Electricity cyber network code

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-12-31 in 52 days ENTSO for Electricity, with the EU DSO entity, makes available an exercise scenario template for entity and Member State exercises (Article 43)
2. 2027-12-31 in 417 days ENTSO for Electricity makes available a template for regional and cross-regional exercises (Article 44(6))
3. 2029-12-31 in 1148 days First regional cybersecurity exercise in each system operation region (Article 44)
4. 2031-06-13 in 1677 days Latest date for TSOs to develop the first regional cybersecurity risk mitigation plans (Article 22)
5. 2025-06-13 ACER guidelines on information exchange are due, and ENTSO for Electricity prepares the provisional list of standards and controls (Articles 47(7) and 48(6))
6. 2025-03-13 Competent authorities notify entities on the provisional list of high-impact and critical-impact entities (Article 48(3))
7. 2024-12-13 Member States must designate their competent authority (Article 4(1))
8. 2024-06-13 Network code on cybersecurity for electricity enters into force

1. 2026-05-19
   Commission Delegated Regulation (EU) 2024/1366 (as corrected on 19 May 2026) ErrataCurrent text

   A corrigendum fixes cross-references in Articles 7(3), 21(1), 23(4) and 24(7), including in the English text. source

2. 2025-06-19
   Corrected by Delegated Regulation (EU) 2025/1759 Errata

   Corrects certain non-English language versions of Article 18(2)(a); in force from 14 September 2025. The English text is not among the versions corrected. source

3. 2024-03-11
   Delegated Regulation (EU) 2024/1366 Major version

   The network code on sector-specific rules for cybersecurity aspects of cross-border electricity flows, published in the Official Journal on 24 May 2024 and in force from 13 June 2024. source

The code binds listed electricity-sector entities only once a competent authority identifies them as high-impact or critical-impact, using the electricity cybersecurity impact index (ECII).

Entities in scope

Electricity undertakings, NEMOs, organised markets, critical ICT service providers, ENTSO for Electricity, the EU DSO entity, balancing responsible parties, recharging point operators, regional coordination centres and MSSPs (Article 2(1)). source

Identification

Competent authorities identify high-impact and critical-impact entities using the ECII and the thresholds in the Union-wide cybersecurity risk assessment report, including entities outside the EU active within it (Article 24). source

Transition

Entities on the provisional list may voluntarily fulfil their obligations on a precautionary basis before the methodologies are approved (Article 48(3)). source

Critical-impact entities must demonstrate compliance through independent third-party audits or a national verification scheme, repeated every three years.

Verification

No later than 24 months after adopting the controls and the management system, critical-impact entities must demonstrate compliance through independent third-party security audits or a national verification scheme (Article 31(1)-(2)). source

Every three years

Verification is repeated at the latest 36 months after the end of the first one, and every three years thereafter (Article 31(4)). source

Management system

Within 24 months of being notified, high-impact and critical-impact entities establish a cybersecurity management system and review it every three years (Article 32). source

Cyber-attack reporting

Entities share information on a reportable cyber-attack with their CSIRT and competent authority without undue delay and no later than four hours after becoming aware it is reportable (Article 38(3)). source

Exercises

Critical-impact entities run a cybersecurity exercise by 31 December of the year after their notification and every three years thereafter (Article 43(1)). source

National competent authorities identify entities, approve methodologies and verify compliance; ACER monitors implementation and reports at least every three years.

Competent authorities

Each Member State designates a governmental or regulatory authority for the tasks of the Regulation (Article 4(1)). source

ACER monitoring

ACER monitors implementation and publishes a report at least every three years on the status of cybersecurity risk management by high-impact and critical-impact entities (Article 12). source

Derogations

Competent authorities may grant derogations from the minimum and advanced controls, for example where costs significantly exceed benefits (Article 30). source

1. Law text Commission Delegated Regulation (EU) 2024/1366 - network code on cybersecurity for electricity
2. Law text Corrigendum to Delegated Regulation (EU) 2024/1366 (19 May 2026)
3. Law text Commission Delegated Regulation (EU) 2025/1759 correcting certain language versions
4. Guidance Cybersecurity network code for electricity (ACER)

1. NIS2

   The cross-sector EU cybersecurity directive; the network code adds sector-specific rules for cross-border electricity flows on top of it.

2. CER Directive

   The EU directive on physical resilience of critical entities, including in energy, rather than cybersecurity of electricity flows.

3. NERC CIP

   The mandatory North American cybersecurity standards for the bulk electric system, the nearest counterpart outside the EU.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to Electricity cyber network code (RSS)