AI answer written only from the numbered passages below
Both regimes can apply at the same time. Energy operators that use AI to manage or operate parts of critical infrastructure, such as grid balancing, can trigger the EU AI Act's high-risk category (Annex III, critical infrastructure) in addition to their NIS2 duties as an essential entity 1. The functional test for AI Act scope is whether the system co-determines whether supply stays safe and reliable, rather than merely supporting human planning after the fact 1. NIS2 requires appropriate technical and organisational measures across the whole entity (Art. 21), including supply-chain security, while the AI Act requires accuracy, robustness and cybersecurity for specific high-risk systems (Art. 15) 2. An attack that manipulates or poisons a grid-control AI model is at once an AI Act robustness failure and a NIS2 security incident, which is why operators are advised to fold AI risk management into the same NIS2 governance structure instead of two separate compliance tracks 2.
Not in the sources: The passages do not set out deadlines, thresholds or the specific registration or reporting steps for either regime.
Cited passages
Passage 1: Two overlapping regimes
Energy operators that use AI to manage or operate parts of critical infrastructure — grid balancing, smart-grid control, security-of-supply forecasting that feeds real-time decisions — can trigger the EU AI Act's high-risk category (Annex III, critical infrastructure) in addition to their NIS2 duties as an essential entity. The practical test for AI Act scope is functional: does the system co-determine whether supply stays safe and reliable, rather than merely support human planning after the fact?
Where NIS2 and the AI Act meet in the energy sectorAdapted from trusq's 'AI in energy: critical infrastructure and NIS2' explainer · eur-lex.europa.eu · retrieved 18 Sep 2026
Passage 2: Where the obligations overlap
NIS2 requires appropriate technical and organisational measures across the whole entity (Art. 21), including supply-chain security; the AI Act requires accuracy, robustness and cybersecurity for specific high-risk systems (Art. 15). An attack that manipulates or poisons a grid-control AI model is simultaneously an AI Act robustness failure and a NIS2 security incident, which is why operators are advised to fold AI risk management into the same NIS2 governance structure rather than running two separate compliance tracks.
Where NIS2 and the AI Act meet in the energy sectorAdapted from trusq's 'AI in energy: critical infrastructure and NIS2' explainer · eur-lex.europa.eu · retrieved 18 Sep 2026
Sources consulted
- Where NIS2 and the AI Act meet in the energy sectorAdapted from trusq's 'AI in energy: critical infrastructure and NIS2' explainer · eur-lex.europa.eu · retrieved 18 Sep 2026 · cited
General information from public sources, not legal advice. Passages are our own-words summaries of the linked publications; follow the link for the authoritative text.