Critical National Infrastructure Designation Rules

Detailed Explanation With Case Laws

1. Introduction

Critical National Infrastructure (CNI) Designation Rules are legal rules used by governments to identify infrastructure whose disruption, destruction or failure could cause serious harm to national security, public safety, economic activity or essential public services.

Electricity infrastructure is a major example of CNI. It can include:

power stations;

transmission networks;

distribution networks;

substations;

control centres;

interconnectors;

electricity-storage facilities; and

important digital systems supporting electricity operations.

Designation is important because once infrastructure is classified as critical, additional security, resilience, reporting, investment and emergency-planning obligations may apply.

2. Meaning of CNI Designation

Designation means that a government formally identifies a particular asset, system, service or category of infrastructure as strategically important.

A simple model is:

Identify risk → establish criteria → designate infrastructure → impose duties → monitor compliance → review designation

Designation is therefore more than simply giving an asset a special name. It creates a legal and regulatory relationship between the infrastructure operator and the state.

3. Why Designation Is Necessary

Modern society depends heavily on infrastructure.

Failure of an electricity network can affect:

hospitals;

water systems;

telecommunications;

transport;

banking;

businesses;

emergency services; and

households.

Electricity infrastructure can also have cascading effects. A failure in one system may cause problems in other critical sectors.

For this reason, designation frameworks generally consider both the importance of the individual asset and its interdependencies with other infrastructure.

4. UK Critical National Infrastructure Framework

The UK has a long-established CNI framework.

The UK Government identifies 13 national infrastructure sectors, including:

energy;

communications;

transport;

water;

health;

finance; and

government.

Energy infrastructure is therefore recognised as part of the UK's national critical infrastructure framework.

The National Security and Investment Act 2021 also provides a separate framework for reviewing certain acquisitions involving sensitive sectors where national-security risks may arise.

5. Electricity as Critical Infrastructure

Electricity is generally treated as critical because almost every other essential service depends upon it.

Important electricity assets may include:

Generation

Power stations and other significant generation facilities.

Transmission

High-voltage networks transporting electricity over long distances.

Distribution

Networks delivering electricity to consumers.

Control Systems

Systems used to monitor and operate electricity networks.

Interconnectors

Infrastructure connecting different electricity systems.

Storage

Large battery or other storage facilities supporting system stability.

Designation may focus on an entire network rather than only one physical asset.

6. Criteria for Designation

A designation framework may consider several factors.

1. Essentiality

How important is the infrastructure to society?

2. Scale of Impact

How many people or businesses could be affected by failure?

3. Duration

How long would disruption last?

4. Geographic Impact

Would the consequences be local, regional or national?

5. Interdependency

Would failure disrupt other critical services?

6. Substitutability

Can another infrastructure system replace it?

7. Security Risk

Could hostile actors exploit the infrastructure?

These factors help governments distinguish genuinely critical assets from ordinary infrastructure.

7. Designation and Electricity Regulation

Designation can create additional duties for electricity operators.

These may include:

security plans;

emergency-response plans;

cyber-risk management;

incident reporting;

resilience testing;

business-continuity planning;

physical security;

supply-chain security; and

cooperation with government authorities.

Thus:

CNI designation → enhanced regulatory obligations.

8. Cybersecurity

Modern electricity infrastructure is increasingly digital.

Electricity operators use:

SCADA systems;

automated control systems;

digital substations;

communication networks;

remote monitoring; and

data-management platforms.

A cyberattack can therefore create consequences similar to physical damage.

CNI designation may consequently require stronger:

access controls;

network security;

incident detection;

backup systems;

encryption;

recovery arrangements; and

cyber-incident reporting.

9. Physical Security

Designation may also result in physical-security requirements.

These can include:

perimeter protection;

access control;

surveillance;

security personnel;

emergency communications;

protected control centres; and

backup facilities.

The level of protection should depend on the consequences of failure.

10. Supply-Chain Security

Critical infrastructure does not operate independently of external suppliers.

Electricity operators may depend on suppliers for:

transformers;

cables;

circuit breakers;

software;

telecommunications;

spare parts; and

control-system equipment.

Therefore, CNI regulation increasingly considers third-party and supply-chain risks.

A cyberattack or disruption affecting a key supplier could indirectly affect electricity infrastructure.

11. Case Law: R (National Farmers' Union) v Secretary of State

A useful public-law principle can be found in R (National Farmers' Union) v Secretary of State for Environment, Food and Rural Affairs [2003] EWHC 1090 (Admin).

The case concerned government emergency measures in response to risks affecting the agricultural sector.

Although not an electricity CNI case, it demonstrates the importance of government emergency powers, statutory authority and proportionality when responding to serious risks.

Relevance

CNI designation and emergency regulation may involve significant restrictions on private operators.

Therefore, government action should have:

proper legal authority;

rational criteria;

procedural safeguards; and

appropriate review mechanisms.

12. Case Law: R (Miller) v Secretary of State

R (Miller) v Secretary of State for Exiting the European Union [2017] UKSC 5 is not a CNI case, but it provides an important constitutional principle.

The Supreme Court emphasised the importance of Parliamentary authority where government action affects legal rights and domestic law.

Relevance

Where CNI designation creates significant legal obligations for private companies, the government should have a clear statutory basis for those obligations.

This supports the principle that critical-infrastructure regulation should operate within established constitutional and administrative-law structures.

13. Foreign Ownership and CNI

Foreign ownership can become relevant where a foreign investor seeks control over designated critical infrastructure.

The UK National Security and Investment Act 2021 provides a framework under which acquisitions in sensitive sectors can be scrutinised for national-security risks. (gov.uk)

The framework can therefore operate alongside CNI designation.

The legal question is not simply:

Who owns the company?

It can also involve:

What asset is being acquired? + What control is obtained? + What national-security risk could result?

14. EU Critical Infrastructure Framework

The EU has strengthened its critical-entity resilience framework through the Critical Entities Resilience Directive (EU) 2022/2557.

The Directive covers sectors including energy, transport, banking, digital infrastructure, drinking water and health.

Member States must identify critical entities and establish measures to strengthen their resilience against various risks.

These can include:

natural disasters;

terrorism;

insider threats;

public-health emergencies; and

other disruptive events.

This demonstrates the movement from simply identifying critical infrastructure toward requiring resilience capabilities.

15. Designation and Emergency Planning

Once infrastructure is designated as critical, emergency planning becomes particularly important.

Operators may need to prepare for:

blackouts;

cyberattacks;

terrorism;

extreme weather;

equipment failure;

fuel shortages;

supply-chain disruption; and

physical attacks.

Plans may include:

Prevention → Detection → Response → Continuity → Restoration

The aim is not to guarantee that failure will never occur, but to reduce its consequences.

16. Interdependency

A major feature of CNI law is interdependency.

For example:

Electricity → telecommunications

Electricity → water pumping

Electricity → hospitals

Telecommunications → electricity control systems

This creates a circular relationship in which one infrastructure sector may depend on another.

Designation rules should therefore examine system-wide risk, not just individual assets.

17. Review and Reclassification

Critical infrastructure designation should not remain permanent without review.

An asset may become more or less critical because of:

technological change;

network expansion;

new interconnections;

changes in population;

replacement infrastructure;

cyber threats; or

changing geopolitical conditions.

Therefore, good legislation should provide for:

periodic review;

updating of designation lists;

operator consultation;

government reassessment; and

removal of designation where appropriate.

18. Legal Principles

CNI designation should follow several principles.

Clear Criteria

Operators should understand why an asset is designated.

Proportionality

Security obligations should correspond to the level of risk.

Transparency

The legal framework should be transparent, while sensitive security information may remain confidential.

Accountability

Designating authorities should be subject to appropriate oversight.

Risk-Based Regulation

Protection should focus on consequences and vulnerabilities.

Cooperation

Government and infrastructure operators should share relevant information.

19. Conclusion

Critical National Infrastructure Designation Rules provide the legal foundation for identifying infrastructure that is essential to national security, public safety and economic continuity.

In electricity systems, designation may cover generation, transmission, distribution, control systems, storage and other strategically important assets. Once designated, operators may face enhanced obligations concerning cybersecurity, physical security, incident reporting, emergency planning, resilience and supply-chain management.

The UK's CNI framework and National Security and Investment Act 2021 demonstrate how infrastructure protection can be connected with national-security regulation. The EU's Critical Entities Resilience Directive similarly moves beyond simple designation toward systematic resilience obligations.

Cases such as R (Miller) demonstrate the importance of proper legal authority when government action affects legal rights, while emergency-law cases illustrate the importance of lawful and proportionate government intervention.

The central principle is that designation should be based on objective risk and the consequences of infrastructure failure, rather than simply on the size or ownership of an asset. A strong CNI framework therefore combines clear designation criteria, enhanced security duties, resilience planning, regulatory oversight and periodic review to protect electricity systems and the wider society that depends upon them.