NIS2 for Energy
Electricity entities can carry two cybersecurity texts at once: NIS2, and Delegated Regulation (EU) 2024/1366, the network code on cybersecurity aspects of cross-border electricity flows, which complements NIS2 for the electricity sector and binds only the entities identified as high-impact or critical-impact under its article 24 (art. 2(1)).
Which entities are covered
Electricity: electricity undertakings which carry out the function of ‘supply’, distribution system operators, transmission system operators and producers, as defined in Directive (EU) 2019/944; nominated electricity market operators, and market participants providing aggregation, demand response or energy storage services, as defined in Regulation (EU) 2019/943; operators of a recharging point that are responsible for the management and operation of a recharging point, which provides a recharging service to end users, including in the name and on behalf of a mobility service provider. District heating and cooling: operators of district heating or district cooling (Directive (EU) 2018/2001). Oil: operators of oil transmission pipelines; operators of oil production, refining and treatment facilities, storage and transmission; central stockholding entities (Council Directive 2009/119/EC). Gas: supply undertakings, distribution system operators, transmission system operators, storage system operators, LNG system operators and natural gas undertakings, as defined in Directive 2009/73/EC; operators of natural gas refining and treatment facilities. Hydrogen: operators of hydrogen production, storage and transmission.
Sub-sectors named in the annex
- Electricity
- District heating and cooling
- Oil
- Gas
- Hydrogen
Essential or important
A large entity of this sector — one exceeding the ceilings for medium-sized enterprises of Recommendation 2003/361/EC — is essential (art. 3(1)(a)); a medium-sized one is important (art. 3(2)). A small or micro entity is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Not every electricity undertaking is listed: the annex names those which carry out the function of ‘supply’ (Directive (EU) 2019/944, art. 2(12)), and market participants only where they provide aggregation, demand response or energy storage services.
Trap 2
Recharging point operators are listed where they are responsible for the management and operation of a recharging point that provides a recharging service to end users, including when they act in the name and on behalf of a mobility service provider.
Trap 3
An energy entity identified as a critical entity under Directive (EU) 2022/2557 (CER) is covered whatever its size and is an essential entity (art. 2(3), 3(1)(f)).
Trap 4
Electricity production from nuclear power plants is within scope; where some of those activities are linked to national security, the member state may exercise its responsibility for safeguarding it (recital 10, art. 2(6)).
What else applies to you
Delegated Regulation (EU) 2024/1366 (network code on cybersecurity aspects of cross-border electricity flows), for entities identified as high-impact or critical-impact; Directive (EU) 2022/2557 (CER), for critical entities.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.