Scenario<\/strong><\/td>NIS2 in scope?<\/strong><\/td><\/tr>| Your organisation owns solar panels and consumes all generated electricity itself, but the panels are connected to the grid.<\/td> | Yes \u2013 You still qualify as a \u201cproducer.\u201d<\/td><\/tr> | | Your organisation owns solar panels, but no electricity is injected into the grid.<\/td> | No \u2013 Without grid connection, no societal\/economic risk to the grid exists.<\/td><\/tr> | | Your organisation rents a building with solar panels it does not own, but consumes the electricity (wholly or partly).<\/td> | No \u2013 You don\u2019t \u201cgenerate\u201d electricity if you don’t own\/operate the panels.<\/td><\/tr> | | Another organisation uses space on your roof to place and operate solar panels.<\/td> | No \u2013 Same principle as above.<\/td><\/tr> | | Your organisation purchases electricity from another organisation operating solar panels on your building.<\/td> | No \u2013 You\u2019re a consumer, not a producer.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nKey threshold: The size-cap matters<\/h5>\n\n\n\nNIS2 obligations only apply if your organisation qualifies as at least a medium-sized enterprise, meaning the entity has:<\/p>\n\n\n\n \n- 50 or more employees (calculated in annual work units); or<\/li>\n\n\n\n
- annual turnover exceeding EUR10 million and an annual balance sheet total exceeding EUR10 million.<\/li>\n<\/ul>\n\n\n\n
Importantly, data from partner and linked enterprises generally has to be consolidated when calculating size. This could push smaller entities above the threshold unexpectedly.<\/p>\n\n\n\n The good news: A lighter touch<\/h5>\n\n\n\nThe CCB acknowledges that self-consumption electricity producers were \u201cnot the intended highly critical entities targeted in the electricity sub-sector\u201d of NIS2. So, while these entities are in scope, a less stringent supervision approach applies.<\/p>\n\n\n\n In practice, this means:<\/p>\n\n\n\n \n- You still have to register as an NIS2 entity.<\/li>\n\n\n\n
- You still have to report significant incidents.<\/li>\n\n\n\n
- You still have to apply cybersecurity measures \u2013 but using a lower assurance level of the CyberFundamentals (CyFun\u00ae).<\/li>\n\n\n\n
- Framework (eg \u201cBasic\u201d) will be considered proportionate.<\/li>\n\n\n\n
- Your management bodies must be trained and are responsible to approve the cybersecurity measures and oversee their implementation.<\/li>\n<\/ul>\n\n\n\n
This solution takes into account the \u201crather limited societal and economic impact\u201d of self-consumption electricity production.<\/p>\n\n\n\n Naturally, if your organisation falls within the scope of NIS2 for other activities, this more flexible supervisory approach won’t apply.<\/p>\n\n\n\n Remaining questions and inconsistencies<\/h5>\n\n\n\nWhile the CCB’s scenarios provide helpful guidance, several gaps and tensions remain:<\/p>\n\n\n\n Does self-consumption allow an escape from the NIS2 scope?<\/strong><\/p>\n\n\n\nMore clarity is needed on whether NIS2 applicability depends on any physical connection to the public grid, or on the actual and meaningful injection of electricity into that grid.<\/p>\n\n\n\n The distinction between installations that are technically grid connected (and are therefore in scope) and those that don’t inject electricity (and would be out of scope) is crucial. Yet most commercial, non residential PV systems are grid connected even when self consumption is maximised \u2013 meaning injection is minimal or purely incidental.<\/p>\n\n\n\n The CCB\u2019s guidance suggests that mere physical grid connection \u2013 regardless of the volume or frequency of injection \u2013 triggers NIS2 obligations. This interpretation risks sweeping in far more organisations than the risk based rationale behind NIS2 would seem to warrant.<\/p>\n\n\n\n One may reasonably question this approach. If the policy logic is that generation \u201cnot injected into the grid\u201d doesn’t pose systemic risk, it becomes difficult to justify why an organisation that consumes virtually all of its self generated electricity but is physically grid connected should still fall in scope. In both situations, the impact on grid stability is similarly limited.<\/p>\n\n\n\n A more proportionate approach could be to apply a minimum annual injection threshold, combined with the medium\u2011sized enterprise test, as dual criteria for determining NIS2 applicability. This would better align with the directive\u2019s risk\u2011based intent and provide clearer boundaries for operators.<\/p>\n\n\n\n What about Power Purchase Agreements (PPAs) and other third-party ownership models?<\/strong><\/p>\n\n\n\nMany organisations use PPAs or third-party ownership models to install solar capacity without having direct ownership. While the CCB’s scenarios suggest these structures keep the building occupant out of scope, the precise boundaries are untested. For example, if a financing company owns solar panels under a leasing arrangement but the panels are operated by the building owner, it’s unclear which of these entities could fall under the NIS2 scope.<\/p>\n\n\n\n | | |