What is the NIS2 Directive?
The NIS2 Directive (Directive (EU) 2022/2555) is an EU cybersecurity law that strengthens security requirements for organizations in critical sectors, including energy. It requires covered organizations, including qualifying EV charging operators, to manage cybersecurity risks, secure their supply chains and report significant incidents.
Under Article 41 of the directive, Member States had to transpose it into national law by 17 October 2024, although many missed that deadline.
Does NIS2 apply to EV charging operators?
Annex I of NIS2, its list of sectors of high criticality, includes operators responsible for the management and operation of recharging points (the EU legal term for charge points) that provide a charging service to end users. The wording matches the definition of a charge point operator in AFIR, the Alternative Fuels Infrastructure Regulation, explained in AMPECO’s AFIR compliance guide for CPOs.
As a general rule, NIS2 covers operators that qualify as medium-sized or large enterprises under EU rules. This typically means having at least 50 employees or exceeding the relevant financial thresholds. Company size may also depend on the structure of the wider business group, so operators should check the applicable national rules.
Within scope, NIS2 uses two categories:
- Essential entities: large charge point operators (CPOs). Authorities supervise them proactively and can audit them without a suspected breach.
- Important entities: medium-sized operators, supervised after the fact when there is evidence of non-compliance.
A Member State can also bring a smaller organization into scope by designating it, for example when it is the sole provider in that country of a service essential to critical societal or economic activities.
An e-Mobility Service Provider (eMSP) that only sells access to other operators’ charge points is not covered as a charge point operator. It comes into scope on that basis only if it also operates charge points, although it could fall under another NIS2 category.
Because NIS2 is a directive, each Member State applies it through its own national law, which sets the details, including where and how an operator registers.
What does NIS2 require?
- Management accountability: The management body (the board or executive leadership) must approve and oversee the cybersecurity measures and take part in training. Its members can be held liable for infringements.
- Risk-management measures: Article 21 sets ten minimum areas, including incident handling, business continuity and backups, encryption, access control and multi-factor authentication. The CPO’s guide to the NIS2 Directive walks through all ten.
- Incident reporting: A significant incident is one that causes, or could cause, severe operational disruption, financial loss or considerable damage to others. It triggers three deadlines: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month of that notification.
- Supply chain security: Operators must assess the security of their direct suppliers, including charger manufacturers and the charge point management system (CPMS) they run on.
NIS2 requires Member States to set maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, whichever is higher. For important entities, the figures are EUR 7 million or 1.4%. Actual penalties depend on the infringement and national law.
What do operators and software providers each do under NIS2?
NIS2 places its obligations on qualifying EV charging operators, and they stay with the operator: registering with the competent authority, running its own risk analysis, setting cybersecurity policies, training management, commissioning chargers securely, handling incidents and meeting the reporting deadlines. Software providers support these efforts by building in security controls, maintaining secure systems and providing documentation, such as certifications, audit reports and security policies. Operators can use this information in their supplier risk assessments, but using a secure software platform does not automatically make them NIS2-compliant.
NIS2 vs. the Cyber Resilience Act
| Aspect | NIS2 Directive | Cyber Resilience Act (CRA) |
|---|---|---|
| What it covers | How an organization secures its networks and systems | How products with digital elements, chargers included, are built |
| Who must comply | Qualifying EV charging operators and other covered entities | Manufacturers, importers and distributors |
| Core duties | Governance, risk management, incident reporting | Security by design, vulnerability handling |
| Timing | National transposition deadline 17 October 2024 | Reporting from 11 September 2026; full application 11 December 2027 |
The two laws address different aspects of cybersecurity. NIS2 focuses on how organizations manage cybersecurity risks, including those associated with suppliers. The Cyber Resilience Act, Regulation (EU) 2024/2847, sets cybersecurity requirements for connected hardware and software products. Standalone cloud-based services generally fall outside the CRA, although certain remote services that are integral to a product’s functionality may be covered.
How AMPECO supports NIS2 supply chain assessments
AMPECO’s EV charging management platform has independently assessed security controls that operators can review when they assess AMPECO as a supplier under NIS2:
- ISO/IEC 27001:2022 certification and a SOC 2 Type II audit
- Role-based access control, multi-factor authentication and single sign-on (SSO)
- TLS 1.2 for data in transit and AES-256 encryption for data at rest
- Audit logging
- Disaster recovery procedures tested in regular drills
The certifications and controls are described on AMPECO’s security page.
Related terms
- Charge Point Operator (CPO)
- eMSP (e-Mobility Service Provider)
- CPMS (Charge Point Management System)
- OCPP (Open Charge Point Protocol)
- ISO 15118
Frequently asked questions
Does NIS2 apply to small EV charging operators?
Generally not. Small enterprises, with fewer than 50 employees and no more than EUR 10 million in annual turnover or balance sheet, fall outside the size rule. A Member State can still designate a small operator, for example if it is the sole provider of an essential service in that country, so check the national law before ruling it out.
What are the NIS2 incident reporting deadlines?
For a significant incident, an operator sends an early warning to its national computer security incident response team (CSIRT) or competent authority within 24 hours of becoming aware of it. An incident notification with an initial assessment follows within 72 hours, and a final report within one month of that notification. If the incident is still ongoing then, the operator sends a progress report instead, and the final report within one month of handling the incident.
Does NIS2 apply to EV charging software providers?
It can. EV charging software providers are not automatically covered as charge point operators, but they may fall under NIS2 through other categories, such as cloud computing or managed services. Even when a software provider is not directly regulated, charging operators covered by NIS2 must assess the cybersecurity practices of their suppliers, including their CPMS providers.
Is ISO 27001 certification enough for NIS2 compliance?
No. ISO/IEC 27001 certification can help organizations demonstrate that they have established cybersecurity risk-management processes, but it does not automatically establish NIS2 compliance. Organizations must also meet applicable requirements for management accountability, incident reporting, supply chain security and other obligations under national NIS2 legislation.
Was this helpful?