Priority sector
Electricity, gas, oil, hydrogen, district heating, drinking water and wastewater operators provide the services on which every other sector depends.
Key obligations
Energy, drinking water and wastewater are sectors of high criticality listed in Annex I of NIS2.
Entities identified under the Critical Entities Resilience Directive (EU) 2022/2557 must assess risks and take resilience measures.
Significant incidents require an early warning within 24 hours, a notification within 72 hours and a final report within one month.
Large energy companies are at the centre of sustainability reporting and supply-chain due diligence obligations.
Energy and water operators combine operational technology, physical infrastructure and large volumes of customer data. They must protect both the digital and the physical resilience of their services, report incidents quickly and show their management bodies that risks are under control. Smart meters and customer platforms add significant data protection obligations.
information security: NIS2 risk-management measures across IT and operational technology, with incident response;
resilience: risk assessment and resilience planning for entities identified as critical;
Data Protection Officer: for customer, smart meter and employee data;
sustainability and supply chain: readiness for reporting and due diligence on suppliers.
A free Compliance Assessment clarifies the entity's classification and its priority obligations.
Related domains: Cybersecurity (NIS2) · Sustainability (CSRD/CSDDD) · Third-Party & Supply Chain · Data Protection · Corporate Governance
Regulated functions: Information Security Officer · Data Protection Officer · Compliance Officer · All sectors
General information as at October 2026; it does not constitute legal advice.
Request a free assessment designed for energy and water operators.