NIS2 applies to energy operators of a type listed in Annex I that are at least medium-sized. The subsectors are electricity, district heating and cooling, oil, gas and hydrogen. Medium-sized means 50 or more staff, or turnover and balance sheet both above €10 million. Large operators are essential, medium-sized ones important, and CER critical entities are essential whatever their size.
This guide covers the scope table by subsector, oil and gas, essential or important status, what NIS2 requires, the electricity network code, the CER Directive, nuclear, operational technology in practice, and a checklist.
| Subsector | Entity types in NIS2 Annex I | Under NIS1? |
|---|---|---|
| Electricity | Electricity undertakings that carry out supply; distribution system operators; transmission system operators; producers; nominated electricity market operators (NEMOs); market participants providing aggregation, demand response or energy storage; operators of recharging points that provide a recharging service to end users | Supply, DSOs and TSOs only |
| District heating and cooling | Operators of district heating or district cooling | No |
| Oil | Operators of oil transmission pipelines; operators of oil production, refining and treatment facilities, storage and transmission; central stockholding entities | Yes, except central stockholding entities |
| Gas | Supply undertakings; distribution and transmission system operators; storage system operators; LNG system operators; natural gas undertakings; operators of natural gas refining and treatment facilities | Yes |
| Hydrogen | Operators of hydrogen production, storage and transmission | No |
Which energy operators are in scope of NIS2?
Two tests decide it: the entity type, then size. Scope attaches to the legal entity, not to a site or an asset.
Type. Most Annex I energy entries point to a definition in EU energy law, and the definitions are wide. A producer is “a natural or legal person who generates electricity” (Directive (EU) 2019/944, Article 2(38)), with no capacity floor. Aggregators, demand response providers and storage operators come in as market participants. District heating and cooling, hydrogen and recharging points are new: NIS1 covered only electricity, oil and gas.
Size. NIS2 applies to entities that are at least medium-sized under Recommendation 2003/361/EC: 50 or more staff, or turnover and balance sheet total both above €10 million. Linked and partner enterprise data is added. Article 2(1) switches off the Recommendation’s public-control rule, so a municipal utility is not large only because a municipality owns it.
Regardless of size. A smaller operator is in scope if it is a CER critical entity (Article 2(3)). It is also in scope if its Member State identifies it, for example as the sole provider of an essential service (Article 2(2)). For a small local network operator, that is the question to put to the authority.
The method is in the NIS2 scope guide, and the NIS2 scope checker gives a first answer from sector, headcount and turnover.
What the January 2026 proposal would change
On 20 January 2026 the Commission proposed targeted NIS2 amendments, COM(2026) 13. They would exclude electricity producers with a total generation capacity of 1 MW or less. They would also redefine the hydrogen entries by reference to Directive (EU) 2024/1788. It is a proposal, not law: today every producer that meets the size test is in scope.
Does NIS2 apply to oil and gas companies?
Yes, to the listed types that are at least medium-sized.
Oil. The entries follow the infrastructure, from pipelines and production to refining, storage and transmission, plus central stockholding entities, which manage emergency and specific oil stocks. Trading on its own is not a listed activity.
Gas. Natural gas undertakings is the broad entry. NIS2 points to the definition in Directive 2009/73/EC, since recast as Directive (EU) 2024/1788: a person carrying out at least one of “production, transmission, distribution, supply, purchase or storage of natural gas, including LNG”, excluding final customers. A gas producer or a wholesale buyer and seller can fall under it.
For an oil and gas group, run the test per legal entity. The pipeline company, the storage company and the trading arm can land in different places.
Is an energy operator essential or important?
| Energy entity | NIS2 status | Directive |
|---|---|---|
| Annex I energy type, large: 250 or more staff, or turnover above €50M and balance sheet above €43M | Essential | Art. 3(1)(a) |
| Annex I energy type, medium-sized | Important | Art. 3(2) |
| Small or micro | Out, unless a size-independent case applies | Art. 2(1) to 2(3) |
| Critical entity under the CER Directive, any size | Essential | Art. 2(3), 3(1)(f) |
| Identified by the Member State | Essential or important, as identified | Art. 2(2)(b) to (e), 3(1)(e) |
| NIS1 operator of essential services identified before 16 January 2023 | Essential, if the Member State so provides | Art. 3(1)(g) |
Both categories carry the same obligations. Supervision is proactive for essential entities (Article 32) and after the fact for important ones (Article 33). Maximum fines, whichever is higher, are at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important ones (Article 34). The detail is in essential vs important entities.
What does NIS2 compliance require of energy operators?
The directive has no energy chapter. Energy operators carry the same core duties as every other entity:
- Management body: approves the Article 21 measures, oversees them, and its members follow training (Article 20).
- Risk management: at least the ten measures in Article 21(2), on an all-hazards approach. See the ten Article 21 measures.
- Incident reporting: early warning within 24 hours, incident notification within 72 hours, final report within one month (Article 23).
- Registration: submit your details to the authority and report changes within two weeks (Article 3(4)).
Implementing Regulation (EU) 2024/2690 covers digital providers, not energy operators. For electricity, sector detail comes from a separate act, below.
In practice, supply chain security weighs heavily in energy: control system vendors, integrators and maintenance contractors often have remote access to operational systems. See NIS2 supply chain security.
National measures had to apply from 18 October 2024. Not every Member State transposed on time, so check that your national law is in force.
How does NIS2 relate to the network code on cybersecurity for electricity?
Commission Delegated Regulation (EU) 2024/1366, the network code on cybersecurity, sets sector-specific rules for the cybersecurity aspects of cross-border electricity flows. It was adopted on 11 March 2024 under the Electricity Regulation, (EU) 2019/943, and entered into force on 13 June 2024.
It does not replace NIS2. Recital 3 says it “complements the provisions of Directive (EU) 2022/2555 regarding the electricity sector, whenever cross-border electricity flows are concerned”. Recital 15 asks the NIS2 authorities and the network code authorities to cooperate, to avoid gaps and duplication.
- Who: only entities that competent authorities identify as high-impact or critical-impact under Article 24. Article 2 lists electricity undertakings, NEMOs, organised market places, balancing responsible parties, recharging point operators, regional coordination centres, ENTSO for Electricity and the EU DSO entity. It also lists critical ICT service providers and managed security service providers.
- What: cybersecurity risk assessments at Union, Member State and regional level (Articles 19 to 21), minimum and advanced cybersecurity controls (Article 29) and supply chain measures (Article 33).
- When: Member States had to designate a competent authority by 13 December 2024 (Article 4(1)). Duties on entities follow a staged cycle of risk assessments and identification, so ask your authority whether you have been identified.
The supplier point matters: a software or managed security provider can be brought in without being an energy company.
How does NIS2 relate to the CER Directive?
The CER Directive, (EU) 2022/2557, covers the resilience of critical entities against all risks, not only cyber. Member States had to identify their critical entities by 17 July 2026 and notify them within one month.
- A CER critical entity is an essential NIS2 entity, whatever its size (NIS2 Articles 2(3) and 3(1)(f)).
- CER does not apply to matters covered by NIS2 (CER Article 1(2)). Its resilience duties are switched off only in banking, financial market infrastructure and digital infrastructure (Article 8), so energy critical entities carry both.
- A critical entity assesses its risks within nine months of notification, then at least every four years (Article 12), and takes resilience measures including physical protection (Article 13).
- It notifies the CER authority of incidents that significantly disrupt, or could disrupt, essential services, initially within 24 hours unless operationally unable (Article 15). One cyberattack on a control centre can trigger this and NIS2 Article 23.
The physical side of NIS2 is in the all-hazards approach. A sensible approach is one record per legal entity showing which regimes apply:
ENERGY ENTITY REGIME MAP (one per legal entity)
Legal entity: [name, registration number]
Annex I entries: [e.g. electricity: DSO; gas: supply undertaking]
Size, latest accounts: staff (AWU) [ ] turnover [ ] balance sheet [ ]
NIS2 status: [out / important / essential], basis [Art. 3]
CER critical entity: [no / yes, notified on (date)]
Network code: [not identified / high-impact / critical-impact]
Authorities: NIS2 [ ] CER [ ] network code [ ]
Incident channels: NIS2 CSIRT or authority [ ] CER authority [ ]
OT sites in scope: [plants, control centres, remote assets]
Risk assessment: [reference, regimes it serves, next review]
Registered with: [authority, date, reference]Does NIS2 apply to nuclear power plants?
Yes. Recital 10 says the directive applies to entities producing electricity from nuclear power plants, but some of those activities may be linked to national security. There, including within the nuclear value chain, a Member State should be able to exercise its national security responsibility. The split is decided nationally: ask your authority.
What NIS2 leaves open in operational technology
Article 21 is technology-neutral. It does not mention control systems. It asks for measures that take account of the state of the art and, where applicable, European and international standards.
The Commission’s 2019 Recommendation on cybersecurity in the energy sector names why OT is hard. Some elements must react to commands within a few milliseconds. Grids and pipelines are interconnected, so a disruption can cascade. Equipment with a lifespan of 30 to 60 years, designed before cybersecurity was a consideration, runs alongside modern systems.
In practice, closing the gap looks like this:
- An asset inventory that includes OT, built with passive discovery where active scanning could disturb controllers.
- Segmentation between IT and OT, and between OT zones. Recital 89 names network segmentation as cyber hygiene. The IEC 62443 series, written for industrial automation and control systems, is the usual reference.
- One controlled path for remote access, for staff and vendors, with MFA and session logging. MFA applies “where appropriate”, and vendor access to a control system is hard to argue out of that.
- Documented compensating controls where you cannot patch, with the risk accepted by a named owner.
- Backups of controller logic and configurations, a tested restore and a rehearsed manual fallback.
- An incident process with operations and safety in it, able to decide within 24 hours whether an OT event is significant.
The evidence sits in firewalls, remote-access gateways, historians and asset tools, not in policies. Collected by hand once a year, it describes last year’s plant. Collected continuously, with a person reviewing the exceptions, it shows what is running now. That is how the CloudSoul platform works: automated, with human-in-the-loop expertise. The sector view is on the energy page, the wider programme on the NIS2 compliance page.
NIS2 energy sector checklist
- Match each legal entity to its Annex I entry and the energy-law definition behind it.
- Calculate size from the latest approved accounts, with linked and partner enterprises.
- Ask whether you have been identified: CER critical entity, network code entity, or national identification.
- Register with your NIS2 authority and report changes within two weeks.
- Run one risk assessment covering IT, OT and physical sites, mapped to every regime that applies.
- Put all vendor remote access to OT behind one controlled, logged path.
- Test incident handling against the 24-hour and 72-hour deadlines, with operations in the room.
- Record management body approval of the measures and its members’ training.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23 and 32 to 34, recitals 10 and 89, Annex I, EUR-Lex.
- Directive (EU) 2016/1148 (NIS1), Annex II, EUR-Lex.
- Commission Delegated Regulation (EU) 2024/1366, network code on cybersecurity for cross-border electricity flows, recitals 3 and 15, Articles 2, 4, 19 to 21, 24, 29 and 33, EUR-Lex.
- Directive (EU) 2022/2557 on the resilience of critical entities (CER), Articles 1, 6, 8, 12, 13 and 15, EUR-Lex.
- Commission Delegated Regulation (EU) 2023/2450, list of essential services under CER, Annex, EUR-Lex.
- Directive (EU) 2019/944, Article 2, and Directive 2009/73/EC, Article 2, EUR-Lex and EUR-Lex; Directive (EU) 2024/1788, recast of Directive 2009/73/EC, EUR-Lex.
- Commission Recommendation (EU) 2019/553 on cybersecurity in the energy sector, EUR-Lex.
- Proposal COM(2026) 13, targeted amendments to Directive (EU) 2022/2555, EUR-Lex.
- European Commission, Critical infrastructure and cybersecurity in energy.
- IEC, Understanding IEC 62443.
Frequently asked questions
Does NIS2 apply to the energy sector?
Yes. Energy is an Annex I sector of high criticality with five subsectors: electricity, district heating and cooling, oil, gas and hydrogen. NIS2 applies to the listed entity types that are at least medium-sized, and to some smaller ones, such as critical entities under the CER Directive.
Does NIS2 apply to oil and gas companies?
Yes, to the listed types that are at least medium-sized: oil pipelines, production, refining and treatment, storage and transmission, central stockholding entities, and in gas supply undertakings, network, storage and LNG operators, refining and treatment facilities and natural gas undertakings. Natural gas undertakings include companies that produce, supply, purchase or store gas, but not final customers.
Is an energy company an essential or important entity under NIS2?
An energy operator above the medium-sized ceilings, meaning 250 or more staff or turnover above €50 million and a balance sheet above €43 million, is essential. A medium-sized one is important. A critical entity under the CER Directive is essential whatever its size.
How does NIS2 relate to the network code on cybersecurity for electricity?
Delegated Regulation (EU) 2024/1366 complements NIS2 for the cybersecurity aspects of cross-border electricity flows. It applies to entities identified as high-impact or critical-impact, including some ICT and managed security service providers. It does not replace NIS2.
Are EV charging point operators covered by NIS2?
Yes. Operators of recharging points that provide a recharging service to end users are listed in the electricity subsector of Annex I. Like other energy entities, they are in scope if they are at least medium-sized, or if a size-independent case applies.
