NIS2 gives entities in scope 24 hours from becoming aware of a significant incident to send an early warning. That’s too short to design a process, so the work has to happen beforehand.
Operators of recharging points are listed in Annex I, subject to size rules. See NIS2 for charge point operators for scope. This guide is general information and isn’t legal advice, and national law sets the details.
What counts as significant
Article 23(3) gives two tests. An incident is significant if it has caused, or could cause, severe operational disruption or financial loss for you. It’s also significant if it has affected, or could affect, others by causing considerable material or non-material damage.
Note the words “capable of causing”. An incident can qualify before the damage happens. For an operator, a rogue firmware job stopped halfway may need the same assessment as a network-wide outage.
Agree your own thresholds with counsel now, and check them against guidance from your national authority.
What’s due, and when
Start
You become aware
Of a significant incident. A named person records the moment.
Within 24 hours
Early warning
Suspected malicious act, and any cross-border impact.
Within 72 hours
Incident notification
An initial assessment of severity and impact.
One month later
Final report
Counted from the 72-hour notification. Root cause and mitigation.
| Report | Deadline | What it covers |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Whether malicious acts are suspected and whether there could be cross-border impact |
| Incident notification | Within 72 hours of becoming aware | An update, an initial assessment of severity and impact, and indicators of compromise where available |
| Intermediate report | When the CSIRT or authority asks | Relevant status updates |
| Final report | Within one month of the notification | Description, severity and impact, likely root cause, mitigation, and any cross-border impact |
If the incident is still running when the final report is due, you send a progress report then. The final report follows within one month of finishing your handling of the incident.
In Germany, the BSIG sets these duties out in § 32, and reports go to the BSI. See our regulation tracker for dates.
What to set up now
- Name who decides whether an incident is significant, plus a deputy for nights and holidays.
- Write down when the clock starts in your organisation, and how you record that moment.
- Find your reporting route and test the login. The CSIRT or authority differs by country.
- Prepare a short template for the early warning, so nobody drafts from nothing at 3 am.
- Keep logs from your back-end, chargers and suppliers with synchronised time.
- Put notice periods in supplier contracts, because their delay eats into your 24 hours.
- Run a tabletop exercise with a charging scenario, and time how long the decision takes.
Keep the decision as well as the report
Record why you did or didn’t treat an incident as significant, who decided, and what they knew at that moment. If an authority asks later, that record is your explanation.
Article 20 makes management bodies responsible for approving and overseeing risk-management measures. So your board should see the exercise results, along with the process document.
The final report asks for a root cause and the mitigation applied. Both are easier to write from a timeline built during the incident. We’re building GridSEAL to help with that record, and a person still signs each report.
