S3 / Energy and infrastructure
Generation, transmission, distribution, storage: energy is among the most exposed and most regulated sectors in Europe. NIS2, the critical entities resilience directive and the network code on electricity cybersecurity demand evidence, not intentions, just as AI moves into network maintenance and operations. Every new use of data must be designed together with the security of industrial systems.
Submit a briefInventory the applicable obligations (NIS2, operators of vital importance, critical entities, network code, AI Act) and cost compliance scenarios, site by site.
Specify and run consultations for network digitalisation projects: security requirements, segregation between IT and industrial systems, supplier clauses, acceptance.
Deploy AI on operational data in a private, segregated environment, with quality thresholds set before the pilot and sign-off by the operator.
Prepare governance and evidence: management approval of measures, a 24- and 72-hour notification procedure, control of maintenance contractors’ access.
Other sectors
An untransposed directive does not directly create obligations for companies. Existing regimes, for operators of vital importance and operators of essential services under the first NIS directive, remain in force; since the content of NIS2 is known, preparing now avoids a last-minute rush.
Not necessarily. High risk covers AI systems used as safety components in the management and operation of networks; a planning aid often falls under a lighter regime, but the classification must be documented.
For the EU network code on electricity cybersecurity, the CRE performs the tasks of competent authority in France. On 17 June 2026 it approved the cyber-attack classification methodology proposed by the transmission system operators.
Independent analysis, not legal advice. Facts checked as at 29 October 2026.