Compliance
What the rules actually say.
Charge point operators carry more evidence obligations than anyone else in the charging chain, and a surprising amount of what is written about them is wrong. This is our reading of the primary sources, with links to every one of them, so you can check it yourself.
Last verified 21 August 2026. If you find an error, tell us and we will fix it and say so.
The most common mistake
AFIR does not require 97% uptime. Or 99%. Or any number at all.
Article 5 of Regulation (EU) 2023/1804 is headed "Recharging infrastructure" and contains no availability, uptime or opening-hours obligation. The words "uptime" and "needs of end users" do not appear anywhere in the regulation.
"Operational status" and "Availability" do appear — but as data fields you must publish under Article 20(2), not as performance targets. They are two distinct fields with defined values: operational status is whether the point works, availability is whether it is occupied. A charge point can be operational and in use at the same time.
Uptime commitments on European operators are real. They come from contracts, tenders and municipal concessions — not from AFIR.
What AFIR does require of you
- Static data updated when a change occurs and no later than 24 hours after it occurred. Dynamic data — including operational status — within one minute of the change. Both clocks run from when the change happened, not from when you noticed.
- DATEX II format, at least CEN/TS 16157-10:2022, from 14 April 2026.
- An open API giving free and unrestricted access to that data, registered with your national access point.
- A unique operator ID issued by your Member State's Identification Registration Organisation, and a unique ID per recharging point that contains it.
- Ad hoc charging without a contract, with a card reader or contactless device at points deployed from 13 April 2024. From 1 January 2027 this extends to all points of 50 kW or more on the TEN-T network or in safe and secure parking areas, including points deployed before that date — and QR codes do not satisfy it for that cohort.
- Price per kWh shown at the station before the session starts, at points of 50 kW and above.
- Digital connectivity at all publicly accessible points from 14 October 2024, and smart recharging capability for points built after 13 April 2024 or renovated after 14 October 2024.
Regulation (EU) 2023/1804, Articles 5 and 20 · Commission Implementing Regulation (EU) 2025/655, Articles 1, 2 and 3
There is no record-keeping or audit-trail obligation in the AFIR data rules either. What there is: a duty to run data quality control mechanisms at source, and to monitor for inconsistencies and errors.
Where uptime is actually mandated
Three regimes have a number. Europe is not one of them.
| Regime | Number | Measured per | What is excluded |
|---|---|---|---|
| EU — AFIR | None | — | Not applicable. No numeric requirement exists. |
| UK — Public Charge Point Regulations 2023, reg. 7 | 99% | Network average across all of one operator's rapid points of 50 kW and above, per calendar year | Restricted-hours points assessed only during those hours. Statuses unknown and blocked count as reliable. Only inoperative and out of order count against you. |
| US — NEVI, 23 CFR § 680.116(b) | Greater than 97% | Each charging port, calculated monthly across the previous twelve months | Utility outages, vehicle-side faults, scheduled maintenance, vandalism, natural disasters, and hours outside operating hours — but only where the operator can demonstrate the port would otherwise have been operational. |
| California — CEC reliability regulations | 97% | Each charging port, per calendar year, for the first six years | Grid loss with utility documentation, planned maintenance capped at 72 hours per 12 months, vandalism capped at 10 days per incident with a police report, natural disasters, communication outages only if the charger defaults to free, and operating hours. Payment system failures and physical damage are not excluded. |
The UK figure is a network average, so a persistently broken site is diluted by a healthy fleet. Breaching it costs up to £10,000 for the whole network — while a helpline or reporting failure costs up to £10,000 per charge point.
The UK annual report must state the reliability of each individual charge point, its location, and the time spent in each status over the year. That is the real data burden, not the 99%.
NEVI's exclusion for faults "due to the fault of the vehicle" is where interoperability failures live — which is why a network can report 97% while a driver's session fails.
SI 2023/1168 reg. 7 and 8 · 23 CFR § 680.116 · California Code of Regulations Title 20
NIS2
You are not caught by NIS2 by accident. You are listed in Annex I.
"Operators of a recharging point that are responsible for the management and operation of a recharging point, which provides a recharging service to end users, including in the name and on behalf of a mobility service provider"
Directive (EU) 2022/2555, Annex I, sector 1 Energy, subsector (a) Electricity
Essential or important
A charge point operator that exceeds the medium-sized enterprise ceilings — more than 250 staff, or turnover above €50m together with a balance sheet above €43m — is an essential entity. One that merely qualifies as medium-sized is an important entity. Essential entities face supervision before anything has gone wrong; important entities only after.
The scoping trap
Scope follows the size criteria, not the megawatts you manage. The Dutch government confirmed this explicitly when operators asked, and has asked the European Commission to change it. If you are a small subsidiary of a large group, the linked-enterprise rules consolidate group headcount and turnover — which is how a forty-person operator becomes an essential entity.
The physical edge is in scope
Article 21(2) requires an all-hazards approach that protects network and information systems "and the physical environment of those systems". A charger is a network and information system standing on a pavement, maintained by a subcontractor. That is a NIS2 problem, not just an electrical one.
Reporting
Early warning within 24 hours. Incident notification within 72 hours. Final report within one month of the notification — including the root cause.
Accountability
Management bodies approve the measures, oversee implementation, and can be held liable. Board training is mandatory, not encouraged.
Fines
Up to at least €10m or 2% of worldwide group turnover for essential entities, whichever is higher. €7m or 1.4% for important entities.
One large exception
France has not transposed NIS2. The transposition deadline was 17 October 2024; the French bill is still in first reading, and the decree that will name the entity types in scope has not been published. If you operate in France, the obligations above are not yet enforceable there — but the directive's own annex still names you, and the decree will presumably mirror it.
Directive (EU) 2022/2555, Articles 2, 3, 20, 21, 23, 32 and 34
Being straight about this
Ampsflow is an evidence layer, not a cybersecurity control.
A NIS2 programme is mostly IT and OT security work. A field-operations record helps with a specific, narrow part of it — the physical and configuration edge, which is the part nobody has records for. Here is exactly where the line falls.
Where it genuinely helps
Supply chain — Article 21(2)(d)
The question is never whether you have supplier security clauses. It is how you know they were honoured on four thousand chargers. A per-visit, per-subcontractor record is one of the few objective answers.
Asset management — Article 21(2)(i)
Asset management is named outright as a required measure. Identifier, location, type, configuration, in-service date, end of life — captured as the work happens rather than reconstructed in a spreadsheet.
Remediation evidence — Article 21(2)(e)
When a charger vulnerability lands, the two questions are how many affected units you have and where, and proof they are all patched. A per-asset change history answers both. It does not find the vulnerability.
The reporting clock — Article 23
What changed, when, by whom, and which other sites received the same treatment. That last question is what turns a single-site incident into a fleet-wide severity assessment, inside 72 hours.
Where it does nothing
Detection. Ampsflow will never tell you an incident is happening.
Network monitoring, SIEM, intrusion detection, endpoint security.
Cryptography, key management and certificate lifecycle — Article 21(2)(h).
Multi-factor authentication and secured communications — Article 21(2)(j).
Business continuity, backup and disaster recovery — Article 21(2)(c).
Vulnerability scanning, penetration testing and coordinated disclosure. Your corporate IT estate. Your CSMS.
Three of the ten Article 21(2) measures, with any strength. We would rather tell you that than have your security lead find out.
Netherlands
Four separate regimes, and only one of them is about cyber.
Cyberbeveiligingswet
In force since 15 August 2026. Charge point operators are an entity type in the energy annex, using the statutory term exploitant van een laadpunt. The supervisor for electricity is the RDI; the CSIRT is NCSC-NL. Registration in the national entity register via Mijn.NCSC.nl is mandatory from the date the act took effect — no grace period is published. An incident is reportable when it affects, or could affect, at least 100 MW of aggregated available capacity. That is the reporting threshold. It is not the scoping threshold — whether you are in scope at all depends on your size, not your megawatts.
NEN 1010 at handover
The Besluit bouwwerken leefomgeving points at NEN 1010 for electrical installations, and specifically requires charge points in vehicle-storage functions to meet Mode 3 or Mode 4 as described in NEN 1010. Meeting the standard gives presumption of conformity with the legal requirement — it is not itself the statute. Inspection and testing at completion is part of the standard.
NEN 3140 and the interval myth
NEN 3140 does not set a one-to-five-year inspection interval. It requires the appointed installatieverantwoordelijke to determine and record the frequency from a risk assessment. Inspection companies quote one to five years as a typical outcome of that assessment, not as a legal rule. The underlying duty sits in the Arbobesluit, which requires work equipment to be inspected as often as necessary and written evidence of those inspections to be available at the workplace and produced to the inspector on request.
Metering
The kWh meter used to bill a driver must be MID-conform: conformity assessment, CE marking with the supplementary metrology marking and notified body number, and an EU declaration of conformity. The RDI supervises this under the Metrologiewet and states explicitly that meters used in charge points to settle energy fall under it. The Netherlands has not introduced an EV-specific calibration regime like the German Eichrecht — there is no Dutch requirement for cryptographically signed session records or a transparency app.
A correction worth making
SCIOS Scope 12 is photovoltaic installations, not EV charging. There is no EV-specific SCIOS scope. Charge points are inspected under Scope 8 as an electrical installation, Scope 9 where they are treated as electrical work equipment, and Scope 10 where the driver is fire risk under NTA 8220. SCIOS is a private certification scheme, not a legal requirement — but it is frequently a contractual and insurance one.
Stb. 2026, 187 · Stcrt. 2026, 22078 · Besluit bouwwerken leefomgeving art. 4.199 · Arbobesluit art. 3.4, 3.5 and 7.4a · Metrologiewet · scios.nl
Germany
Eichrecht is the strictest evidence regime in European charging.
And unlike most of this page, it is being actively enforced.
What it demands
Not just a certified meter. The charging device and its ancillary equipment are themselves subject to conformity assessment. Measurement datasets must be cryptographically signed at the point of measurement, and the customer must be able to re-verify their bill using transparency software that has been validated by the notified body — the admissible software is fixed in each device's type-examination certificate, not chosen by the operator.
The clock
The verification period for meters and ancillary equipment at charge points is eight years, for both AC and DC. It expires on 31 December of the year in which it falls due, not on the anniversary. It also ends early if seals are broken, markings become illegible, or anything is changed that affects metrological properties — which is what makes a cable replacement or a post-vandalism repair a re-verification event.
The records — this is the one that matters most for us
MessEG § 31(2) Nr. 4 requires evidence of every maintenance action, repair or other intervention on the measuring device — expressly including interventions performed electronically — to be kept until three months after the verification period expires, and for at most five years. Note what that covers: a remote firmware update or a configuration change is an intervention you must be able to evidence, years later, per device.
One thing that changed: the § 32 MessEG duty to notify the verification authority when putting a meter into use was abolished with effect from 1 January 2025. The verification and application rules were not affected. If your process still includes a notification step, it is doing work nobody requires.
Enforcement is live. The Bavarian metrology authority announced in August 2025 that it would stop refraining from action and would begin challenging and penalising non-compliant charging stations used commercially. Fines under MessEG § 60 run to €50,000 in the most serious categories and €20,000 otherwise.
NIS2 in Germany
The German implementation came into force on 6 December 2025, with registration due by 6 March 2026. Charge point operators appear in the BSIG annex as Ladepunktbetreiber nach § 2 Nummer 8 LSV. Registration and incident reporting run through the BSI, but energy-sector security requirements are set by the Bundesnetzagentur in agreement with the BSI — so a CPO deals with both.
MessEG §§ 6, 31, 33, 37, 60 · MessEV Anlage 7 section 6.7 · PTB · Bayerisches Landesamt für Maß und Gewicht · BSIG Anlage 1
France
The most prescriptive rules in Europe. And no NIS2 yet.
France regulates the physical work harder than any other market on this page, and has not transposed the cybersecurity directive at all.
Qualified hands, installing and maintaining
Every publicly accessible charge point in France must be installed by a professional holding an IRVE qualification. There is no power threshold — the exemption only reaches private residential installations at or below 3.7 kW that are not open to the public. Article D. 353-2 extends the same requirement to maintenance work. That is the half most operators miss: the person who services the charger needs a current qualification too, and you need to be able to show which one.
Inspected every year, with the proof on the charger
Article 24 of décret 2017-26: every publicly accessible charge point is inspected at least once a year by a competent person or body. A marking giving the date of the inspection and identifying who carried it out is fixed to the equipment, visible to the public. Nothing like it exists in the Netherlands, Germany or the UK.
Consuel before you energise
A conformity attestation, submitted for visa to CONSUEL, is required above 36 kW, at any power in collective residential buildings, and again whenever a power uprate crosses 36 kW — so converting an AC site to DC re-triggers it. It must reach the approving body at least twenty days before the planned energisation date. Where there are several installers, each writes the attestation for the portion of the works they carried out.
Roaming you cannot refuse
Article R. 353-4-3 obliges the operator of a supervised public site to grant roaming access to any e-mobility service provider that requests it. Not permit — grant. Connecting to an interoperability platform satisfies it. Failing to offer ad hoc charging, and failing to publish your charge point data, each carry an administrative fine of up to €300 per charge point.
Publish what you promise, then what you achieved
Quality-of-service commitments across four defined themes, published openly. Then at least once a year, a report giving the measured availability rate, the successful-session rate, and the method used to measure them. There is no numeric uptime target in French law. Your own published figures become the benchmark instead.
NIS2: not yet
France has not transposed NIS2. The bill is still in first reading, and the decree that will determine which entity types fall in scope has not been published. Charge point operators are not mentioned anywhere in the current text. That is a gap, not an exemption. The transposition deadline passed in October 2024.
Check your data pipeline
Since 27 March 2026, what a French operator must publish is defined by direct reference to AFIR Article 20(2)(a) and (b). The arrêté du 4 mai 2021 that set the old national data list and the one-month publication deadline was abrogated. If your pipeline still targets the old national schema, it is publishing to a specification that no longer exists. Separately: since August 2024 French operator and charge point identifiers are issued by AVERE-France, not AFIREV.
France is the only country on this page whose law already separates availability from successful sessions. Its own industry observatory put the successful-session rate at 85.5% for 2023.
Décret n° 2017-26 arts. 11, 23, 24, 24-2 · Code de l'énergie D. 353-2, R. 353-4-2 to R. 353-4-5, D. 342-20 · Arrêté du 27 octobre 2021 · Arrêté du 24 mars 2026 · Code du travail R. 4226-14 to R. 4226-21
The part that actually bites
Your concession asks for more than the law does.
Dutch municipal concessions and NAL-region tenders are built on a shared template. These requirements recur almost verbatim across them.
A named installatieverantwoordelijke — The concession holder must appoint one, as defined in NEN 3140. Not a policy — a named person, per concession.
A successful Site Acceptance Test per charge point — After placement, before the point counts as delivered. FAT documentation and the technical description are delivered too.
Metering in accordance with the Metrologiewet — Stated explicitly, separately from the general legal duty.
99% availability, measured monthly, reported weekly — This is where a European uptime number comes from. Not AFIR.
Session data in OCPI CDR format — The data model is specified in the tender, not left to the operator.
The as-built dossier, on transfer — At the end of a concession the operator hands the incoming manager photographs, delivery documents, digital drawings and certificates. If those were never captured properly, this is the clause that finds out.
The end-of-concession transfer clause is the reason the commissioning record has commercial value, not just regulatory value. It is the moment somebody checks whether the paperwork ever existed.
NKL Nederland, Basisset AC-laadinfrastructuur: Programma van eisen · Gemeente Leeuwarden concession, Programma van Eisen bijlage PVE-I
Check all of it.
Every claim on this page links to the primary source. If you find something wrong, tell us — we will correct it and note the correction.
European Union
Netherlands
Germany and United Kingdom
This page is a summary of published law and standards, written by an operations software company. It is not legal advice, it is not exhaustive, and regulations change. Verify against the primary sources before you rely on any of it — the links are right there.
Ampsflow does not make you compliant. It makes the evidence exist before anyone asks for it. See how that works →