NIS2 for charge point operators
A plain summary of what the directive says about recharging points, and what an operator should be able to show.
Are you in scope?
Annex I lists operators of a recharging point that are responsible for managing and operating it and that provide a recharging service to end users, including on behalf of a mobility service provider.
Size rules apply, so being on the list isn’t the whole test. National law then decides the details.
The reporting clock
Art. 23 applies to significant incidents. The clock runs from becoming aware of one, so a person has to assess it and record when.
Start
You become aware
Of a significant incident. A named person records the moment.
Within 24 hours
Early warning
Suspected malicious act, and any cross-border impact.
Within 72 hours
Incident notification
An initial assessment of severity and impact.
One month later
Final report
Counted from the 72-hour notification. Root cause and mitigation.
If you operate in Germany
NIS2 came into force through the BSIG on 6 December 2025, with no general grace period.
Charge point operators are listed at Anlage 1, 1.1.9, and § 28 sets size thresholds. BSIG Anlage 1
§ 32 sets the same 24-hour, 72-hour and one-month steps. BSIG § 32
§ 38 requires management to implement the measures, oversee implementation and train regularly. Liability is to the entity, under company law. BSIG § 38
Up to €10M for essential entities, or 2% of worldwide turnover where that’s higher and turnover exceeds €500M. For important entities, €7M or 1.4% on the same basis. BSIG § 65
What you should be able to show
Our reading of what an auditor is likely to ask for. GridSEAL will produce this evidence. Your duties stay yours.
Records that management approved the measures and took training.
An inventory of chargers and identities, access control, incident handling and supplier assurance.
A timestamped incident record, with who decided what and when.