figures below are national budgets and capacity statistics, not a consolidated market valuation.

A warning from 2 November 2026: a cyberattack on retail chains in Sweden, Belgium, Luxembourg and Ireland raised temperatures in fridges and freezers at dozens of stores and forced them to discard food, repeating a pattern seen in France the month before. It shows that an attack on building control systems can destroy supplies without a single shot, which applies equally to the power, cooling and ventilation of shelters.

1. Current state of the market

1.1 A very uneven starting position

Coverage differs enormously between member states. Finland, which never abandoned civil defense, has shelters for about 4.8 million of its 5.6 million people. Outside the EU, Switzerland has roughly 365,000 private and public shelters with around nine million places, more than its resident population; Swiss owners who cannot build a shelter for technical reasons pay a substitute levy that funds public shelters.

Germany sits at the opposite end. Federal and state governments stopped funding public shelters in 2007, and many facilities were decommissioned. The federal authorities now record 579 public shelters with about 478,000 places, most of them not ready for immediate use. West Germany had around 2,000 public shelters with roughly 1.6 million places at the end of the Cold War.

A March 2026 Euronews analysis found that a continent-wide pattern of decay is visible. After a drone strike near a British base in Cyprus, inspections found many shelters unusable, which reopened the debate on civil protection across the Union.

1.2 What the EU can and cannot do

The EU’s role is mostly strategic and coordinating:

• • The Preparedness Union Strategy (26 March 2025) contains 30 key actions, promotes a “preparedness by design” culture, encourages 72-hour household preparedness and advises improving shelter availability. The Commission aimed to complete the first EU-wide risk and threat assessment by the end of 2026.
  • Under the subsidiarity principle, Brussels cannot force construction, set binding technical specifications for shelters or directly fund bunkers without treaty change. The shelter capacity the EU does fund through rescEU (for example, the Swedish program, due for completion around September 2026) consists of modular units, tents and prefabricated camps for displaced people, not blast-resistant protection.
  • Defense money is larger but is not aimed at shelters. The €150 billion SAFE loan instrument, part of the Readiness 2030 plan to mobilize up to €800 billion, targets air and missile defense, artillery, ammunition, drones and counter-drone systems. First disbursements began in August 2026. Hardened military infrastructure is therefore largely a national-budget matter, although SAFE-funded air defense and counter-drone systems create indirect demand for protected command, storage and basing facilities.

1.3 National programs shaping demand

Germany. On 20 May 2026 the federal cabinet approved a Civil Protection Pact with about €10 billion of federal investment to 2029, part-funded through a special fund exempt from debt rules. It deliberately favors everyday spaces (underground car parks, tunnels, metro stations, basements) over rebuilding Cold War bunkers, and the defense minister acknowledged that dedicated bunker space for the whole population is unrealistic. Municipalities have been asked to identify candidate spaces by the end of 2026. A legislative initiative would add shelters to the zoning options in the building code, and the federal approach currently relies on voluntary, owner-hardened basement shelters rather than a mandate. The former head of the federal civil protection agency had floated a target of about one million places and a longer-term cost of around €30 billion over a decade; critics argue that universal coverage would be far costlier (one academic estimate puts it near €800 billion) and that skills and materials are limiting factors. One official warned that new public shelters take “a generation” to deliver.

Poland. From 2026, newly approved multi-family residential and public buildings must include spaces adaptable as temporary shelters. A civil defense plan for 2025–2026 allocates almost PLN 5 billion (about US$1.4 billion) for modernization, new construction and alert systems. This is the clearest example in the EU of a building-code mandate, which creates a steady stream of demand for developers and installers.

Baltic states and Finland. Following repeated drone incursions, including a 20 May 2026 alert in Lithuania that sent civilians to shelters, the Baltic states have been talking to Ukrainian companies about shelter supply and know-how. At least 24 drone incidents were recorded in the Baltic states between the start of 2025 and May 2026. The European Parliament addressed the incursions in a resolution of 18 June 2026. Reports also describe the Baltics building more than 1,000 bunkers, ammunition depots and supply shelters along the Russian border, and Poland, Finland and the Baltic states withdrew from the anti-personnel mine convention in 2025. Basements and underground spaces in the Baltics are increasingly being marketed as potential shelters.

Ukraine as a reference market. Ukrainian firms that began producing civilian shelters after 2022 and later moved into military fortification now export experience in rapid, modular, drone-aware protection. This is a competitive and partnership opportunity for EU suppliers.

1.4 Demand versus available places in selected countries

Note: “demand” means the population to be covered or a government-set target, not a market calculation. Population figures are the author’s rounded estimates and coverage is approximate. The data comes from different methodologies (shelters, hiding places and temporary shelter sites are not comparable), so the table is suited to judging orders of magnitude, not to ranking.

1.5 Poland: ad hoc shelter places as a low-cost alternative to shelters

Polish law (the shelter act, in force since 1 January 2026, amended on 29 May 2026) distinguishes shelters, hiding places and ad hoc shelter places (known as MDS). In new apartment buildings and underground parking garages a developer only has to design the underground floors so that MDS can be organized there; a full shelter or hiding place is required mainly in public-use buildings, where justified and technically possible. Estimates put the effect on apartment prices at about PLN 300 per square meter.

This is a “mass and cheap” model: large nominal capacity, weaker protection. MDS are not airtight, have no filtered ventilation and do not protect against contamination, and in a crisis the municipality, not the developer, organizes them. For investors this means demand for structural preparation and retrofits, and for the premium shelter market a quality gap relative to the Finnish model.

2. Segment analysis

2.1 Private (households and residential developers)

• • Current position: low penetration outside Finland. Demand is rising where governments push self-protection (Germany, Poland) and where proximity to Russia raises perceived risk.
  • Products: reinforced basement conversions, prefabricated in-ground units, shelter-ready design in new multi-family housing.
  • Constraints: cost, planning permission, absence of incentives (Germany’s old tax treatment of shelter costs exists but has been little used since funding stopped), and low public awareness. Maintenance is the hidden problem: a shelter nobody services will not work when needed.
  • Outlook: growth is likely to be mandate- and incentive-driven. Watch for tax relief, substitute-levy models on the Swiss pattern, and insurance linkage.

2.2 Commercial and critical infrastructure

• • Customers: operators of hospitals, data centers, energy and water utilities, transport hubs, ports, telecoms, large employers and public buildings.
  • Drivers: continuity-of-operations obligations, rising hybrid-threat exposure, insurer scrutiny and procurement rules that favor resilient suppliers. Public parking garages, metro and rail tunnels and large basements are being treated as dual-use assets, which brings property owners into the market.
  • Products: protected control rooms, hardened server and plant rooms, staff-protection spaces, filtered ventilation, redundant power and comms, drone-resistant roofing and perimeter systems.
  • Outlook: the strongest private-sector growth is likely here, because the business case (continuity, liability, insurance) is clearer than for households.

2.3 Military and defense

• • Drivers: Readiness 2030, national rearmament, and the eastern-flank fortification effort (border barriers, bunkers, depots, a planned regional drone wall). Counter-drone and air-defense procurement is accelerating through SAFE and national budgets.
  • Products: hardened shelters for command posts, aircraft and vehicles, ammunition and fuel storage, protected logistics, underground or dispersed basing, camouflage and deception, and protection against precision munitions and drones.
  • Constraints: classification and security clearance, domestic-industry preference in EU-funded procurement, long approval cycles and a limited pool of qualified contractors.
  • Outlook: a sustained multi-year investment cycle, with demand concentrated in Poland, the Baltics, Finland, Romania and Germany.

3. Main threats

The European Parliament’s June 2026 resolution describes Russian-linked destabilization by drone incursions and airspace violations across Romania, the Baltic states and Finland. Separately, in February 2026 the Commission announced a drone action plan and stricter rules because of risks to airports and critical infrastructure.

In October 2026, police said hackers took control of cooling units at hundreds of supermarkets in France, causing fires and food losses. On 2 November 2026 a similar attack hit chains such as ICA and Coop in Sweden, Ahold Delhaize and Colruyt in Belgium and Luxembourg, at least one IKEA store, and 13 SuperValu stores in Ireland. No one has claimed the attacks; Reuters could not establish who is behind them or whether the incidents are linked, and Moscow has repeatedly denied involvement in sabotage. Some of the affected units used controllers from the Danish maker Danfoss, which was also targeted in France. The EU agriculture commissioner called the incidents a deliberate attempt to disrupt the food supply chain. A SentinelOne researcher noted that the absence of financial demands points to sabotage rather than extortion.

4. Key risks for the market

1. Delivery risk. Capacity (skilled labor, materials, engineering) may not match political ambition. Germany’s own officials say that building public shelters takes decades, so retrofit and temporary solutions will dominate near term.
2. Maintenance and lifecycle risk. The Cold War experience shows that shelters decay when funding stops. Without inspection regimes and operating budgets, new investment will repeat the pattern.
3. Policy volatility. Programs depend on threat perception and fiscal space. A ceasefire or a change of government could slow demand abruptly, while a serious incident could accelerate it.
4. Different national standards raise costs for suppliers and make cross-border scaling difficult. There is no EU-wide technical standard for civil shelters.
5. False security. A space labeled a shelter that has not been assessed against drone, fire, ventilation or toxic-gas risks can be dangerous. Liability exposure for owners and suppliers is rising.
6. Public trust and communication. People must know where shelters are, how to reach them and what to do. Alert fatigue after repeated false or stray-drone alarms is a documented concern.
7. Supply chain and sovereignty. Reliance on non-EU components in ventilation, electronics and building-management systems is a security risk in itself.
8. Digital dependency risk. An attack on cooling and building-management controllers shows that supplies (food, medicines, data) can be destroyed without damaging physical infrastructure. For shelters this means stocks and life-support systems need an offline mode and independent safeguards.

5. Where the market is heading

This section is analysis based on the trends above, not a forecast from any single source.

• Dual-use becomes the default. Expect new parking garages, metro extensions, hospitals and public buildings to be specified with shelter functions from the start, supported by building-code changes on the Polish model.
• Modular and rapid-build products grow. Time-to-protection matters more than perfection. Prefabricated units, containerized solutions and quick-harden kits suit a market that needs capacity within a few years.
• Standards and certification emerge. As liability and public funding grow, national certification of shelter quality will follow, and EU-level harmonization may eventually be pursued even if the Union cannot mandate construction.
• Services outgrow construction. Surveying and assessment of existing spaces (Germany’s municipal inventories are the first big wave), inspection, maintenance contracts, signage, alert integration and training will form a recurring-revenue segment.
• Protection of continuity, not just people. Commercial demand will focus on keeping operations running: hardened power, cooling, comms and data.
• Counter-drone integration. Shelters, facilities and campuses will increasingly be sold as part of a layered system with detection and defeat capability.
• Financing innovation. Look for tax incentives, substitute levies, green-bond-style resilience financing, insurance discounts and public-private partnerships.
• Ukrainian and Nordic know-how enters the market. Finnish and Ukrainian experience will shape design and supply chains, through partnerships or competition.

6. How AI creates new threats

AI does not replace conventional threats; it makes them cheaper, faster and harder to defend against. The ENISA Threat Landscape 2026 report, covering 8,257 incidents in 2025, found that attackers mainly used commercial AI models to speed up and scale existing techniques such as phishing and exploit writing, and expects AI to support more direct parts of the attack chain in 2026. The 2025 edition already noted attacks on the AI supply chain as a rising trend. For shelters and protective facilities, the relevant risks are:

1. Reconnaissance and targeting. AI image analysis can find, classify and prioritize facilities from satellite, aerial and social-media imagery at scale. Public shelter registries, mapping apps and signage, which are essential for the public, also give a hostile actor a ready-made target list. Policy makers will have to balance public access to shelter information against operational security, and designers should assume location data will be found.
2. More resilient autonomous weapons. Drones with onboard AI can keep navigating when jammed or when GPS is denied, which weakens one of the main current defenses (electronic warfare). Ukraine’s president warned in March 2026 that AI-enabled drones used against Ukrainian infrastructure are becoming affordable enough for non-state actors in Europe.
3. Swarms and saturation. Coordinated drone swarms can overwhelm point defenses. Roofs, entrances, air intakes and exposed utilities become weak points rather than thick walls.
4. Cyber-attacks on shelter systems. Modern shelters rely on networked ventilation, filtration, doors, lighting, power management and alerting. AI-assisted intrusion, vulnerability discovery and phishing lower the skill barrier to disabling these systems or the utilities that feed them. The risk is highest in retrofitted facilities where building-management systems were never designed for hostile environments.
5. Deception and panic. Synthetic voice, video and text can produce convincing false alerts, fake official instructions or misleading shelter information, causing crowding, evacuation into danger or loss of trust in genuine warnings.
6. Supply chain and insider risk. AI makes it easier to profile and target suppliers, contractors and staff, and to compromise software or firmware used in shelter equipment.
7. Scale of attack on defenders. Machine-speed attacks shorten the window in which human operators can notice and respond.

The November 2026 example. Belgium’s Centre for Cybersecurity acknowledged that those behind the supermarket attacks may never be identified, and said AI can now be used to exploit system weaknesses successfully, especially by sophisticated actors. A SentinelOne researcher noted that from the defender’s side a teenager and an intelligence service look alike, because breaking into an exposed control panel leaves almost no trace. For shelters the lesson is simple: cyber resilience of cooling, ventilation and power controllers is part of the protection, not an add-on.

Attacks on the warning system itself. Section 6 so far treats deception as forged messages. A harder case is the takeover of a genuine warning channel (sirens, mobile alerts, apps, radio and TV interruption), because an alert from an official source is credible and hard to retract. Three scenarios matter: a false alarm that triggers panic, crowding at shelter entrances, road accidents and loss of trust in later warnings; suppression or delay of a real alarm shortly before a physical attack; and a false alarm timed to move people into a place where they can be harmed or to overload emergency services. AI lowers the cost of finding vulnerabilities, writing convincing alert text in many languages and timing messages. This report did not check whether any such intrusion into a European warning system has already occurred, so no example is given.

Defensive opportunities. AI also helps defenders: automated assessment of candidate shelter sites, digital twins for maintenance, anomaly detection in building systems, drone detection and classification, and better alert targeting. Suppliers that can show secure-by-design control systems, offline fallback modes and manual override will have a clear advantage.

7. Implications and recommendations

For private owners and developers: treat shelter-readiness as a design requirement, specify filtered ventilation and independent power, and plan for maintenance from day one.

For commercial and critical-infrastructure operators: protect continuity of operations, segment and harden building control systems, and test manual fallback procedures.

Lessons from the supermarket attacks: inventory remotely controlled devices (cooling, building management, access control), close public access to control panels, keep up with supplier patches, and have temperature alarms that do not depend on the network.

For defense and security planners: design for layered protection against drones and precision strikes, assume AI-assisted reconnaissance, and use dispersion, concealment and deception alongside hardness.

For policy makers: invest in inventories and inspection regimes, publish clear technical standards, ring-fence maintenance funding, and decide deliberately which shelter information is public.

For authorities responsible for warning systems: authenticate alert messages, keep several independent channels (sirens, phone alerts, radio, local loudspeakers), have a tested procedure to retract a false alarm quickly, separate alert systems from general administrative networks, and run public exercises so people know what a genuine alert looks like.

For suppliers: build modular, retrofit-friendly products, offer lifecycle services, make cyber resilience a core feature, and prepare for certification.

 

8. Limits of this report

• No consolidated EU market size or growth rate was found; the numbers quoted are program budgets and capacity counts from national and press sources and should not be added together.
• Several figures come from news reports of government statements and may change as programs are finalized.
• Sections 1.5, 5 and 6 contain the author’s analysis rather than established facts.
• Military capabilities and specific protection levels are intentionally discussed at a general level.

 

9. Further research and development

This report does not cover the topics below, which are worth adding in the next version.

Market model and suppliers

• A market-size model (demand × cost per place × delivery speed) for each main country, with assumptions marked.
• A map of manufacturers, contractors and suppliers of key components (air filters, airtight doors and closures, ventilation), with prices and supply-chain bottlenecks.
• Competition for materials and contractors with military demand.

Shelter design and operation

• Energy, water, sanitation and supplies: how long a shelter really operates without grid power, especially after an attack on the energy system.
• The difference between sheltering in place and evacuation, including cross-border evacuation.
• Older people, people with disabilities, the sick, children and pets, plus real capacity and the ability to arrive in time.
• Nuclear and radiological threats, including power plants and waste storage, and climate hazards as an additional demand driver.

Law, finance and information

• Insurance (war exclusions), liability of owners of parking garages and garages used as shelters, and the status of dual-use facilities if they also serve the military.
• Information security: the trade-off between public shelter maps and the risk of targeting.
• Security of public warning systems: documented intrusions in Europe, how well alerts are authenticated, and how fast a false alarm can be retracted.

Verification

• Basing the analysis of Polish law on the text of the act and its regulations rather than on commentary, and checking conclusions against the audit office report and German planning documents.
• Replacing population estimates with official data and harmonizing coverage methodology across countries.
• Interviews with practitioners: shelter designers, developers, municipal officials and insurers.
• Checking whether independent security analysts support the link between the supermarket refrigeration attacks and shelters (sections 3 and 6).

Sources

• European Commission, Preparedness Union Strategy (26 March 2025), and coverage via the Finnish government and PreventionWeb
• Euronews, “Europe’s civil shelters are crumbling. Brussels can’t do much about it” (12 March 2026)
• Reuters via regional outlets and Defence24, German Civil Protection Pact (20 May 2026)
• ZDF, BBK/BImA figures on German public shelters; Xpert.Digital on shelter law and Swiss comparison (August 2026)
• GGI, Poland’s shelter investment and building requirements
• European Parliament resolution P10_TA(2026)0231 (18 June 2026)
• Novaya Gazeta Europe, drone incidents in the Baltic states (21 May 2026); Euromaidan Press and Politico reporting on Baltic–Ukrainian shelter cooperation (May 2026)
• European Commission DG DEFIS, SAFE instrument and first payments (August 2026)
• ENISA Threat Landscape 2025 and 2026 (as reported by WAM and Dutch IT Channel)
• OECD AI Incidents Monitor entries on EU drone action plan (February 2026) and AI-enabled drone warnings (March 2026)
• Radio Łódź, Interia and Bankier on the firefighters’ inventory and the audit office findings on Polish shelters; TVP.info on Lithuania; Infor.pl, Rzeczpospolita and Eurobuild CEE on the Polish shelter act and ad hoc shelter places (2025–2026)
• Reuters, cyberattacks on supermarket refrigeration in Sweden, Belgium and Ireland (2 November 2026), via Internazionale