As more Dutch households add devices such as home batteries, EV chargers, heat pumps, and solar inverters, regulators fear hacking or faulty software updates could threaten the power grid, prompting calls for certification.
Here's what to know
As reported by PV Magazine, the Netherlands' digital infrastructure inspectorate, the Rijksinspectie Digitale Infrastructuur, says EU cybersecurity law is still missing crucial sections for the companies that remotely coordinate large numbers of household energy devices.
Its position paper says the danger lies less in a single charger, battery, or heat pump than in the common cloud and backend systems manufacturers, aggregators, and energy management system providers use to control entire fleets.
The inspectorate cited SolarPower Europe research saying the grid can be disrupted by a sudden supply-demand gap of 3 gigawatts or more. Since 2019, the Netherlands has seen the number of heat pumps and EV chargers rise fivefold.
The regulator outlined three ways a mass disruption could happen at once. First, a company with remote access could roll out a faulty setting or update. Second, attackers could break into devices or the systems that control them. Third, a state could pressure manufacturers and service providers within its jurisdiction to assist.
The same devices designed to lower bills and cut pollution also need to be secure and dependable, or cyber risks and outages could erode public trust in electrification.
TCD Picks » Quince Spotlight
💡These best-sellers from Quince deliver affordable, sustainable luxury for all
More background
For these products, the EU Cyber Resilience Act currently sets general cybersecurity obligations, lets manufacturers self-assess compliance, and does not apply to products placed on the EU market until December 11, 2027.
Because NIS2 is based largely on company size rather than the amount of power a firm can direct remotely, smaller operators are generally left out unless a national authority specifically designates them.
Manufacturers and energy companies based outside the EU and operating without an establishment inside the bloc also aren't fully covered by the rules.
The forthcoming Network Code on Cybersecurity has not yet solved that problem. Even on its provisional list of covered entities, with requirements due to begin in mid-2028, manufacturers and energy management system providers remain excluded.
So, ironically, as households add internet-connected energy hardware as part of the transition to cleaner energy sources, if those tools aren't secure, what looks cleaner on paper could be more vulnerable in practice.
What's being done?
The Dutch inspectorate proposed three remedies.
One recommendation is to set EU-wide standards specifically for these products, and to add more home energy technologies to the Cyber Resilience Act's important class II list so they would need independent assessment before sale in the European Union.
It also wants to trigger NIS2 coverage based on a company's remotely controllable capacity when it poses a grid-stability risk, rather than the firm's size or where it is based.
Another proposal is to build greater "digital autonomy" into the grid by relying less on non-EU companies that can affect very large numbers of devices.
In a report released in October, a European Commission expert group said solar inverters should fall under the CRA's important class II category and face limits on high-risk suppliers, while EV chargers, heat pumps, and battery storage systems could be reviewed later.
At a cybersecurity forum in Brussels on October 8, the European Network for Cyber Security showed that compromising one smart-home device could let an attacker send commands to a residential inverter or home battery on the same network.
Researchers from Modat and the Dutch National Cyber Security Centre also reported at the ONE Conference in The Hague that 8,547 European solar and wind site systems were exposed online despite not being meant for public internet access.
Isabel van der Leij, the inspectorate's manager of digital resilience for the energy sector, said, "The devices make the electricity system smarter and more sustainable but introduce new risks that require both secure devices and resilience across the energy system as a whole."
Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.
