Energy & environment compliance: NIS2, AI Act, Data Act & GDPR

Why the 'Energy & environment' sector is concerned.

Criticality defines the sector. A power outage, water disruption, or sanitation failure has cascading effects on public health, the economy, and security. NIS2 therefore classifies energy and water among the essential sectors, subject to the most stringent regime and enhanced supervision, with significant exposure to attacks targeting industrial control systems (SCADA).

Network management increasingly relies on AI. Yet the AI Act classifies as high-risk those AI systems used as safety components in the management and operation of electricity, gas, heat, or water supply. These use cases carry the heaviest compliance obligations.

Finally, smart meters and sensors generate data: the Data Act opens access to it for the user, and GDPR applies to consumption data, which is particularly revealing of a household's lifestyle habits.

NIS2 — an essential sector

Energy (electricity, gas, oil, hydrogen, heat), drinking water, and wastewater are among the essential entities under NIS2. These actors are subject to the strictest regime: risk management measures, incident notification, ex-ante supervision, and management accountability. Waste management falls under important entities.

The security of industrial systems (SCADA) and IT/OT convergence is the key challenge.

Key obligations

• Risk management measures (art. 21) IT and OT/SCADA.
• Notification of significant incidents.
• Business continuity and crisis management for critical infrastructures.
• Supply chain security.

AI Act — high-risk AI for network management

The AI Act classifies as high-risk those AI systems used as safety components in the management and operation of water, gas, heat or electricity supply. The obligations are significant: risk management, data quality, human oversight, and documentation.

Optimisation use cases without a safety role fall under lighter regulatory regimes.

Key obligations

• Qualifying network management AI (often high-risk).
• Risk management and data quality.
• Human oversight and technical documentation.
• Post-market surveillance.

Data Act — meters and connected objects

Smart meters and connected energy equipment generate data to which the Data Act grants users access, with the ability to share it with third parties (alternative suppliers, energy efficiency services). This drives competition and the development of energy services.

Key obligations

• User access to meter and equipment data.
• Sharing with designated third parties (suppliers, services).
• 'Data access by design' architecture.
• Review of energy service contracts.

GDPR — sensitive consumption data

Consumption data, especially at fine time granularity, reveals a household's lifestyle patterns (presence, routines, appliances). It is personal data and calls for a clear legal basis, transparent information, and enhanced security.

Key obligations

• Legal basis and information on consumption data.
• Minimising the measurement time step.
• Security and retention periods.
• Regulation of energy profiling.

Comparative overview of regulations

How these regulations interact

Infrastructure security is the common thread: NIS2 measures (essential), AI Act obligations for network management AI, GDPR security of consumption data, and CRA for equipment. An incident affecting a control system combines NIS2 risk, AI Act malfunction, and potential GDPR breach.

The smart meter illustrates the combination of the Data Act and GDPR: its data must be accessible to the user (Data Act) while being protected as personal data (GDPR), with measurement interval minimisation to limit intrusion into private life.

Application timeline

• 1GDPR. In force; vigilance regarding granular consumption data.
• 2Data Act. Majority of obligations applicable from 12 September 2025.
• 3AI Act. High risk (critical infrastructures) from 2026–2027.
• 4NIS2. French transposition under way; essential regime to anticipate.

Applicable penalties

NIS2 up to €10M or 2% (essential entities), AI Act up to €35M or 7%, GDPR up to €20M or 4%, CRA up to €15M or 2.5%. Data Act: national sanctions.

The risk goes beyond the fine: a breach affecting an essential network has societal consequences, which justifies ex ante supervision of essential entities.

Compliance roadmap

• 1Secure IT/OT/SCADA. Deploying NIS2 measures across the management and industrial systems of infrastructures.
• 2Qualify network AI. Identify AI systems that are safety components and produce the required documentation.
• 3Opening meter data. Implement Data Act access and sharing.
• 4Protect consumption. Minimise measurement intervals and secure personal data.
• 5Steer. Involve management, appoint a DPO and CISO, periodic review.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, NIS2 and DORA on a single platform, with outsourced DPO and CISO, and supports energy and water sector players on the NIS2 essential regime and AI-based network management.

DCO provides templates tailored to critical infrastructures (NIS2 OT measures, AI Act documentation, meter data mapping).

Frequently asked questions