TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules do not adequately cover companies whose cloud platforms can remotely control large numbers of home batteries and other energy devices. It proposes independent product assessments and NIS2 coverage based on remotely controllable power, while warning that the scale of any current exposure is not established in the report.
The Netherlands’ digital infrastructure inspectorate is urging the European Union to tighten cybersecurity oversight of companies that can remotely control household batteries and other energy devices, warning that a faulty update or cyberattack on shared cloud systems could affect enough equipment to threaten grid stability. The Rijksinspectie Digitale Infrastructuur says existing EU rules partly miss these firms and proposes assessing obligations by the amount of power they can control, rather than relying mainly on company size.
In a recently published position paper presented at the ONE Conference in The Hague, the inspectorate says the greatest risk may lie in manufacturers’ and aggregators’ backend systems, energy management service providers and the cloud platforms they use—not only in individual devices. When many devices connect to the same backend, a single point of access could potentially affect them together.
The paper describes three routes to a widespread disruption: an authorized party could push a faulty update or setting; attackers could exploit vulnerabilities in devices or their control platforms; or a state could compel manufacturers or service providers under its jurisdiction to cooperate. These are risks identified by the inspectorate, not reports that any such coordinated incident has occurred.
The inspectorate cites SolarPower Europe research saying a sudden supply-and-demand imbalance of 3 gigawatts or more can disrupt the grid. It also reports that the number of heat pumps and EV chargers in the Netherlands grew fivefold between 2019 and 2024. Those figures illustrate the potential scale of connected equipment; they do not establish how much capacity any one company can currently control or whether a specific grid is at immediate risk.
Why Remote Control Changes Grid Risk
Home batteries, solar inverters, heat pumps and EV chargers can help households use electricity more flexibly, but remote coordination also creates a shared digital pathway into equipment that affects energy demand and supply. If a platform can issue commands to many devices, a problem in that platform could have consequences beyond the individual home.
The inspectorate’s proposal would make the scale of remotely controllable power a factor in cybersecurity oversight. That approach could bring smaller firms into scope when their systems can influence substantial capacity, while giving regulators a way to distinguish providers with limited reach from those whose services connect many devices. The paper argues that protecting the electricity system requires attention to both device security and the resilience of the systems managing devices at scale.
The potential consequences are not limited to household inconvenience. The inspectorate warns that coordinated changes to power flows could contribute to a grid imbalance. It does not say that a specific attack is underway, quantify the likelihood of one, or identify a particular company or product as responsible.
As an affiliate, we earn on qualifying purchases.
EU Rules and Their Coverage
The inspectorate says the EU’s Cyber Resilience Act (CRA) sets general cybersecurity requirements for covered products, but manufacturers assess their own compliance under the current approach. The requirements described in the paper apply to products placed on the EU market from December 11, 2027. The regulator wants device-specific harmonized standards and relevant energy-device categories added to the CRA’s list of important class II products, which would require an independent assessment before sale.
The inspectorate also says the NIS2 directive generally determines which companies face obligations by factors including company size, rather than the power they can remotely control. Smaller businesses may fall outside the rules unless national authorities designate them; the paper also identifies possible gaps for energy companies and manufacturers without an EU establishment. Separately, a provisional entity list under the Network Code on Cybersecurity does not yet include manufacturers or energy management system providers, with those obligations due to take effect in mid-2028.
A European Commission expert group recommended this month that solar inverters be classified as important class II products under the CRA, alongside restrictions concerning high-risk suppliers. The group said its analysis did not cover EV chargers, heat pumps or battery storage systems, which it could examine later. At an October 8 cybersecurity forum in Brussels, European Network for Cyber Security researchers demonstrated how a compromised smart-home device could send commands to a residential inverter or battery on the same network.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, a security researcher at the European Network for Cyber Security
solar inverter with remote control
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Scale of Exposure Remains Unspecified
The position paper warns about possible routes to mass control but does not identify a current attack, a vulnerable company or a confirmed number of devices that could be affected through one platform. The cited 3-gigawatt threshold is presented as a potential grid-disruption level, not as an amount currently controlled by a named provider.
It is also unclear whether the European Commission or EU lawmakers will adopt the inspectorate’s proposals, how any power-based threshold would be calculated, and which device categories would be included. The Commission expert group’s recommendation is limited to solar inverters; its assessment did not cover batteries, heat pumps or EV chargers.
At the ONE Conference, researchers from Modat and the Dutch National Cyber Security Centre also reported finding 8,547 internet-facing systems at European solar and wind sites that, they said, should not be reachable online. The report does not establish that those systems were compromised or that they connect to the household device platforms addressed in the inspectorate’s paper.
As an affiliate, we earn on qualifying purchases.
EU Decisions Will Shape Coverage
The immediate next step is for EU institutions to consider whether product standards, CRA classifications or NIS2 coverage should change in response to the inspectorate’s recommendations. The paper calls for independent assessment of selected devices, NIS2 obligations for companies able to control enough capacity to endanger grid stability regardless of size or location, and reduced reliance on non-EU companies able to influence devices at scale.
The Commission expert group’s possible later assessment of batteries, heat pumps and EV chargers could clarify whether its proposed inverter classification should extend to other equipment. Meanwhile, the CRA requirements described by the inspectorate are scheduled to apply to products placed on the EU market from December 11, 2027, and Network Code on Cybersecurity obligations are due to take effect in mid-2028. The supplied material does not give a timetable for an EU response to the Dutch paper.
As an affiliate, we earn on qualifying purchases.
Key Questions
What change is the Dutch regulator seeking?
It wants EU cybersecurity oversight to account for how much power a company can control remotely, not just its size. It also proposes device-specific standards and independent assessments for selected home energy products.
Which devices does the warning cover?
The paper discusses home batteries, solar inverters, heat pumps and EV chargers, along with the backend and cloud platforms used to manage them. The Commission expert group’s current recommendation specifically addresses solar inverters and did not assess the other listed device types.
Has a cyberattack on home batteries been reported?
The supplied report describes potential attack paths and a demonstration involving commands sent to a residential inverter or battery through a compromised smart-home device. It does not report a confirmed attack that caused widespread disruption through these platforms.
When do the relevant EU rules take effect?
The inspectorate says the CRA requirements at issue apply to products placed on the EU market from December 11, 2027. Obligations under the Network Code on Cybersecurity are due to take effect in mid-2028; the paper says the provisional entity list does not yet include manufacturers or energy management system providers.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
