Who each rule binds in EV charging
An operator and a charger maker have different duties, so this page shows who each rule applies to.
6 Dec 2025
BSIG in force
NIS2 in German law.
8 Jan 2026
AFIR: ISO 15118-1 to -5
For new or renovated public points.
15 Aug 2026
Dutch Cbw in force
NIS2 in Dutch law.
11 Sep 2026
CRA reporting
Binds manufacturers.
1 Jan 2027
AFIR: ISO 15118-20
For new or renovated points.
11 Dec 2027
CRA main obligations
Essential requirements and CE marking.
| Rule | Who it binds | What it asks for | Dates | Source |
|---|---|---|---|---|
| NIS2 Directive | Operators of a recharging point, listed in Annex I, subject to size rules | Risk-management measures (Art. 21), management accountability (Art. 20) and incident reporting (Art. 23) | 24 h early warning, 72 h notification, final report one month after the notification | EUR-Lex |
| Germany: BSIG 2025 | Charge point operators listed at Anlage 1, 1.1.9, subject to § 28 size thresholds | Registration (§ 33), reporting (§ 32), management duties and training (§ 38). Fines up to €10M for essential entities, or 2% of worldwide turnover where that’s higher and turnover exceeds €500M (§ 65) | In force since 6 Dec 2025, with no general grace period. BSI treats the registration window as ended on 6 Mar 2026 | BSIG Anlage 1 |
| Netherlands: Cyberbeveiligingswet | Entities in scope under Dutch law, which implements NIS2 | Duty of care and incident reporting, including a 24-hour early warning | In force since 15 Aug 2026 | Forvis Mazars (secondary) |
| Cyber Resilience Act | Manufacturers of products with digital elements. Reporting doesn’t bind operators | Report actively exploited vulnerabilities and severe incidents through ENISA’s platform | Reporting since 11 Sep 2026, main obligations from 11 Dec 2027 | European Commission |
| RED delegated act | Makers of radio-connected equipment. We found no official charger-specific text, and vendors treat chargers as in scope | Network, privacy and fraud protection. EN 18031 is voluntary and cited with restrictions | Since 1 Aug 2025. Repeal adopted 16 Feb 2026, effective 11 Dec 2027 | European Commission |
| AFIR and Reg. 2025/656 | Operators of new or renovated public points, and some private points from 2027. AFIR isn’t a cybersecurity law | Digital connection, smart recharging and data access. EN ISO 15118 for points installed or renovated from the dates shown | ISO 15118-1 to -5 from 8 Jan 2026, ISO 15118-20 from 1 Jan 2027 | AFIR, consolidated |
| Network code on cybersecurity | Operators of recharging points, among others, if identified as high-impact or critical-impact | Cyber risk assessment and supplier security for cross-border electricity flows | In force since 13 Jun 2024, and being phased in | Reg. (EU) 2024/1366, EUR-Lex |
| EU post-quantum roadmap | Member states. A coordinated, non-binding roadmap that doesn’t classify charging | National roadmaps, then migration of high-risk and medium-risk use cases | End 2026: national roadmaps and pilots. End 2030: high-risk. End 2035: medium-risk | European Commission |
| UK public charge points | A consultation from the Department for Transport, covering public charge points | Proposes ETSI EN 303 645, possibly EN 18031, tamper protection and a possible second phase for operators | Opened 29 Oct 2026, closes 20 Dec 2026 | GOV.UK |
Standards to watch
Adds bidirectional charging and control of distributed energy. Edition 1 published by IEC as IEC 63584-210:2025. Open Charge Alliance
Requires mutual TLS 1.3 on the vehicle-to-charger link, which a charging back-end can’t see. Amendment 1 was published in July 2026, with an improved security concept. CharIN
Industrial security standards built on zones and conduits. A useful way to separate chargers, back-end, payment and building systems. ISA/IEC 62443 series