Cybersecurity Gaps in Cloud-Controlled Home Batteries

The Dutch digital infrastructure inspectorate, Rijksinspectie Digitale Infrastructuur, has published a critical position paper urging the European Union to tighten cybersecurity regulations for companies remotely controlling home batteries, inverters, heat pumps, and EV chargers. The warning highlights significant vulnerabilities in cloud platforms that could compromise grid stability across the bloc.

Risks of Concentrated Control

The inspectorate emphasizes the dangers of concentrated control in backend systems and cloud platforms. A single cyberattack or faulty software update could simultaneously affect thousands of connected devices. The regulator warns that a sudden imbalance of 3 GW or more caused by compromised systems could lead to major grid disruptions, threatening the energy security of member states.

Proposed Capacity-Based NIS2 and CRA Compliance

To address these risks, the inspectorate proposes extending the obligations of the NIS2 Directive based on remotely controlled power capacity rather than company size. This ensures that smaller providers controlling significant grid capacity are adequately regulated. Additionally, the regulator suggests adding relevant product categories to the Cyber Resilience Act's (CRA) important class II list, mandating independent device assessments before they are placed on the market.

EU Regulatory Timelines and Digital Autonomy

The CRA's general cybersecurity requirements are scheduled to apply to products placed on the EU market from December 11, 2027, with Network Code on Cybersecurity obligations due by mid-2028. An EC expert group has already recommended classifying solar inverters as important class II products, with battery storage systems likely to follow. Ultimately, the inspectorate calls for reducing the EU's reliance on non-EU companies capable of affecting connected devices at scale, safeguarding both digital autonomy and grid resilience.

"A sudden imbalance of 3 GW or more can cause major disruptions, highlighting the urgent need for robust EU-wide cybersecurity frameworks."

Source: Wattreserve

This article was assisted by AI analysis. Please refer to the original source for official information.