AI for energy and critical infrastructure
NIS2 and the continuity of essential services.
Research
Context
Energy companies, grid operators and utilities run systems society depends on. AI can help operations and planning if it does not weaken resilience or control.
Power, water, telecoms and transport operators need AI without new points of failure or unassessed NIS2 suppliers. Lindstead helps them decide what runs on their own infrastructure, what it costs and who governs it.
Case study (anonymised): Maintenance knowledge assistant for a grid operator A European regional electricity distribution operator, around 2,500 staff.
Need a first decision? The AI Sovereignty Scan covers readiness, regulation and hosting in ten working days.
Energy and telecoms lead on AI, water and transport lag
Critical infrastructure is not one AI market. Eurostat's enterprise survey shows how far apart its sectors are.
Energy and telecoms use AI well above the EU average. Water and transport lag behind.
Share of enterprises with 10 or more persons employed that use at least one AI technology, EU-27, %
¹ All enterprises with 10 or more persons employed, excluding agriculture, forestry, fishing, mining and quarrying, and the financial sector. AI use means at least one of the AI technologies covered by the survey, such as text mining, speech recognition, natural language generation, image recognition, machine learning, AI-based process automation, autonomous robots and generation of images, video or sound. ² Water supply, sewerage, waste management and remediation (NACE section E). Telecoms is NACE division 61, electricity and gas is NACE division 35, transport and storage is NACE section H.
Source: Eurostat, Artificial intelligence by NACE Rev. 2 activity (isoc_eb_ain2), updated 15 June 2026
View data table
| Category | Series 1 | Series 2 | Series 3 |
|---|---|---|---|
| All sectors¹ | 8.1% | 13.5% | 20% |
| Telecoms | 19.2% | 27.1% | 39.8% |
| Electricity and gas | 18.4% | 25.7% | 33.6% |
| Water supply and waste² | 5.7% | 8.4% | 13.1% |
| Transport and storage | 5.3% | 8.1% | 11.2% |
Series 1: 2023. Series 2: 2024. Series 3: 2025. Unit: %
Challenges
In 2025, 39.8% of telecoms and 33.6% of electricity and gas companies used AI, against 13.1% in water and waste and 11.2% in transport. Each operator should know whether its sector is on the fast or the slow track.
- New single points of failure Once control-room staff rely on an AI assistant, it is part of the service. If it runs on one external API, that provider's outage or new terms become an operational risk. NIS2 continuity plans must cover it.
- AI providers as suppliers NIS2 requires an assessment of each direct supplier's vulnerabilities. For AI, that means the model developer, its host and the model's origin. Every new AI service is one more supplier to assess, document and exit-test.
- Personal board liability Boards must approve and oversee cybersecurity measures and can be held liable. Member States must allow fines for essential entities of up to at least 10 million euro or 2% of worldwide annual turnover. Directors need to know which AI touches their networks.
- Operational technology separation Substations, pumping stations and signalling run apart from office IT and the internet. AI that reads their data must respect that boundary, which cloud-only services often cannot. Where AI is a safety component in water, gas, heating or electricity supply, the AI Act makes it high-risk, with obligations from 2 December 2027.
- Grid planning under pressure Dutch regional grid operators ended 2025 with 15,014 offtake capacity requests waiting, up from 11,922 a year earlier. AI can help planners weigh each request. Topology and capacity data should stay under the operator's control.
Europe's data centres add 42 TWh by 2030, the US adds 202
Every AI workload ends up as load on a grid. IEA estimates show where that load grows.
Europe's data centre electricity use is projected to grow by more than half by 2030, while its global share shrinks.
Electricity consumption of data centres by region, IEA Base Case, TWh
¹ IEA Europe region: the European Union plus Albania, Belarus, Bosnia and Herzegovina, Gibraltar, Iceland, Israel, Kosovo, Montenegro, North Macedonia, Norway, Moldova, Serbia, Switzerland, Türkiye, Ukraine and the United Kingdom. ² 2023 to 2025 are IEA estimates; 2030 is the IEA Base Case projection. Global totals: 485 TWh in 2025 and 945 TWh in 2030.
Source: IEA, Key Questions on Energy and AI, Annex A, Table A.4, April 2026
View data table
| Category | Series 1 | Series 2 | Series 3 |
|---|---|---|---|
| 2023 | 154 | 84 | 66 |
| 2024 | 183 | 102 | 68 |
| 2025 | 224 | 117 | 72 |
| 2030 Base Case² | 426 | 277 | 114 |
Series 1: United States. Series 2: China. Series 3: Europe¹. Unit: TWh
Key regulation
European data centre demand rises from 72 TWh in 2025 to 114 TWh in 2030. Its global share still falls from about 15% to about 12%, as the US and China grow faster. Grid operators must connect tens of terawatt hours of new demand. Much AI compute will keep running outside Europe.
| Framework | Relevance |
|---|---|
| NIS2 | Energy is a sector of high criticality. In the Netherlands, the Cyberbeveiligingswet applies from 15 August 2026. |
| Critical entities resilience | The Dutch Wet weerbaarheid kritieke entiteiten applies from the same date. |
| EU AI Act | AI used as a safety component in critical infrastructure is high-risk, with obligations from 2 December 2027. |
How Lindstead helps
- AI strategy Workload map by criticality and data class Lindstead rates each AI use case by its link to the essential service, its data and the rules that apply. A board paper sets out what runs in-house, in a European cloud or via an external API.
- Regulation and risk NIS2 and AI Act map per system Lindstead maps each AI system, with its data flows, suppliers and owner, to NIS2, national law, the AI Act risk class and, where relevant, the electricity network code on cybersecurity. The CISO and board get a register and a gap list.
- Model selection Model origin and supplier assessment Lindstead tests candidate models on the organisation's own manuals and languages, and checks licence terms and developer jurisdiction. The shortlist holds up in a NIS2 supplier assessment.
- Infrastructure and cost Cost of resilient in-house AI capacity Lindstead sizes hardware for the chosen workloads, with redundancy and isolated environments. It compares owning, renting in Europe and staying with an API over three years, with every assumption shown.
- Deployment First use case inside the security perimeter Lindstead builds one use case, such as a maintenance assistant, on the organisation's own infrastructure, with access control, logging and evaluation. The organisation's team takes it over with audit documentation.
- Model stewardship Monthly watch on models, suppliers and rules Lindstead checks new models, licence changes and regulatory guidance every month. The board gets a quarterly note with recommended decisions under NIS2 and the AI Act.
Case study (anonymised)
Maintenance knowledge assistant for a grid operator
A European regional electricity distribution operator, around 2,500 staff
The operator was an essential entity under NIS2. Engineers wanted AI to search decades of manuals and fault reports, and some already used public chatbots.
The board asked what could run safely, where, and who would own it.
What Lindstead did
- Inventory and classification Lindstead mapped all AI use, including informal chatbots, by data sensitivity, link to operations and NIS2 duties. It marked which uses touched operational technology.
- Models and supplier review Lindstead tested open-weight and closed models on anonymised manuals and fault reports. It checked licences, developer origin and hosting against the operator's supplier policy.
- Cost and architecture Lindstead designed an isolated environment with fallback capacity, on the operator's own servers or a European cloud. It compared both with an external API over three years.
- Governance and board paper Lindstead mapped the design to NIS2 duties, incident reporting and the AI Act, and drafted the controls. The board received a paper with a phased plan.
What the client received
- AI system register mapped to NIS2 and the AI Act
- Model shortlist with licence and origin review
- Three-year cost model for in-house and European cloud
- Reference architecture separated from operational technology
- Board paper with a phased deployment plan
The decision
The board approved a production pilot on infrastructure the operator controlled, with a named owner and review points.
It also set which AI uses stay out of operational environments.
Infrastructure operators draw one in six cyber incidents
NIS2 counts these operators as essential entities. ENISA's latest threat report shows how much recorded cyber activity targets them.
Transport, digital infrastructure and energy drew 16.9% of the cyber incidents ENISA recorded in the EU in 2025.
Share of cyber incidents recorded by ENISA in the EU in 2025, by targeted sector (top ten), %
¹ Share of 8,257 incidents recorded by ENISA from 1 January to 31 December 2025, mainly from open sources and anonymised information shared by Member States. The categories 'Other' (4.9%) and 'Unknown' (4.5%) are excluded from the ranking. ² Digital infrastructure as defined in NIS2, including public electronic communications networks and services, cloud computing, data centre services, internet exchange points and DNS. ³ Energy as defined in NIS2: electricity, district heating and cooling, oil, gas and hydrogen. Drinking water (0.3%) and waste water (0.0%) fall outside the top ten.
Source: ENISA, ENISA Threat Landscape 2026, September 2026
View data table
| Category | Value | Group |
|---|---|---|
| Public administration¹ | 31.8% | 2 |
| Business services | 8.5% | 2 |
| Transport | 8.0% | 1 |
| Manufacturing | 6.9% | 2 |
| Finance and banking | 5.6% | 2 |
| Civil society | 5.1% | 2 |
| Digital infrastructure² | 4.7% | 1 |
| Energy³ | 4.2% | 1 |
| Digital providers | 3.9% | 2 |
| Education | 2.9% | 2 |
Group 1: Critical infrastructure operators. Group 2: Other sectors. Unit: %.
Opportunities
Transport ranks third at 8.0%, digital infrastructure has 4.7% and energy 4.2%. In Member State NIS2 reporting for 2025, digital infrastructure had 12% and transport 8% of events. ENISA also records a coordinated wiper attack on the energy sector in December 2025. AI connected to operational networks must be secure by design.
- Maintenance knowledge search Engineers ask manuals and fault histories questions in plain language and get answers that cite the source. These documents detail critical assets, so the model should run in-house.
- Grid and capacity planning Models summarise connection requests, planning scenarios and investment papers. Topology and capacity data are sensitive, so this work belongs on the operator's own infrastructure.
- Incident and compliance reporting AI drafts early warnings, incident notifications and regulator reports from logs for staff to review. NIS2 allows 24 hours for the early warning. An in-house model keeps incident details inside.
- Customer and outage communication AI drafts customer replies and outage updates for staff to check. An in-house or European cloud model keeps that data out of non-EU jurisdictions.
Frequently asked questions
-
The main frameworks are:
- NIS2: Energy is a sector of high criticality. In the Netherlands, the Cyberbeveiligingswet applies from 15 August 2026.
- Critical entities resilience: The Dutch Wet weerbaarheid kritieke entiteiten applies from the same date.
- EU AI Act: AI used as a safety component in critical infrastructure is high-risk, with obligations from 2 December 2027.
-
Organisations in this sector most often face three issues:
- New single points of failure: Once control-room staff rely on an AI assistant, it is part of the service. If it runs on one external API, that provider's outage or new terms become an operational risk. NIS2 continuity plans must cover it.
- AI providers as suppliers: NIS2 requires an assessment of each direct supplier's vulnerabilities. For AI, that means the model developer, its host and the model's origin. Every new AI service is one more supplier to assess, document and exit-test.
- Personal board liability: Boards must approve and oversee cybersecurity measures and can be held liable. Member States must allow fines for essential entities of up to at least 10 million euro or 2% of worldwide annual turnover. Directors need to know which AI touches their networks.
- Operational technology separation: Substations, pumping stations and signalling run apart from office IT and the internet. AI that reads their data must respect that boundary, which cloud-only services often cannot. Where AI is a safety component in water, gas, heating or electricity supply, the AI Act makes it high-risk, with obligations from 2 December 2027.
- Grid planning under pressure: Dutch regional grid operators ended 2025 with 15,014 offtake capacity requests waiting, up from 11,922 a year earlier. AI can help planners weigh each request. Topology and capacity data should stay under the operator's control.
-
The use cases with the clearest value are:
- Maintenance knowledge search: Engineers ask manuals and fault histories questions in plain language and get answers that cite the source. These documents detail critical assets, so the model should run in-house.
- Grid and capacity planning: Models summarise connection requests, planning scenarios and investment papers. Topology and capacity data are sensitive, so this work belongs on the operator's own infrastructure.
- Incident and compliance reporting: AI drafts early warnings, incident notifications and regulator reports from logs for staff to review. NIS2 allows 24 hours for the early warning. An in-house model keeps incident details inside.
- Customer and outage communication: AI drafts customer replies and outage updates for staff to check. An in-house or European cloud model keeps that data out of non-EU jurisdictions.
-
Yes. Open-weight models can run on-premise or in a European private cloud, which keeps data and model access under the organisation's control. Whether that is cheaper than an external API depends on sustained volume, and whether it is required depends on data sensitivity and regulation. Lindstead's break-even analysis shows the volume at which own infrastructure pays off.
-
Not by default. Annex III makes AI high-risk when it is a safety component in critical digital infrastructure, road traffic, or water, gas, heating or electricity supply. A safety component directly protects the physical integrity of infrastructure or people's safety. Cybersecurity-only components are excluded. Obligations for qualifying systems apply from 2 December 2027.
-
NIS2 has no AI-specific rules. Significant incidents are reported whatever system is involved: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Critical entities under the CER Directive also notify within 24 hours when an essential service is significantly disrupted.
-
The Cyberbeveiligingswet and the Wet weerbaarheid kritieke entiteiten have applied since 15 August 2026. The first implements NIS2 for more than 8,000 organisations, the second the CER Directive. Organisations must register with the NCSC, manage security risks and report significant incidents. Directors must approve security measures and take training.
Related research
- Where Should Your AI Run? The 2026 European Briefing
- Self-hosting or API: where is the break-even point?
Sources
- EUR-Lex, Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 23, 34 and Annex I, 14 December 2022
- EUR-Lex, Directive (EU) 2022/2557 on the resilience of critical entities (CER), Articles 6, 13 and 15, 14 December 2022
- EUR-Lex, Regulation (EU) 2024/1689 (AI Act), Annex III point 2 and recital 55, 13 June 2024
- European Commission, AI Omnibus enters into force (Regulation (EU) 2026/1744), July 2026
- EUR-Lex, Commission Delegated Regulation (EU) 2024/1366, network code on cybersecurity aspects of cross-border electricity flows, 11 March 2024
- Rijksoverheid, Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf vandaag van kracht, 15 August 2026
- NCSC, Cbw en Wwke nu van kracht, 15 August 2026
- Netbeheer Nederland, Stand van de Uitvoering 2025, April 2026
Discuss the priorities in energy and critical infrastructure.
A 30-minute meeting covers the use case, sector requirements and next step.