TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules do not adequately cover companies whose platforms can remotely control large groups of home batteries and other energy devices. It proposes capacity-based oversight, independent device assessments and limits on reliance on non-EU providers that can influence devices at scale.
The Netherlands’ digital infrastructure inspectorate is urging the European Union to strengthen cybersecurity rules for companies that can remotely control home batteries and other energy devices, warning that a faulty update or cyberattack on shared cloud platforms could affect enough equipment to threaten electricity-grid stability. Its position paper says current EU rules only partly cover the manufacturers, energy-management providers and aggregators behind those systems.
The inspectorate, the Rijksinspectie Digitale Infrastructuur, says the main risk is not necessarily an individual battery or inverter but the backend systems used to manage many devices. A shared platform can give a company or attacker access to equipment across multiple homes, creating a potential single point of entry. The paper identifies faulty remote updates or settings, exploitation of security vulnerabilities, and pressure by a foreign state on companies under its jurisdiction as ways that many devices could be affected at once.
The agency cites research by SolarPower Europe saying a sudden supply-and-demand imbalance of 3 gigawatts or more can disrupt the grid. It also reports that the number of heat pumps and electric-vehicle chargers in the Netherlands grew fivefold from 2019 to 2024. That growth increases the amount of connected equipment that may interact with energy systems, although the paper does not say that the Dutch devices are currently being used to cause grid disruption.
The inspectorate recommends device-specific EU standards and adding relevant products to the Cyber Resilience Act’s important class II category, which would require an independent assessment before sale. It also wants NIS2 coverage to depend on how much capacity a company can control remotely, rather than company size alone, and calls for stronger digital autonomy to reduce reliance on non-EU providers able to influence devices at scale.
As batteries, heat pumps, inverters and chargers become connected to energy-management services, a single backend can potentially send commands to many devices. That can help coordinate electricity use, but it also concentrates risk: a compromised platform or faulty update could affect multiple homes at once. The inspectorate’s concern is about the possible scale of a disruption, not a claim that a large coordinated attack has occurred.
The proposed approach would link oversight to the power capacity under remote control. That could bring smaller firms into scope if they manage enough devices to pose a system-level risk, while making independent testing a requirement for certain products. For consumers, the proposals concern the security and reliability of connected energy equipment as well as the businesses that operate its remote services.
As an affiliate, we earn on qualifying purchases.
EU Rules Leave Coverage Gaps
The inspectorate says the Cyber Resilience Act sets general cybersecurity requirements for connected products, but manufacturers assess their own compliance under the current framework. The requirements apply to products placed on the EU market from December 11, 2027. The regulator argues that this does not yet provide the independent, device-specific assessment it wants for home energy equipment.
It says NIS2 obligations are mainly tied to company size, with smaller companies generally outside the rules unless national authorities designate them. The paper also flags companies without an EU establishment and says manufacturers and energy-management system providers are absent from a provisional list under the Network Code on Cybersecurity, whose obligations are due to take effect in mid-2028.
A European Commission expert group recommended this month that solar inverters be classified as important class II products under the CRA, alongside restrictions on high-risk suppliers. The group said its report did not assess EV chargers, heat pumps or battery storage systems, though it could examine them later. Separately, researchers at a Brussels cybersecurity forum on October 8 demonstrated how a compromised smart-home device could send commands to a residential inverter or battery on the same network.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, security researcher at the European Network for Cyber Security
As an affiliate, we earn on qualifying purchases.
Proposals Await EU Decisions
The position paper is a regulatory recommendation, not an adopted EU rule. It is not yet clear whether the European Commission or member states will take up the proposals, what products or power thresholds any new rules would cover, or how responsibilities would be divided among manufacturers, aggregators and cloud providers.
The paper describes scenarios that could affect many devices but does not establish that a specific cloud platform or home battery fleet has been compromised. The Commission expert group’s recommendation focuses on solar inverters; its assessment of batteries, heat pumps and chargers remains outside the report’s stated scope.
As an affiliate, we earn on qualifying purchases.
EU Cyber Rules Face Further Review
The next step would be consideration of the inspectorate’s recommendations by EU policymakers and regulators as they develop implementation of the CRA, NIS2 and the Network Code on Cybersecurity. The Commission expert group could also assess batteries, heat pumps and EV chargers in later work, according to the report cited in the source material.
The inspectorate has not announced a timetable for EU action or a specific legislative process tied to its paper. The CRA requirements for relevant products are set to apply from December 11, 2027, while Network Code obligations are due in mid-2028; whether either framework will be revised to include the proposed measures remains unresolved.
electric vehicle charger with smart control
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the Dutch inspectorate asking the EU to change?
It proposes independent assessments for certain home energy devices, NIS2 oversight based on the amount of power companies can control remotely, and measures to reduce reliance on non-EU providers that can influence devices at scale.
Why does the regulator focus on cloud platforms?
Manufacturers, energy-management providers and aggregators can use shared backend platforms to control many devices. The inspectorate says a vulnerability, attack or faulty update affecting such a platform could reach multiple devices at once.
Have home batteries been shown to cause a grid disruption?
The source material describes a risk scenario, not a confirmed grid disruption caused by home batteries. The inspectorate warns that a sudden imbalance of 3 gigawatts or more can disrupt the grid, citing SolarPower Europe research.
When do current EU product cybersecurity requirements apply?
The inspectorate says the Cyber Resilience Act requirements apply to products placed on the EU market from December 11, 2027. It argues that the current framework does not yet require the independent assessment it seeks for these devices.
Are the inspectorate’s recommendations now law?
No. They are recommendations in a position paper. It is not yet clear whether EU institutions will adopt them or what any resulting rules would require.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
