TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules do not fully cover companies and platforms that can remotely control large groups of home energy devices. It proposes risk-based oversight tied to controllable power, independent product assessments and less dependence on non-EU providers. The proposals are recommendations, not adopted EU rules.
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules leave gaps around companies whose cloud platforms can remotely control home batteries and other energy devices, and it is urging the bloc to tie oversight to the amount of power a company can influence. In a recently published position paper, the regulator warns that a faulty update or cyberattack could affect many devices at once and potentially threaten electricity-grid stability.
The inspectorate, Rijksinspectie Digitale Infrastructuur, says the main exposure is not necessarily an individual battery or inverter but the backend systems and cloud services used by manufacturers, energy management providers and aggregators. Because many devices may connect to the same platform, access to one system could allow commands or changes to reach a large fleet, it argues.
The paper describes three routes to a simultaneous disruption: a company or other party with remote access could distribute a faulty update or setting; attackers could exploit weaknesses in devices or control platforms; or a state could compel providers under its jurisdiction to cooperate. The regulator cites research by SolarPower Europe indicating that a sudden supply-and-demand imbalance of 3 gigawatts or more can disrupt the grid. It also says the number of heat pumps and EV chargers in the Netherlands grew fivefold from 2019 to 2024.
To address the gap, the inspectorate proposes device-specific EU standards and adding relevant products to the Cyber Resilience Act’s important class II category, which would require independent assessment before sale. It also wants NIS2 obligations to cover companies able to control enough capacity to endanger grid stability, regardless of company size or location, and calls for reduced dependence on non-EU firms that can influence devices at scale. These are regulatory recommendations, not rules already adopted.
Risks Behind Remote Energy Controls
Home batteries, inverters, heat pumps and EV chargers can help balance electricity supply and demand when their operation is coordinated. The same connectivity creates a potential concentration of risk: a problem in a shared platform could affect many devices, rather than requiring an attacker to compromise each one separately.
The regulator’s focus on remotely controllable capacity would shift attention from a company’s size alone to the potential grid impact of its systems. That matters because smaller providers may still manage large groups of devices, while a single provider’s controls could influence demand or generation across many homes. The inspectorate says resilience must cover both individual product security and the wider energy system.
As an affiliate, we earn on qualifying purchases.
EU Rules and Their Current Reach
The Cyber Resilience Act sets cybersecurity requirements for products with digital elements, but under the current timetable the relevant requirements apply to products placed on the EU market from Dec. 11, 2027. The inspectorate says the devices face general requirements and that manufacturers assess their own compliance; its proposal would add independent scrutiny for specified product categories.
NIS2 mainly determines which companies are covered through criteria such as size, with smaller firms generally outside its scope unless national authorities designate them. The inspectorate says this can leave gaps for energy businesses and manufacturers without an EU establishment. A provisional list under the Network Code on Cybersecurity, with obligations due to take effect in mid-2028, does not yet include manufacturers or energy management system providers, according to the paper.
There are related policy discussions. A European Commission expert group recommended this month that solar inverters be classified as important class II products under the CRA, alongside restrictions on high-risk suppliers. The group said its analysis did not cover batteries, EV chargers or heat pumps, which it could assess later. Separately, researchers at an Oct. 8 Brussels forum demonstrated how a compromised smart-home device could send commands to an inverter or battery on the same network.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, security researcher at the European Network for Cyber Security
As an affiliate, we earn on qualifying purchases.
Scope and Adoption Remain Open
The position paper does not change EU law, and it is not clear whether the European Commission or member states will adopt the inspectorate’s proposals, or on what timetable. The paper also does not specify which capacity threshold should bring a company under NIS2 or how the proposed device categories and independent assessments would be defined.
The Commission expert group’s recommendation concerns solar inverters, not the full range of home energy devices covered by the Dutch inspectorate’s warning. Its assessment of batteries, heat pumps and EV chargers may come later, but no date or outcome is given. The regulator’s cited grid-risk figure is a threshold from research it references, not evidence that a specific incident has occurred.
As an affiliate, we earn on qualifying purchases.
EU Review and Rulemaking Ahead
The next steps depend on whether EU institutions take up the Dutch inspectorate’s proposals during work on the CRA, NIS2 and related energy cybersecurity rules. The expert group’s possible future review of batteries, EV chargers and heat pumps could clarify whether those products receive treatment similar to the solar-inverter recommendation.
For now, the existing timelines remain relevant: CRA requirements for products placed on the EU market are scheduled to apply from Dec. 11, 2027, and the Network Code on Cybersecurity obligations are due in mid-2028. The source material does not report a formal EU decision to change either timetable.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the Dutch regulator recommend?
It proposed independent assessment for specified home energy devices, NIS2 coverage based on remotely controllable power rather than company size alone, and reduced reliance on non-EU providers able to influence devices at scale.
Are the proposed changes already EU law?
No. They are recommendations in a position paper by the Netherlands’ digital infrastructure inspectorate. The source does not report that EU institutions have adopted them.
Which devices and systems are in the warning?
The inspectorate discusses inverters, home batteries, heat pumps and EV chargers, as well as the manufacturers, energy management providers, aggregators and cloud platforms that can control them remotely.
When do the cited EU rules take effect?
The CRA requirements described in the report apply to products placed on the EU market from Dec. 11, 2027. Obligations under the Network Code on Cybersecurity are due to take effect in mid-2028.
Has a cyberattack disrupted the grid in this case?
The report describes potential attack and failure scenarios, not a specific grid disruption caused by these devices. It says vulnerabilities in some devices have been exploited, but provides no details tying those incidents to a grid outage.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
