TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules do not fully cover companies whose cloud platforms can remotely control large numbers of home batteries, inverters, heat pumps and EV chargers. It proposes device-specific independent checks and applying NIS2 obligations according to remotely controlled power capacity, not just company size. The recommendations are proposals, not adopted EU rules.
The Netherlands’ Rijksinspectie Digitale Infrastructuur is urging the European Union to tighten cybersecurity rules for companies that remotely control home batteries and other energy devices, warning that a compromised cloud platform could affect enough equipment to threaten grid stability. In a recently published position paper, the inspectorate says current EU rules only partly cover the companies behind these systems and proposes independent device assessments and oversight based on how much power a company can control.
The inspectorate identifies the main exposure not in a single battery or inverter, but in the backend systems and cloud platforms used by manufacturers, energy-management providers and aggregators. Because many devices can connect to one platform, a faulty update, a malicious command or an attack on the platform could affect multiple devices at once. The paper says a sudden supply-and-demand imbalance of 3 gigawatts or more can disrupt the electricity grid, citing research by SolarPower Europe.
The report outlines three ways that devices could be affected simultaneously: an authorized party could distribute a faulty update or setting; attackers could exploit vulnerabilities in devices or their control systems; or a state could compel a manufacturer or service provider under its jurisdiction to cooperate. The inspectorate also points to rapid growth in connected equipment: the number of heat pumps and EV chargers in the Netherlands grew fivefold between 2019 and 2024.
Under the inspectorate’s account, the Cyber Resilience Act sets general cybersecurity requirements for these products, with manufacturers assessing their own compliance, and applies to products placed on the EU market from December 11, 2027. NIS2 obligations are largely tied to company size, which can leave smaller firms outside the rules unless national authorities designate them. The paper says the provisional list under the Network Code on Cybersecurity also does not yet include manufacturers or energy-management providers; those obligations are due to take effect in mid-2028.
Cloud Platforms Can Reach Many Devices
Home batteries, inverters, heat pumps and EV chargers can respond to remote commands, making them useful for managing electricity demand and supporting renewable power. But the same connectivity creates a concentration of control: a single compromised platform or faulty update may affect many devices that contribute to the power system.
The inspectorate’s proposed capacity-based approach would focus oversight on a company’s potential effect on the grid, rather than whether it meets a size threshold. That could bring smaller providers into scope if they can control enough connected power. The proposal also raises a question of digital autonomy: the inspectorate wants the EU to limit dependence on providers outside the bloc that can influence devices at scale.
As an affiliate, we earn on qualifying purchases.
EU Rules Leave Providers Uncovered
The inspectorate proposes three changes: develop device-specific EU standards; add relevant product categories to the CRA’s important class II list, requiring independent assessment before sale; and extend NIS2 coverage to companies able to control enough capacity to endanger grid stability, regardless of company size or location. It also calls for reducing reliance on non-EU companies with the ability to affect devices at scale.
The issue is also under discussion at EU level. A European Commission expert group this month recommended classifying solar inverters as important class II products and proposed restrictions on high-risk suppliers. Its report did not assess EV chargers, heat pumps or battery storage systems, though it said those technologies could be considered later. Separately, researchers at an October 8 Brussels cybersecurity forum demonstrated how a compromised smart-home device could send commands to a residential inverter or battery on the same network.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, security researcher at the European Network for Cyber Security
As an affiliate, we earn on qualifying purchases.
Scope and Adoption Remain Open
The inspectorate’s recommendations are proposals; the paper does not establish that the EU has agreed to amend the CRA, NIS2 or the Network Code. The source report does not specify which device categories or capacity thresholds should trigger independent assessment or NIS2 coverage, nor how authorities would measure a company’s remotely controlled capacity.
It is also unclear when EU institutions might consider the proposals or whether the Commission’s work on solar inverters will expand to batteries, heat pumps and EV chargers. The cited 3-gigawatt imbalance is a potential disruption threshold referenced by the inspectorate, not a report that such an event has occurred.
As an affiliate, we earn on qualifying purchases.
EU Review Will Set the Path
The next steps depend on whether EU institutions take up the inspectorate’s proposals and how they define covered devices, companies and capacity thresholds. The inspectorate presented its position paper at the ONE Conference in The Hague. EU work on classifying solar inverters may provide a near-term opening to consider connected energy equipment, while the Commission expert group said other device categories could be assessed later.
For now, the timelines already set in existing rules remain relevant: the CRA requirements described in the report apply to products placed on the EU market from December 11, 2027, and Network Code cybersecurity obligations are scheduled to take effect in mid-2028. Whether those frameworks will be revised to cover the gaps identified by the Dutch regulator remains unsettled.
As an affiliate, we earn on qualifying purchases.
Key Questions
What cybersecurity gap did the Dutch regulator identify?
The inspectorate says current EU rules may not fully cover companies whose platforms can remotely control large numbers of home batteries, inverters, heat pumps and EV chargers. It argues that a company’s potential grid impact can matter even if the company is small.
What changes is the regulator proposing?
It proposes device-specific EU standards and independent assessments for designated products, extending NIS2 obligations to firms that can control enough power to threaten grid stability, and reducing reliance on non-EU providers able to influence devices at scale.
Are the proposals already EU law?
No. They are recommendations in a Dutch inspectorate position paper. The source report does not say that EU institutions have adopted them or set a timetable for doing so.
When do the cited EU rules take effect?
The report says the CRA requirements apply to products placed on the EU market from December 11, 2027. Obligations under the Network Code on Cybersecurity are due to take effect in mid-2028.
Does the report say a major grid disruption has happened?
No. The inspectorate warns that a cyberattack or faulty update could affect many devices and cites 3 gigawatts or more as a potentially disruptive imbalance. The report does not describe an actual grid event of that scale.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
