The crucial role of non-combustible roofing in NIS2 compliance and business security

Cyber attacks  … and roof fires?  The EU’s new NIS2 rules demand that critical companies address all risks – including physical ones. Learn how a non-combustible roof coating safeguards facilities and supports NIS2 compliance.

Beyond cyber: NIS2 demands all-round resilience

In the digital era, businesses often fixate on cybersecurity – but the NIS2 Directive reminds us that physical threats to infrastructure are just as critical. NIS2 (EU Directive 2022/2555) adopts an “all-hazards” approach, requiring organizations in essential sectors to protect against a wide range of threats, from cyberattacks to fires and other physical hazards. This means that if you operate a data center, hospital, energy utility, or any NIS2-scope enterprise, you must have robust measures not only against hackers, but also against the likes of building fires, power outages, and other safety risks. Compliance isn’t just about IT – it’s about holistic risk management.

One often overlooked aspect is the vulnerability of combustible roofs, especially those loaded with new technology like solar panels. A rooftop fire can incapacitate a facility just as surely as a cyber incident – destroying critical hardware, halting operations, and endangering lives. Regulators now recognize this; under NIS2, physical risks (including fire) to network and information systems infrastructure must be addressed in security planning.

Roof fires: a growing physical threat with PV expansion

The push for sustainability has led to massive growth in solar PV installations on commercial roofs. Ironically, this green initiative introduces a new fire exposure that many older safety codes didn’t fully consider. A fire on a flat roof with PV panels can behave very differently – spreading faster and further – compared to an empty roof. Combustible roofing materials (e.g. bitumen membranes, EPS insulation) can quickly become involved, feeding a blaze under the array, while panels and mounting hardware may impede firefighting. If not addressed, this altered fire behavior increases the speed, extent, and impact of rooftop fires.

For high-risk sites (data centers, telecom hubs, etc.), a roof fire could be devastating: it might knock out cooling systems, compromise structural integrity, or allow water ingress onto sensitive equipment. NIS2 compliance means these scenarios must be contemplated and mitigated in risk assessments. Insurers and industrial fire experts have for years been recommending enhanced measures for PV roofs – even before laws required it. Typical advice has been to install a non-combustible layer beneath PV modules on any combustible roof. Doing so can dramatically limit fire spread and prevent minor ignition sources from becoming multi-million-euro losses.

Fire-stopping at the roof level – an underused safeguard

One highly effective measure now gaining traction is to ensure the roof itself acts as a fire stop. By using non-combustible roofing materials or coatings (such as AllShield Blue and BarrierSheet), organizations can achieve functional compartmentation on the roof. In essence, if a fire starts on a section of the roof (for example, from an electrical arc in a solar panel), a non-combustible roof surface will contain the fire to that section, instead of letting it race across the facility. This concept parallels the idea of firewall divisions inside a building – but applied horizontally on the roof.

AllShield’s solution epitomizes this strategy: our coating and boards create a thin mineral barrier that fire cannot penetrate or spread across. Large-scale testing by independent institutes has shown that even with a severe ignition under a PV panel, a roof protected by AllShield did not propagate the fire beyond the immediate area. The flames above the coating self-extinguished and, critically, the underlying roof layers never ignited. In effect, the coating acts as a built-in firebreak, satisfying the intent of both NIS2 and insurers’ guidelines for physical resilience.

Compliance, insurance, and business continuity

Adopting a non-combustible roof system can help tick multiple boxes: NIS2 regulatory compliance, insurance eligibility, and overall business continuity planning. Insurers are increasingly mandating non-combustible or Class A roof assemblies for sites with PV or critical operations, and they often require proof of fire mitigation steps as part of coverage for solar installations. A roof upgraded with AllShield Blue meets these expectations – it’s certified Euroclass A1 and has even achieved FM Approval in fire tests, meaning it performs at the highest level under both EU and international standards.

For NIS2 compliance, deploying such physical safeguards demonstrates that your organization has addressed the “fire and structural” component of risk management. Article 21 of NIS2 explicitly calls for measures based on all-hazards risk analysis, including “the physical security of network and information systems.” A fire-safe roof coating is a concrete example of a physical risk countermeasure. It reduces the likelihood of a fire-induced outage and thus supports the continuity of the essential service your facility provides.

In summary

Fire-safe roofing is now an integral part of holistic security. With NIS2 raising the bar, forward-thinking firms are treating roof fire protection with the same priority as cybersecurity – and solutions like AllShield make it easier to do so. By investing in a non-combustible roof, you’re not only protecting assets and people, but also aligning with the latest compliance and insurance benchmarks for a resilient operation.