Ice cream producers under special EU protection? New rules cause considerable confusion

New European Union cybersecurity regulations, specifically Directive NIS2, are creating significant confusion across various sectors as businesses grapple with identifying whether they fall under the scope of critical infrastructure protection.

The directive, adopted in 2022 to bolster Europe's resilience against cyberattacks, requires operators in essential sectors to register with national cybersecurity authorities. However, the broad and sometimes ambiguous wording of the directive has led to unexpected interpretations, potentially including businesses like ice cream manufacturers, chewing gum wholesalers, and even Christmas light producers.

According to Politico, technology experts and lawyers are highlighting how a literal application of the rules could ensnare companies not typically associated with critical infrastructure. For instance, the directive covers the production, processing, and distribution of food. While the logic of protecting the food supply chain is clear, the broad categorization could encompass businesses whose disruption would not critically impair societal functioning.

Czech MEP Markéta Gregorová has pointed out such instances, noting that sufficiently large ice cream producers might be included. Similarly, Andreas Daum from the law firm Noerr explained that even large chewing gum wholesalers could be subject to the directive. The confusion is so widespread that a German trade association reportedly had to clarify to its members that artisanal bakeries are not covered by the rules, despite initial concerns.

“

You probably wouldn't need them in a crisis situation.