Dutch regulator flags EU cyber gap for cloud-controlled home batteries
Dutch regulator warns EU rules fail to cover cloud-controlled home batteries and inverters, risking grid instability if compromised by faulty updates or cyberattacks.
The Rijksinspectie Digitale Infrastructuur, the Netherlands’ digital infrastructure inspectorate, warns that a single cyber incident or faulty update on manufacturer or aggregator platforms could simultaneously switch large numbers of inverters, home batteries, heat pumps and EV chargers, destabilizing the grid. The regulator highlights that current EU cybersecurity frameworks like the Cyber Resilience Act and NIS2 directive only partially address risks posed by backend systems and cloud platforms controlling these devices. It notes that a sudden imbalance of 3 GW or more could disrupt the grid, citing research by SolarPower Europe, and points to the rapid growth of heat pumps and EV chargers in the Netherlands between 2019 and 2024.
The inspectorate identifies three potential vectors for large-scale disruption: manufacturers pushing faulty updates, attackers exploiting vulnerabilities in devices or control platforms, or states compelling cooperation from manufacturers and service providers. It argues that the EU Cyber Resilience Act’s requirements apply only to products placed on the EU market from December 11, 2027, and that NIS2’s obligations are primarily tied to company size rather than the capacity remotely controlled, leaving gaps for smaller or non-EU entities.
To address these gaps, the inspectorate proposes three remedies: establishing device-specific harmonized EU standards, adding categories of these devices to the CRA’s list of important class II products requiring independent assessment, and bringing companies capable of remotely controlling enough capacity to endanger grid stability under NIS2 regardless of size or location. It also advocates strengthening the grid’s digital autonomy by reducing dependence on non-EU companies that can influence devices at scale.
Isabel van der Leij, the inspectorate’s manager of digital resilience for the energy sector, emphasized that while these devices make the electricity system smarter and more sustainable, they introduce new risks that demand both secure devices and resilience across the entire energy system. A European Commission expert group recently recommended classifying solar inverters as important class II products under the CRA, though its analysis did not yet cover EV chargers, heat pumps or battery storage systems.