Question 1

1. Does NIS2 apply to a charging operator with fewer than 50 employees?

Accepted Answer

Often, yes. The size cap in Article 2(1) is assessed after consolidating linked enterprises at 100%, so a small operator owned by a utility or fuel retailer is measured on its parent's numbers. A Member State can also designate an operator of any size under Article 2(2) where it is the sole provider of an essential service or is critical at national or regional level.

Question 2

2. Is a charging platform vendor outside the EU in scope?

Accepted Answer

Not directly. Jurisdiction follows establishment under Article 26(1), and the EU-representative requirement in Article 26(3) covers only the digital entity types, not energy. The obligation arrives contractually instead: your European customer must secure its direct suppliers under Article 21(2)(d) and has to evidence how it did so.

Question 3

3. What are the NIS2 incident reporting deadlines?

Accepted Answer

An early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours with an initial severity assessment and indicators of compromise, an intermediate report if the CSIRT asks, and a final report within one month of the notification. If the incident is still open, a progress report replaces the final report until one month after it is handled.

Question 4

4. What actually differs between an essential and an important entity?

Accepted Answer

The risk-management and reporting duties are the same. Supervision and penalties are not: essential entities face proactive inspections and audits under Article 32 and fines up to €10 million or 2% of worldwide turnover, while important entities are supervised only after evidence of non-compliance and face €7 million or 1.4%. Only essential entities can have a CEO temporarily barred from managerial functions.

Question 5

5. Does NIS2 require a specific certification?

Accepted Answer

No certificate is mandated by the directive itself. Article 21(1) requires measures that reflect the state of the art and relevant European and international standards, Article 25 encourages their use, and Article 24 lets a Member State require products certified under an EU cybersecurity certification scheme. In practice, recognised standards are how operators evidence the measures rather than a substitute for them.

NIS2 And EV Charging: What The EU Directive Requires Of Recharging Point Operators

Secure EV Charging API Practices Every CPO Should Demand

cpo compliance

NIS2 And EV Charging: What The EU Directive Requires Of Recharging Point Operators

Secure EV Charging API Practices Every CPO Should Demand