TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules do not fully cover companies and cloud systems that can remotely control large groups of home batteries and other energy devices. It proposes independent product assessments and oversight based on the amount of power a company can control, rather than company size alone.
The Netherlands’ digital infrastructure inspectorate is calling for changes to EU cybersecurity rules, warning that gaps in oversight could leave cloud platforms able to control large numbers of home batteries, inverters, heat pumps and EV chargers without safeguards proportionate to their potential effect on the electricity grid. In a position paper presented at the ONE Conference in The Hague, the regulator proposed independent testing of certain devices and rules that account for how much power a company can remotely control.
The Rijksinspectie Digitale Infrastructuur says the main concern is not just the security of an individual device, but the backend systems and cloud platforms used by manufacturers, energy management providers and aggregators. Many devices may connect to the same systems, meaning a faulty update, compromised platform or other misuse of remote access could affect many devices at once, the inspectorate said.
The regulator identifies three routes to a widespread disruption: a manufacturer or another party with remote access could send a faulty update or setting; attackers could exploit weaknesses in devices or control platforms; or a state could compel companies under its jurisdiction to cooperate. Citing research by SolarPower Europe, the inspectorate says a sudden supply-and-demand imbalance of 3 gigawatts or more could disrupt the grid. That figure describes a potential imbalance, not an event the regulator says has occurred.
Its proposals include device-specific EU standards and adding relevant product categories to the Cyber Resilience Act’s list of important class II products, which would require independent assessment before sale. It also wants NIS2 coverage to apply to companies according to the remotely controllable capacity they manage, regardless of company size or location, and calls for less dependence on non-EU companies able to influence devices at scale.
Remote Control Could Scale Grid Risk
Residential energy devices can help balance electricity supply and demand, but networked control also creates a potential route for an incident at one platform to affect many installations. The inspectorate’s argument is that the scale of controllable power matters more to grid risk than the size of the company operating the service.
That approach could change which manufacturers, software providers and aggregators face cybersecurity obligations. Independent assessment could also give buyers and energy providers a way to check security before devices enter the EU market. The proposals are recommendations, however, and do not themselves change current rules.
The issue extends beyond batteries. The regulator identifies inverters, heat pumps and EV chargers as devices that can be connected to common control systems. Their growing use makes the security of those systems relevant to energy resilience as well as consumer-device protection.
As an affiliate, we earn on qualifying purchases.
EU Rules Leave Coverage Gaps
The inspectorate says the Cyber Resilience Act currently sets general cybersecurity requirements for these products, with manufacturers assessing their own compliance. The relevant requirements apply to products placed on the EU market from December 11, 2027. The regulator argues that this does not yet provide device-specific rules or mandatory independent assessment for the products it identifies.
NIS2 obligations generally depend on company size and sector. According to the inspectorate, smaller firms can fall outside the rules unless national authorities designate them, while some energy companies and manufacturers without an EU establishment are also not covered. A provisional list under the Network Code on Cybersecurity, with obligations due to take effect in mid-2028, does not yet include manufacturers or energy management system providers.
There are related EU discussions. A European Commission expert group recommended this month that solar inverters be treated as important class II products under the CRA, alongside restrictions on high-risk suppliers. The group said its analysis did not cover EV chargers, heat pumps or battery storage, though it could examine them later. At the October 8 cybersecurity forum in Brussels, ENCS researchers demonstrated how a compromised smart-home device could send commands to a residential inverter or battery on the same network.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, security researcher at the European Network for Cyber Security
Scope and Adoption Remain Open
The position paper does not establish that a coordinated cyberattack has disrupted the Dutch grid, or that the 3 GW imbalance cited by the inspectorate has occurred. The regulator describes ways devices could be affected and a potential grid consequence; the likelihood and scale of a real incident are not specified in the source material.
It is also unclear which device categories or capacity thresholds would be included in any revised EU rules, how compliance would be checked, and whether EU institutions will adopt the proposals. The Commission expert group’s current recommendation concerns solar inverters; it said other device categories were outside the scope of its analysis.
Separately, researchers from Modat and the Dutch National Cyber Security Centre reported finding 8,547 internet-facing systems at European solar and wind sites that they said should not be reachable online. The report does not establish that those systems were compromised or provide further detail on the risks posed by each one.
EU Review Will Shape Coverage
The Dutch regulator’s proposals now depend on consideration by EU policymakers and regulators. Any change to the Cyber Resilience Act or NIS2 would require decisions on which products and companies are covered, how remotely controllable capacity is measured, and what independent testing must involve.
The Commission expert group may assess EV chargers, heat pumps and battery storage in later work, according to the source report. The CRA requirements cited by the inspectorate are scheduled to apply to products placed on the EU market from December 11, 2027; the Network Code obligations are due in mid-2028. Until rules are adopted, the inspectorate’s recommendations remain proposals rather than new legal requirements.
Key Questions
What is the Dutch regulator asking the EU to change?
It wants independent assessment for specified energy devices and cybersecurity oversight based on the amount of power a company can control remotely, not company size alone.
Which devices are involved?
The inspectorate names home batteries, inverters, heat pumps and EV chargers, along with the backend and cloud systems used to manage them.
Has a cyberattack caused the grid disruption described?
The source report describes a potential risk, not a confirmed grid disruption. It cites a possible supply-and-demand imbalance of 3 gigawatts or more as capable of disrupting the grid.
Are the proposed rules already in force?
No. The Dutch inspectorate’s recommendations are proposals. The report says relevant Cyber Resilience Act requirements apply to products placed on the EU market from December 11, 2027, while Network Code obligations are due in mid-2028.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
