NIS2 for Energy
Operational technology is the hard part. Article 21(2)(e) reaches ICS and SCADA, where patching windows are measured in years, not days. Most energy entities discover that their OT asset inventory does not exist in a form article 21(2)(i) would accept.
Which entities are covered
Electricity undertakings, DSOs and TSOs, producers, nominated electricity market operators, electricity market participants, operators of recharging points; district heating and cooling operators; oil pipeline and production operators, central stockholding entities; gas supply undertakings, DSOs, TSOs, storage and LNG system operators, refining and treatment facilities; hydrogen producers, storage and transmission operators.
Sub-sectors named in the annex
- Electricity
- District heating and cooling
- Oil
- Gas
- Hydrogen
Scope traps specific to this sector
Trap 1
Recharging point operators are named explicitly — EV charging networks are in scope even when the parent company is not an energy incumbent.
Trap 2
Hydrogen was added by NIS2 and did not exist in NIS1; producers often have no compliance history at all.
Trap 3
Many energy entities are also designated critical under Directive (EU) 2022/2557 (CER), which brings them into scope regardless of size.
What else applies to you
Directive (EU) 2022/2557 (CER) for physical resilience; network codes on cybersecurity for electricity under Regulation (EU) 2019/943.
NIS2 rarely arrives alone. Where another EU act covers the same ground and is at least equivalent in effect, article 4 disapplies the corresponding NIS2 provisions — but only those, and only where that test is met.