A Dutch regulator says EU cybersecurity rules should target companies by how much power they can control remotely, not by their size, and wants home energy devices certified independently under the Cyber Resilience Act (CRA).
From ESS News
The Netherlands’ digital infrastructure inspectorate, the Rijksinspectie Digitale Infrastructuur, says a faulty update or cyberattack on manufacturer and aggregator platforms could switch enough inverters, home batteries, heat pumps and EV chargers at once to destabilize the grid. It argues in a recently published position paper that the EU Cyber Resilience Act and NIS2 directive only partly cover the companies behind those platforms.
The biggest risk sits not in individual devices but in the backend systems of manufacturers, energy management system providers and aggregators, and in the cloud platforms they use, according to the inspectorate. Because large groups of devices connect to the same backend, a single point of entry can control many of them.
A sudden imbalance between supply and demand of 3 GW or more can disrupt the grid, the regulator says, citing research by SolarPower Europe. It says the number of heat pumps and EV chargers in the Netherlands grew fivefold between 2019 and 2024.
The inspectorate identifies three ways large numbers of devices could be affected simultaneously. A manufacturer or other party with remote access could push a faulty update or setting, attackers could exploit vulnerabilities in devices or their control platforms, or a state could compel manufacturers and service providers under its jurisdiction to cooperate.
Under the EU Cyber Resilience Act, such devices face only general cybersecurity requirements and manufacturers assess their own compliance, while the requirements apply only to products placed on the EU market from Dec. 11, 2027.
NIS2 applies mainly according to company size rather than the capacity a company can control remotely, so smaller companies fall outside unless designated by national authorities, as do energy companies and manufacturers without an EU establishment.
The provisional list of entities under the Network Code on Cybersecurity, whose obligations take effect in mid-2028, does not yet include manufacturers or energy management system providers.
The inspectorate proposes three remedies. It suggests device-specific harmonized EU standards and adding categories of these devices to the CRA’s list of important class II products, which would require an independent assessment before they could be sold in the European Union.
It also proposes bringing companies that can remotely control enough capacity to endanger grid stability under NIS2, regardless of their size or location, and strengthening the grid’s digital autonomy by limiting dependence on companies outside the European Union that can influence devices at scale.
Isabel van der Leij, the inspectorate’s manager of digital resilience for the energy sector, said the devices make the electricity system smarter and more sustainable but introduce new risks that require both secure devices and resilience across the energy system as a whole.
A European Commission expert group recommended in a report this month that solar inverters be classified as important class II products under the CRA, alongside restrictions on high-risk suppliers. The group said its analysis did not cover EV chargers, heat pumps or battery storage systems, which it could assess later.
At a cybersecurity forum in Brussels on Oct. 8, researchers from the European Network for Cyber Security (ENCS) showed how a compromised smart-home device could be used to send commands to a residential inverter or home battery on the same network.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid,” said Harm van den Brink, a security researcher at ENCS. “In the short term, we need independent security testing, prioritized according to the amount of power potentially affected, combined with vulnerability management by manufacturers.”
The inspectorate presented its paper at the ONE Conference in The Hague, where researchers from Modat and the Dutch National Cyber Security Centre also reported 8,547 internet-facing systems at European solar and wind sites that should not be reachable online.
This content is protected by copyright and may not be reused. If you want to cooperate with us and would like to reuse some of our content, please contact: [email protected].