TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules do not fully cover companies and cloud platforms that can remotely control large fleets of home energy devices. It proposes capacity-based oversight, independent device testing and measures to reduce dependence on non-EU providers. The proposals are recommendations, not adopted EU rules.
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules leave gaps around companies and cloud platforms that can remotely control fleets of home batteries, inverters, heat pumps and electric-vehicle chargers. In a position paper, the regulator recommends oversight based on the amount of power a company can control, as well as independent security assessments for relevant devices, because a faulty update or cyberattack could affect many connected systems at once.
The Rijksinspectie Digitale Infrastructuur (RDI) says the main concern is not limited to the security of individual devices. It points to the backend systems used by manufacturers, energy-management providers and aggregators, along with the cloud platforms through which those systems can issue commands. When many devices connect to a shared service, a single compromised access point or mistaken update could reach a large number of them, the inspectorate argues.
The paper identifies three routes to a simultaneous disruption: a company or other party with remote access could distribute a faulty update or setting; attackers could exploit weaknesses in devices or control platforms; or a state could compel a manufacturer or service provider under its jurisdiction to cooperate. The inspectorate cites research by SolarPower Europe saying that a sudden supply-and-demand imbalance of 3 gigawatts or more can disrupt the grid. That figure describes a potential imbalance, not an estimate of a likely attack.
The RDI says the EU’s Cyber Resilience Act (CRA) sets general cybersecurity requirements for these products, with manufacturers assessing their own compliance. The requirements apply to products placed on the EU market from Dec. 11, 2027. The inspectorate also says the NIS2 directive generally brings companies into scope according to size, rather than the volume of power their systems can control remotely. Smaller firms may fall outside the rules unless national authorities designate them; the RDI says companies without an EU establishment can also be missed. A provisional list under the Network Code on Cybersecurity, whose obligations are due to take effect in mid-2028, does not yet include manufacturers or energy-management system providers.
Remote Control Can Scale Grid Risk
The issue matters because connected household equipment can act as part of the electricity system, not just as separate consumer products. If a shared cloud service can change settings across many batteries, inverters, chargers or heat pumps, a cyber incident or operational error could affect electricity demand or generation across multiple homes at once. The inspectorate’s concern is that existing oversight may not track that collective capacity.
The proposals would shift some attention from a company’s headcount or location to the power it can influence remotely. That could bring smaller firms and service providers into scope where their control over a large device fleet creates a potential grid risk. Independent testing could also give buyers and authorities information beyond manufacturers’ own compliance assessments. These are proposed changes; the paper does not establish that a large-scale disruption has occurred.
As an affiliate, we earn on qualifying purchases.
EU Rules and New Device Risks
The RDI says the number of heat pumps and EV chargers in the Netherlands grew fivefold between 2019 and 2024. The figure is specific to those device categories and period; it is not a measure of the number of devices that can be remotely controlled by any one company. The growing use of connected energy equipment is the backdrop to the inspectorate’s call for cybersecurity rules to account for shared control systems.
There have been related EU-level discussions. A European Commission expert group recommended this month that solar inverters be treated as important class II products under the CRA, alongside restrictions concerning high-risk suppliers. The group said its analysis did not cover EV chargers, heat pumps or battery storage, though it could examine them later. At the ONE Conference in The Hague, researchers from Modat and the Dutch National Cyber Security Centre also reported 8,547 internet-facing systems at European solar and wind sites that they said should not be reachable online. That finding concerns renewable-energy sites and is separate from the proposed rules for household devices.
At a Brussels cybersecurity forum on Oct. 8, researchers from the European Network for Cyber Security demonstrated how a compromised smart-home device could be used to send commands to a residential inverter or home battery on the same network. The demonstration illustrates a possible pathway; it does not show that a broad grid disruption took place.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, security researcher at the European Network for Cyber Security
As an affiliate, we earn on qualifying purchases.
Scope and Threat Evidence Remain Open
The position paper does not establish how much generation or demand any specific company can currently control, or how likely a coordinated incident affecting the grid would be. The 3-gigawatt figure is cited as a level of sudden imbalance that can disrupt the grid; it is not a forecast of damage from a particular attack. The reported demonstration and exposed internet-facing systems also do not, on their own, show that household devices or European grids have suffered a large-scale cyber event.
It remains unclear whether the European Commission or EU lawmakers will adopt the inspectorate’s proposals, which device categories would qualify for independent assessments, and how authorities would calculate a company’s remotely controlled capacity. The Commission expert group’s recommendation concerns solar inverters and does not yet settle the treatment of batteries, heat pumps or EV chargers. The RDI’s call to address companies outside the EU also raises questions about how any such rules would be applied across borders.
As an affiliate, we earn on qualifying purchases.
EU Decisions Will Set the Path
The next steps depend on EU institutions and national authorities. The Commission could consider device-specific standards or changes to the CRA’s product categories, while EU policymakers may assess whether NIS2 should cover companies according to remotely controlled capacity. The inspectorate is also calling for limits on reliance on non-EU companies that can influence devices at scale, but the paper does not set out an adopted mechanism or timetable for that proposal.
Further scrutiny may come through the Commission expert group’s possible assessment of batteries, heat pumps and EV chargers, and through implementation of the Network Code on Cybersecurity, whose obligations are scheduled to begin in mid-2028. For now, the RDI’s paper is a regulatory warning and set of recommendations; no change to EU law is confirmed.
electric vehicle charger with remote control
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the Dutch regulator warning about?
The RDI says cloud platforms and service providers may be able to control many connected home energy devices at once, while current EU rules may not fully cover those companies or reflect the scale of their remote control.
Has a cyberattack disrupted the grid?
The source material does not report a large-scale grid disruption from these devices. It describes possible attack routes and research demonstrations, and cites 3 gigawatts as a sudden imbalance that can disrupt the grid.
What changes does the inspectorate propose?
It recommends device-specific EU standards and independent assessments for relevant products, bringing companies with significant remote control under NIS2 regardless of size or location, and reducing dependence on non-EU providers that can influence devices at scale.
Do the proposals apply to home batteries now?
No new requirement is confirmed. The proposals are recommendations in a position paper. The Commission expert group has recommended a CRA classification for solar inverters, but said its current analysis did not cover battery storage, heat pumps or EV chargers.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
