TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules do not adequately cover companies whose cloud platforms can control large numbers of home batteries and other energy devices. It proposes regulation based on remotely controllable power capacity, independent product testing and reduced reliance on providers outside the EU.
The Netherlands’ digital infrastructure inspectorate is urging the European Union to strengthen cybersecurity rules for cloud-controlled home batteries and other energy devices, arguing that current rules can miss companies able to manage large amounts of power remotely. In a position paper, the Rijksinspectie Digitale Infrastructuur says a faulty software update or cyberattack on shared backend platforms could affect many devices at once and threaten grid stability.
The inspectorate says the main exposure is not necessarily an individual battery, inverter or heat pump, but the manufacturer and aggregator platforms that manage fleets of devices. Because many products can connect to the same backend, a compromise or mistake in one place could send commands to many devices. The paper identifies faulty remote updates or settings, attackers exploiting vulnerabilities, and state pressure on companies under a country’s jurisdiction as possible routes to simultaneous disruption.
The inspectorate cites research by SolarPower Europe to say a sudden supply-and-demand imbalance of 3 gigawatts or more can disrupt the electricity grid. It also reports that the number of heat pumps and electric vehicle chargers in the Netherlands grew fivefold from 2019 to 2024. Those figures describe the potential scale and growth of connected equipment; they do not establish that a coordinated attack has occurred.
Its proposals include device-specific EU standards and adding relevant products to the Cyber Resilience Act’s important class II category, which would require independent assessment before products are sold in the EU. It also wants NIS2 coverage to reflect how much power a company can control remotely, rather than relying mainly on company size, and calls for limiting dependence on providers outside the EU that could influence devices at scale.
Why Remote Control Matters to Grid Security
Home batteries, inverters, heat pumps and EV chargers can help balance electricity supply when they respond to grid needs. But the same connectivity means a platform that controls many devices can become a shared point of risk. The inspectorate’s concern is that synchronized commands or a widespread service failure could alter demand or output faster than the power system can accommodate.
The proposed approach would connect cybersecurity obligations to potentially controllable capacity, not just the size of the company operating a service. That could bring smaller providers, or businesses without an EU establishment, into scope if they can influence enough devices to pose a grid risk. Independent testing could also provide a check beyond manufacturers’ own compliance assessments.
The paper is a regulatory proposal, not a finding that home batteries are currently causing instability. Its importance lies in the mismatch it identifies between increasingly centralized remote control and rules that may not capture all the firms and products involved.
As an affiliate, we earn on qualifying purchases.
Where Current EU Rules Fall Short
The inspectorate says the Cyber Resilience Act (CRA) sets general cybersecurity requirements for connected products, with manufacturers assessing their own compliance. The requirements apply only to products placed on the EU market from Dec. 11, 2027. The regulator argues that this framework does not yet provide the device-specific standards or independent assessment it wants for energy equipment.
Under the inspectorate’s account, NIS2 obligations are largely determined by company size. Smaller companies may fall outside unless national authorities designate them, while some energy firms and manufacturers without an EU establishment may not be covered. A provisional list under the Network Code on Cybersecurity, with obligations due to take effect in mid-2028, does not yet include manufacturers or energy management system providers.
The Dutch paper follows a European Commission expert group report this month recommending that solar inverters be classed as important class II products under the CRA, alongside restrictions on high-risk suppliers. That group said its analysis did not cover EV chargers, heat pumps or battery storage, which it could examine later. At the ONE Conference in The Hague, researchers also reported 8,547 internet-facing systems at European solar and wind sites that should not be reachable online.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, security researcher at the European Network for Cyber Security
As an affiliate, we earn on qualifying purchases.
Scope and Risk Still Undetermined
The position paper does not identify a specific attack on Dutch home batteries or quantify the likelihood that a compromised platform would cause a grid disturbance. Its 3-gigawatt figure is a cited threshold for a sudden imbalance, not a measurement of power currently exposed through cloud-controlled household devices.
It is also unclear which device categories and companies would meet any proposed capacity threshold, how that threshold would be measured, or how EU rules would apply to firms based outside the bloc. The Commission expert group has not yet assessed batteries, heat pumps or EV chargers in the report described by the source material. The inspectorate’s proposals have not been adopted as EU law.
electric vehicle charger with smart control
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
EU Decisions on Testing and Coverage
The inspectorate presented its position paper at the ONE Conference in The Hague; the next step would be consideration by EU institutions and member states as they develop product and network cybersecurity rules. The Commission expert group’s possible future assessment of batteries, heat pumps and EV chargers could inform whether those products receive additional CRA treatment.
For now, the regulatory timetable cited in the paper remains relevant: CRA requirements for products placed on the EU market begin on Dec. 11, 2027, while Network Code on Cybersecurity obligations are due to take effect in mid-2028. The source material does not specify a timetable for deciding on the Dutch proposals or confirm that EU authorities have accepted them.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the Dutch regulator proposing?
It wants EU rules to cover companies according to the amount of power they can control remotely, alongside device-specific standards, independent product assessments and less reliance on providers outside the EU that can influence devices at scale.
Does the report say home batteries have been attacked?
No. The paper describes possible ways a faulty update, cyberattack or state pressure could affect connected devices. It does not report a specific attack on home batteries or say that such an incident has destabilized the grid.
Which devices are part of the concern?
The inspectorate discusses home batteries, inverters, heat pumps and EV chargers, as well as the cloud platforms and energy management services that can control them remotely.
When do the EU rules take effect?
According to the position paper, CRA requirements apply to products placed on the EU market from Dec. 11, 2027. Network Code on Cybersecurity obligations are due to take effect in mid-2028. The Dutch proposals themselves have not been adopted.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
