NIS2 in Energy Supply: Municipal Utilities, Grid Operators, Smart Meter

Main article: NIS2 implementation in Germany — scope, measures under Section 30 BSIG, management liability under Section 38 BSIG, reporting duties and fines at a glance.

1. Who is affected?

In Germany, you are affected if you fall under a type of entity in the energy sector pursuant to Annex 1 BSIG and meet the size thresholds of § 28 BSIG — and, irrespective of size, if you operate a critical installation (§ 28(1) no. 1 BSIG). The link to the annex is not incidental: § 28(1) no. 4 BSIG covers exclusively types listed in Annex 1 (highly critical sectors, which include energy), while § 28(2) sentence 1 no. 3 BSIG covers types in Annex 1 or Annex 2.

The size thresholds are alternative, not cumulative: an energy supplier is an important entity if it employs at least 50 people or has an annual turnover and an annual balance sheet total each exceeding EUR 10 million (§ 28(2) sentence 1 no. 3(a) and (b) BSIG). It qualifies as a particularly important entity from at least 250 employees or an annual turnover of more than EUR 50 million combined with a balance sheet total of more than EUR 43 million (§ 28(1) no. 4 BSIG). A supplier with 60 employees and modest turnover is therefore covered — the headcount threshold alone is sufficient. For grid operators, it is not the label that decides but the installation: anyone operating a critical installation is a particularly important entity irrespective of size (§ 28(1) no. 1 BSIG); anyone who does not is classified via the size thresholds set out above. On the additional BSI certification of Smart Meter Gateway administrators (SMGA), see section 4.

Two pitfalls remain in the classification. First, turnover alone is never sufficient: § 28(1) no. 4(b) BSIG requires turnover above EUR 50 million and a balance sheet total above EUR 43 million; only the headcount from 250 upwards operates on its own. Second, the category of important entity has no upper limit — even a large company remains an important entity if it does not fall under a type listed in Annex 1; this does not apply to the energy sector, since energy is among the Annex 1 types, and the case becomes relevant only where there are additional activities in Annex 2 sectors. Headcount, annual turnover and balance sheet total are calculated in accordance with Recommendation 2003/361/EC, with the exception of Art. 3(4) of its annex (§ 28(4) BSIG); belonging to a group may mean that linked enterprises are included. Practice recommendation: record the classification for each company in writing, with the reference date, the figures relied on and the number of § 28 BSIG applied.

2. Triple regulation: NIS2 + EnWG + KRITIS (Germany)

For German energy suppliers, § 28(5) BSIG decides which set of duties applies. For the energy sector, the BSIG 2025 refers to §§ 5c to 5e of the German Energy Industry Act (EnWG) as the governing cybersecurity rules.

Four questions determine which regime applies to your company — to be examined in this order:

1. Do you operate energy supply networks, energy installations or digital energy services under the EnWG, and are you subject to §§ 5c to 5e EnWG? Yes: §§ 30, 31, 32, 35, 36, 38, 39, 61 and 62 BSIG do not apply to that area (§ 28(5) sentence 1 no. 2 BSIG); risk management, reporting and evidence follow the EnWG.
2. Measured against your overall business activity, is operating the energy installation merely an ancillary activity? Yes: the exemption does not apply at all — the BSIG applies in full (§ 28(5) sentence 4 BSIG).
3. Do you additionally operate further critical installations within the meaning of § 2 no. 22 BSIG, or do further activities place you under one of the types of entity set out in Annex 1 or 2 BSIG? Yes: for all IT systems required to operate those further critical installations, the BSIG duties apply — risk management under §§ 30 and 31 BSIG, reporting under § 32 BSIG and the evidence obligation under § 39 BSIG (§ 28(5) sentences 2 and 3 BSIG; deadlines in section 7).
4. Regardless of the outcome: registration under § 33 BSIG is not on the exemption list of § 28(5) sentence 1 no. 2 BSIG — it applies in every constellation. § 65 BSIG is likewise not on the list, but it attaches to breaches of the duties applicable in each case (details at the end of this section).

The third leg is KRITIS law: anyone operating a critical installation within the meaning of § 2 no. 22 BSIG is a particularly important entity irrespective of size (§ 28(1) no. 1 BSIG) and registers, by way of derogation, under § 8 of the German KRITIS Umbrella Act (KRITIS-Dachgesetz) rather than through the general registration of § 33(1) BSIG (§ 33(2) BSIG), to the extent that § 33(2) BSIG is already applicable (§ 66 BSIG: only once the statutory instrument under § 4(3) and § 5(1) KRITIS-Dachgesetz takes effect). Added to this are the KRITIS Regulation and sectoral requirements — the interplay is complex.

For municipal utilities operating across several lines of business, the classification of each line decides which regime applies:

What matters is always the specific type of entity under Annex 1 or 2 BSIG, not the internal name of the business line — the classification must be examined for each company. The first row also falls away if operating the energy installation is merely an ancillary activity (step 2 of the assessment path). This article does not set out in detail which measures, reporting channels and evidence §§ 5c to 5e EnWG require; the statutory text is authoritative (see the sources block).

Practice recommendation: keep this delimitation in a versioned document with a list of installations and activities and update it whenever the portfolio of installations changes — it determines which chain of duties applies to which part of an installation in the first place.

In Germany the fine framework extends to EUR 10 million for particularly important entities and EUR 7 million for important entities (§ 65(5) sentence 1 no. 1 BSIG) — but it attaches to breaches of the duties designated there, including the risk management and reporting duties, which in the constellations of § 28(5) sentence 1 no. 2 BSIG precisely do not apply. The turnover variant of 2 % or 1.4 % of worldwide total turnover applies only above a total turnover of EUR 500 million and only for the breaches designated in § 65(6) and (7) BSIG. Total turnover is the sum of all worldwide turnover of the undertaking to which the entity belongs in the financial year preceding the authority's decision (§ 65(8) BSIG). Where a data protection supervisory authority has already imposed a GDPR fine for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG). The personal internal liability of the management body under § 38(2) BSIG, by contrast, is on this exemption list and applies only to the extent that the exemption does not apply.

3. SCADA security

To the extent that the BSIG regime applies (assessment path, section 2), the same catalogue of measures applies to control technology as to office IT — § 30(2) BSIG contains no separate SCADA catalogue, and the ten areas apply across sectors. To the extent that §§ 30 et seq. BSIG apply, the measures cover all IT systems required to operate the further critical installations (step 3 of the assessment path in section 2).

Industrial control systems are not to be considered separately from office IT (OT/IT convergence). Under § 30(2) sentence 1 BSIG, the measures should comply with the state of the art and take into account the relevant European and international standards; in the control technology environment, IEC 62443 and NIST 800-82 count as such standards. Practice recommendation: record which standards were relied on and why — the statute frames taking them into account as a target requirement, and documenting it makes it auditable.

Five of the ten areas of § 30(2) BSIG translate directly to the control level; the other five are covered in the linked main article. No. 3 requires business continuity with backup management, disaster recovery and crisis management — for the control room this means restarting operations after an outage, not just a backup concept. In practice this is implemented through a business continuity plan with RTO and RPO for each business process, a backup following the 3-2-1 principle or equivalent, a tested restore routine and a crisis management plan. No. 4 concerns supply chain security, which at the control level mainly means the remote maintenance access of control technology manufacturers (section 5). No. 7 requires basic training and awareness — this is where sector-specific depth pays off. No. 9 requires personnel security and access control, no. 10 multi-factor authentication or continuous authentication as well as secured communications; the statute does not specify which access routes are covered in detail — in our practical assessment, multi-factor authentication is the minimum standard for all administrative and external access (VPN, cloud), while pure office use can be justified on a risk basis. Practice recommendation: run dedicated SCADA training for all staff with access to control systems, document the separation of office IT and process network, and practise restarting the control room at least once a year. For no. 7: training content for control room personnel delimited from office IT training, with proof of participation. For no. 9: personalised accounts instead of shared logins in the control room, documented withdrawal on role change or departure, and periodic review of authorisations for control system access. In Austria, the corresponding catalogue is set out in § 32(4)(a) to (j) NISG 2026.

4. Smart Meter Gateway security

For Smart Meter Gateways, the technical guideline BSI TR-03109 applies in addition; a BSI certification obligation applies to Smart Meter Gateway administrators (SMGA), not to every municipal utility. Alongside this run the BSIG duties and, as soon as personal data are involved, data protection law — three strands of rules that must be managed separately.

The second strand consists of the BSIG duties: which of them apply to the operation of the gateways is decided by the assessment path in section 2. Where the EnWG exemption of § 28(5) sentence 1 no. 2 BSIG applies, risk management under Section 30 BSIG, reporting under § 32 BSIG and the evidence obligation under § 39 BSIG also fall away for that part of the installation. The evidence under § 39(1) BSIG must be kept separate from the certification in the first strand: it applies to operators of critical installations and allows a security audit, an examination or a certification as three equivalent routes (section 7).

The third strand is data protection law; what matters in practice there is the double reporting situation. Where a security incident is at the same time a personal data breach, the report to the competent data protection supervisory authority runs alongside the NIS2 report under § 32 BSIG (deadlines and addressee in section 7; only to the extent that the BSIG regime applies, assessment path in section 2): without undue delay and where feasible within 72 hours of becoming aware of it, unless a risk to the rights and freedoms of natural persons is unlikely (Art. 33(1) GDPR). If the report is made later, it must be accompanied by reasons for the delay. Where a high risk is likely, the data subjects must additionally be informed without undue delay (Art. 34(1) GDPR); this is not required where, among other things, appropriate technical protection measures such as encryption were applied (Art. 34(3) GDPR). On the sanctions side in cases of double breaches, see section 2. Practice recommendation: manage both reporting channels in a single joint playbook so that the shorter 24-hour deadline does not outrun the data protection assessment.

5. Supplier audit specifics

In Germany — to the extent that the BSIG regime applies (assessment path, section 2) — the benchmark for suppliers is § 30(2) no. 4 BSIG (supply chain security); in our practical assessment, cybersecurity clauses are frequently missing from contracts in precisely this area. In Austria, the corresponding area is set out in § 32(4)(d) NISG 2026.

Four building blocks belong in the supplier programme:

• Supplier assessment with risk classification — the classification decides which suppliers are examined in depth at all; the criterion with the greatest effect is access to control systems and remote maintenance access.
• Cybersecurity clauses in the standard contracts instead of individual negotiation for each contract.
• Right to audit for critical suppliers — without a contractual basis, any examination remains a request rather than a right.
• Incident reporting by the supplier to you, customarily within 24 hours. This is a contractual clause, not a statutory reporting deadline owed by the supplier to you; it is what makes it possible to submit your own 24-hour report on time.

Practice recommendation: divide suppliers into three classes and align the contract work accordingly — class 1: remote maintenance or control system access, where a right to audit and a 24-hour reporting clause should be agreed contractually and remote maintenance access broken down into auditable points — access procedure, logging, activation, account management; class 2: access to office IT or data without control system access, where a questionnaire and a standard clause apply; class 3: no system access, where a standard clause applies. No statute prescribes the class boundaries — they must fit your own risk profile and be justified.

An ISO 27001 certification does not take this work off your hands: in the mapping of the ten areas of Section 30 BSIG (where applicable, cf. the assessment path in section 2) onto Annex A, it is precisely the supplier controls that carry the high probability of gaps, because the cybersecurity clauses are typically missing there. Practice recommendation: work through existing contracts with control technology and metering technology suppliers — the SCADA manufacturers such as Siemens, ABB or Schneider and the smart meter manufacturers — according to these classes, not alphabetically.

6. Austria: energy suppliers under the NISG 2026

From 1 October 2026, Austrian energy suppliers are essential or important entities under the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (BGBl. I Nr. 94/2025); the competent authority is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria), and reports go to the competent CSIRT. The specific instruments described above (§§ 5c to 5e EnWG, KRITIS law, BSI certification of Smart Meter Gateways under BSI TR-03109, registration with the BSI) are by contrast German law and apply only in Germany. Energy is a highly critical sector in Austria as well (Annex 1, § 2 NISG 2026). For Austrian energy suppliers, the following applies:

• Risk management: appropriate and proportionate measures under § 32 NISG 2026 (all-hazards approach, catalogue (a)–(j)).
• Reporting of significant incidents: to the competent CSIRT (§ 34 NISG 2026), not to the BSI — deadlines of 24 hours / 72 hours / 1 month, see section 7.
• Registration: within 3 months with the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (§ 29 NISG 2026), not with the BSI.
• Fine framework: as under the EU requirement — essential entities up to EUR 10 million / 2 %, important entities up to EUR 7 million / 1.4 % of worldwide annual turnover (§ 45 NISG 2026); fines are imposed by the district administrative authority.

Timing is the key difference from Germany: the NISG 2026 was promulgated on 23 December 2025 and becomes applicable on 1 October 2026 — nine months after promulgation, on the first day of the following month (§ 51(1) and (2)). Only from that day do the risk management duties of § 32 NISG 2026 apply; the subsequent deadlines for registration, self-declaration and evidence are set out in section 7.

Classification follows § 25(2) and (3) NISG 2026: a large enterprise has at least 250 employees or an annual turnover above EUR 50 million combined with a balance sheet total above EUR 43 million; a medium-sized enterprise has at least 50 employees or an annual turnover above EUR 10 million combined with a balance sheet total above EUR 10 million. Large enterprises falling under an Annex 1 type — which includes energy — are essential entities (§ 24(1) no. 3); entities falling under Annex 1 and Annex 2 types that run a large or medium-sized enterprise are important entities, to the extent that they are not already essential entities (§ 24(2) no. 1). The Cybersecurity Authority (Cybersicherheitsbehörde, Austria) is the Federal Office for Cybersecurity, an authority directly subordinate to the Federal Minister of the Interior with its seat in Vienna (§ 3a(1) and (2), § 3b(3) NISG 2026); supervision and enforcement lie with it (§§ 38 and 39), while administrative penalties are imposed by the district administrative authority (§ 44(1)). Management bodies must ensure and supervise compliance with the measures and take part in cybersecurity training (§ 31(1) and (2) NISG 2026) — § 31 NISG 2026 contains no express internal liability rule comparable to § 38(2) BSIG.

Austria has its own sectoral rules; a literal transfer of the German KRITIS and EnWG requirements is not possible.

7. Deadlines and evidence at a glance (DE and AT)

The following overview contains exclusively statutory deadlines and reporting duties — each row names the provision it follows from and the entities it applies to. Practice recommendations appear only in the running text and are marked there. For German energy suppliers, the 'Applies to' column is decisive: where § 28(5) sentence 1 no. 2 BSIG applies, risk management, reporting and evidence follow the EnWG (assessment path, section 2) — the reporting and evidence rows for Germany then do not apply, while the registration row very much does.

The reporting clock starts running only once the incident is significant. Under § 2 no. 11 BSIG, a security incident is significant if it has caused or is capable of causing severe operational disruption of services or financial loss for the entity, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. Quantitative thresholds for this are contained in EU Implementing Regulation 2024/2690, but only for certain digital types of entity such as DNS service providers, cloud and data centre services or managed (security) service providers — not for energy suppliers. For all other entities, until a statutory instrument under § 56(5) BSIG is issued, the definition of § 2 no. 11 BSIG applies on its own. In Austria, the identically worded threshold is set out in § 35(1) NISG 2026.