Navigating energy security and cybersecurity:A comparison of EU and UK policy instruments

Europe's energy transition demands rapid digitalisation of infrastructure, with €170bn earmarked, but this process expands attack surfaces for cyber threats. This research examines how EU and UK cybersecurity policies address (or fail to address) cross-border digitalised energy infrastructure. The objectives are: (1) to map and assess the EU and UK policy instruments governing cybersecurity for cross-border energy infrastructure; (2) to identify jurisdictional gaps, definitional misalignments, and missing provisions, particularly for electricity interconnectors operating across regulatory regimes; and (3) to find legislative and institutional entry points through which those gaps can be addressed. Using structured comparative analysis of 24 EU and UK policy instruments against a nine-question framework, the study finds that no single instrument governs cybersecurity for cross-border energy infrastructure on either side. EU frameworks are extensive but siloed, with no authority holding jurisdiction over cross-border interconnectors. UK energy-specific cybersecurity rules are more fragmented and non-binding. GB-EU interconnectors sit in a governance vacuum, with EU-UK coordination not addressed formally in any of the policy instruments examined (although voluntary industry-level information sharing exists, there is no mandatory regulatory coordination mechanism). The findings point to an urgent need for binding lead-authority mechanisms for interconnectors, formal EU-UK cybersecurity information-sharing, and explicit regulatory designation of cross-border energy infrastructure.