Wwke and the energy sector — what designation means for energy operators

Why energy sits inside the Wwke

The Wwke — the Dutch implementation of the EU CER-richtlijn — names energy among its designated sectors, alongside transport, drinking water, digital infrastructure and others. Roughly 500 Dutch organisations are expected to fall under the law across all sectors. For energy, the logic is direct: electricity and gas are the dependency underneath every other essential service, and the threat picture the Dutch government itself describes has put energy infrastructure in scope — unidentified drones were observed over Dutch and Belgian ports and energy infrastructure through the past winter, against a national terrorism threat level of 4 of 5 (substantieel).

The obligations that bite hardest for energy operators

The statutory duties are the same for every critical entity — risk assessment, resilience measures, incident reporting, ongoing accountability. What makes energy demanding is the asset base they land on:

• Dispersed, unmanned sites — substations, transformer stations, compression and distribution points. Access control and physical protection must work without a person on the gate, which pushes the measure set toward hardening, detection and verified response.
• A nine-month risk assessment across many locations — the all-hazards assessment must cover deliberate physical threats, sabotage, insider action, natural hazards and dependencies for the full estate, not a headquarters sample.
• The 24-hour reporting duty presupposes detection — an operator cannot report an intrusion it never saw. Surveillance coverage and alarm verification at remote sites become compliance infrastructure, not optional extras.
• Contractor and personnel reliability — maintenance chains reach deep into critical installations; personnel security and screening posture sit inside the legal obligation.
• Aerial exposure — the drone observations over energy infrastructure make counter-UAS assessment part of a defensible all-hazards picture for this sector.

The compliance window, in sequence

The clock starts at notification of designation: nine months to a completed risk assessment, ten months to proportionate measures. The assessment gates everything — it determines which sites need hardening, where detection is thin, and what the incident thresholds are. Energy operators who expect designation gain the most by building the assessment before the letter arrives: the all-hazards risk assessment is the schedule-critical item, and a strong one converts the ten-month measures deadline into an ordered work plan instead of a scramble.

What to do now

Start from the estate: map essential services to the sites and people they depend on, assess to the all-hazards standard, and prioritise measures the board can fund. Mission Support supports energy operators with threat-led physical security assessment and protective design and counter-drone exposure assessment, delivered by operators with governmental and defence backgrounds. For the regime as a whole, start with our explainer on the Wwke critical-entities regime.

Last reviewed: 25 August 2026. Orientation summary, not legal advice — the statutory text and your competent authority's guidance govern.