Table of Contents
Since 1 April 2026, buildings in Flanders with an annual offtake of more than one gigawatt-hour have been required to have solar panels. For public buildings, that threshold sits at 250 megawatt-hours. The Flemish administration estimates that this first deadline covers around three thousand supply points. Thousands of companies therefore put panels on their roof, reassured about their energy bill.
What installers rarely mention: in the eyes of the Belgian NIS2 Act, that installation may well turn you into an electricity producer. And electricity producers fall under the NIS2 Act, which means registering with the Centre for Cybersecurity Belgium (CCB) and taking on obligations that apply to your entire organisation.
That comes as a surprise for many companies. The CCB has since expressly confirmed this reading of the NIS2 Act. Below you will find out when the Act applies to you, which three questions settle that, and what is then expected of you in practice.
Key takeaways
- Grid-connected solar panels that you own and operate yourself make your organisation an electricity producer under NIS2, even where you consume everything yourself.
- Three factual questions settle the answer: ownership, operation and injection into the grid. The answer is in your contracts.
- If the Act applies to you, registration, incident reporting and measures remain mandatory, but the CCB accepts CyFun Basic as proportionate.
- Your solar installation then also becomes a link in your supply chain, with contractual consequences for remote access.
- The planned 1 MW threshold will arrive in 2028 at the earliest.
Why solar panels bring you closer to NIS2
The sector your business operates in is one of the factors that determines whether the NIS2 Act applies. Annex I to the Belgian NIS2 Act lists the sectors where an incident has the most serious consequences, and energy is on that list. Within that sector, the Act covers “producers” as defined by the European Electricity Directive: any natural or legal person generating electricity.
That definition contains no capacity threshold and no market criterion, and solar generation may be entirely incidental to what your business actually does. If you own and operate grid-connected panels, you generate electricity and you are therefore a producer. Even when you consume every kilowatt-hour yourself.
NIS2 doesn’t look at your roof, but at your entity as a whole. A logistics operator with panels on its distribution centre becomes a NIS2 entity as an organisation and has to comply with NIS2.
One criterion keeps most smaller companies outside the scope of the NIS2 Act: the size of your business. The Act only applies from medium-sized enterprises onwards, so from 50 employees, or where your annual turnover and balance sheet total both exceed 10 million euros. Those figures do have to be calculated on a consolidated basis, including partner and linked enterprises. That is where things most often go wrong in practice, because a modest company within a larger group reaches the threshold faster than its own balance sheet would suggest at first glance.
Why the legislator is looking at solar installations
The rationale behind this rule becomes clear as soon as you look at the inverter rather than the panel. Inverters are connected to the internet, receive updates remotely and are often controlled through a manufacturer’s cloud platform.
Scale makes the difference. A risk analysis carried out by DNV for SolarPower Europe in April 2025 found that each of seven inverter manufacturers can remotely control more than 10 gigawatts of installed capacity. Compromise one such manufacturer’s systems and you reach a substantial share of European generating capacity in a single move. Security researchers at Forescout separately mapped 35,000 devices in solar installations worldwide with a management interface directly accessible over the internet.
On its own, your installation poses no risk to the grid. Together, however, these installations form a decentralised generating capacity that someone, with good or bad intentions, could control from a single point. We also read this as the explanation for the line the CCB draws: the CCB locates the risk in what happens towards the grid, and therefore in the question of whether you inject electricity. What you consume yourself plays no part in that.
Three questions settle the answer
The CCB has set out five scenarios in its FAQ. They come down to three factual questions.
Do you own the installation? If a third party’s panels sit on your roof, through a lease or an energy services company for instance, then you are not a producer yourself. Not even where you take all the electricity generated. You are then an offtaker and the NIS2 Act does not apply to you, at least not because of these solar panels.
Do you operate the solar panels? Ownership and operation of solar panels do not always coincide. In a financing arrangement where a third party owns the installation but you manage it, it is unsettled which party the Act catches. So ask your energy services provider explicitly whether it regards itself as a producer and whether it has registered.
Does the installation inject into the grid? If you feed nothing back, the CCB considers you outside the Act. But note the nuance: the scenario in which you consume all the electricity yourself and are nevertheless connected to the grid does fall within it. The difference between those two situations is technically small but legally significant. Various authors accordingly question that reading. We see a further point of concern. An export limitation is not a physical disconnection but a setting in your inverter. Anyone taking over that inverter, with good or bad intentions, can lift the limitation, while the grid connection and the associated risk to the electricity grid simply remain in place. Only an installation that is not connected to the grid at all, running off-grid, eliminates the risk, and that is not a realistic choice for most companies. The CCB moreover does not currently clarify how you are to implement or demonstrate that absence of injection. If you rely on this interpretation, it is important to document carefully how your installation is configured and secured so as to exclude the risk.
The answer to those three questions is usually in contracts that often no one has opened since the installation was put in place. But that answer does matter in determining whether your company falls under the NIS2 Act because of its solar panels.
Charging points and batteries follow their own rules
Charging points have a separate entry in Annex I. It requires you to manage and operate the charging point and to provide a charging service to end users. In practice that management often sits contractually with a third party, even where the charging points carry your logo.
Batteries fall under the entry for market participants providing energy storage services. Mere storage behind the meter for your own use is not a service provided to the market. That reasoning is well arguable, although the CCB has not expressly confirmed it at the time of writing. If you do deploy your battery on the flexibility market, you are providing a service and the analysis changes.
What if your solar panels bring you within NIS2?
Here comes the good news. The CCB recognises that self-consumers are not the highly critical entities for which the energy provisions were written, and points to the limited societal and economic impact of self-generation. It therefore applies lighter supervision. This assumes, of course, that the company falls under the NIS2 Act purely because of its solar installation and is not active in other NIS2 sectors.
Lighter supervision does not, however, mean exemption from NIS2 obligations and supervision. You register with the CCB, you report significant incidents and you take cybersecurity measures. But the CCB accepts a lower level of the CyberFundamentals framework as proportionate. CyFun Basic contains 34 controls, and according to the CCB that level covers around 82% of the attack types in the CERT.be threat profiles. You are probably already doing many of those measures, without having documented them.
Your size then determines your NIS2 category and the type of supervision. Because energy sits in Annex I, a sufficiently large company becomes an essential entity, even where its core activity would attract a lighter regime. That means proactive supervision rather than checks after an incident.
Your installation also becomes part of your own supply chain. If the Act applies to you, you have to manage your suppliers’ risk, and your solar installation belongs in that exercise from then on. Who gets remote access to your inverters, where does the monitoring platform run, and what happens when the manufacturer reports a vulnerability? These are contractual questions, and you are best placed to ask them before you sign with your installer.
And what if you are only now discovering that the Act applies to you? The general registration deadline expired in March 2025, and the first compliance deadline passed on 18 April 2026. Waiting will not improve matters. Register, and document when and why you came within scope. The CCB’s primary aim is a high level of cyber resilience, but sanctions do serve as a deterrent here. Companies unable to show that they have done their homework, or are in the process of doing it, are in a weak position during an inspection and expose themselves to possible sanctions such as a fine or a temporary ban on managing the company.
A 1 MW threshold is in the pipeline
The European legislator is considering adjusting this broad definition. On 20 January 2026 the Commission proposed targeted amendments to NIS2, alongside a revision of the Cybersecurity Act. Under that proposal, producers with a total generating capacity of up to 1 MW fall outside the scope.
That would take most roofs out of the Act. At the statutory minimum of 12.5 watt-peak per square metre, you need roughly 80,000 square metres of roof surface to reach 1 MW.
The catch: that threshold does not apply yet. The Commission is aiming for political agreement in early 2027, after which Member States have a further year to transpose the amendment. So count on 2028 at the earliest. If you are planning a large installation now, it may be worth factoring this development into your planning. If your installation is already in place, today’s rules are the ones that apply.
What this means for your organisation
Concretely, we recommend the following:
- Map out your situation: who owns and operates your installation, and does it inject into the grid? Dig out the contracts with your installer or energy services provider and look for the answers. Align with them where necessary.
- Calculate your size correctly, so on a consolidated basis. The medium-sized threshold is the first and most important filter.
- Treat charging points and batteries as separate questions with their own analysis, even where everything was installed in a single project.
- Does NIS2 apply to you? Register with the CCB, consider CyFun Basic as a proportionate framework and involve your management body, because the Act places responsibility squarely there.
Unsure about your qualification? A short preliminary legal analysis costs a fraction of what a wrong assessment costs later on. You can read how to approach such an analysis in our earlier blog post on the legal analysis of NIS2.
Conclusion
Solar panels on your roof do not automatically bring you within the NIS2 Act. Three questions settle the answer: do you own the installation, do you operate it, and does it inject into the grid? If you stay below the size threshold, the analysis stops there. If you do fall within scope, registration, incident reporting and measures await you, but the CCB accepts a proportionate level.
Even so, the question deserves a considered answer. Since April 2026, thousands of Flemish companies have installed panels because they had to. For some of them, that also changed their status under the NIS2 Act, without anyone telling them.
