Question 1

1. Does NIS2 apply to a charging operator with fewer than 50 employees?

Accepted Answer

Often, yes. The size cap in Article 2(1) is assessed after consolidating linked enterprises at 100%, so a small operator owned by a utility or fuel retailer is measured on its parent's numbers. A Member State can also designate an operator of any size under Article 2(2) where it is the sole provider of an essential service or is critical at national or regional level.

Question 2

2. Is a charging platform vendor outside the EU in scope?

Accepted Answer

Not directly. Jurisdiction follows establishment under Article 26(1), and the EU-representative requirement in Article 26(3) covers only the digital entity types, not energy. The obligation arrives contractually instead: your European customer must secure its direct suppliers under Article 21(2)(d) and has to evidence how it did so.

Question 3

3. What are the NIS2 incident reporting deadlines?

Accepted Answer

An early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours with an initial severity assessment and indicators of compromise, an intermediate report if the CSIRT asks, and a final report within one month of the notification. If the incident is still open, a progress report replaces the final report until one month after it is handled.

Question 4

4. What actually differs between an essential and an important entity?

Accepted Answer

The risk-management and reporting duties are the same. Supervision and penalties are not: essential entities face proactive inspections and audits under Article 32 and fines up to €10 million or 2% of worldwide turnover, while important entities are supervised only after evidence of non-compliance and face €7 million or 1.4%. Only essential entities can have a CEO temporarily barred from managerial functions.

Question 5

5. Does NIS2 require a specific certification?

Accepted Answer

No certificate is mandated by the directive itself. Article 21(1) requires measures that reflect the state of the art and relevant European and international standards, Article 25 encourages their use, and Article 24 lets a Member State require products certified under an EU cybersecurity certification scheme. In practice, recognised standards are how operators evidence the measures rather than a substitute for them.

Author name: Team

NIS2 And EV Charging: What The EU Directive Requires Of Recharging Point Operators

IEC 62443 For EV Charging: What The OT Security Standard Requires Of Your Stack

RFID Card For EV Charging: The Authorisation Layer Operators Must Get Right

EV Charging Station Design: Bay Layout, Connector Mix And Canopy Decisions

EV Demand Charge Management: The Bill Forecourts And Fleet Depots Did Not Budget For

EV Charging Station License In India: The Approvals You Actually Need

EV Charging Station Business Plan: Assumptions, Financial Model And What Lenders Ask

EV Charging Station Advertising: Selling The Screen, Not Just The Session

OCPP Backend Software: How To Verify A Vendor’s Compliance Claim

EV Charging For Real Estate: Who Installs, Who Operates, Who Keeps The Revenue

EV Charging Station Subsidy In India: What CPOs Can Actually Claim In 2026

Telangana EV Charging Tender: 169 Stations Where the CPO Pays TGREDCO

Smart Charging for Fleet Depots: Sequencing 40 Vehicles Through 12 Chargers Overnight

UPI-Based EV Charging Under UBC: What The 2026 Rollout Means For CPOs

ISO 15118-20 vs ISO 15118-2: The Plug & Charge Roadmap CPOs Should Plan Around

OCPP 2.1 vs OCPP 2.0.1: What CPOs Need To Know Before Upgrading

EV Charging Station Profit Margin By Site Type: What Operators Actually Make

GST On EV Charging: HSN/SAC Codes And Invoicing Rules CPOs Get Wrong