TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Dutch digital infrastructure inspectorate says EU cybersecurity rules do not adequately cover companies whose cloud platforms can remotely control large numbers of home batteries and other energy devices. It proposes independent product assessments and applying NIS2 obligations according to remotely controlled power capacity, rather than company size alone.
The Netherlands’ digital infrastructure inspectorate says EU cybersecurity rules leave gaps around companies that remotely control home batteries and other energy devices, and is calling for risk-based oversight tied to the amount of power their platforms can affect. Its position paper warns that a faulty software update or cyberattack on shared cloud systems could disrupt many connected devices at once, with potential consequences for electricity-grid stability.
The Rijksinspectie Digitale Infrastructuur says the principal exposure is not limited to vulnerabilities in individual products. It points to the backend systems and cloud platforms used by manufacturers, energy-management providers and aggregators: one system can connect to many inverters, batteries, heat pumps and electric-vehicle chargers. A compromised platform or erroneous command could therefore affect a large number of devices together.
The inspectorate describes three possible routes to such an event: a party with remote access pushes a faulty update or setting; attackers exploit vulnerabilities in devices or control platforms; or a state compels companies under its jurisdiction to cooperate. It cites research by SolarPower Europe indicating that a sudden supply-demand imbalance of 3 gigawatts or more can disrupt the grid. That figure describes the potential imbalance, not a forecast that an attack will cause one.
Its recommendations include device-specific EU standards and adding relevant products to the Cyber Resilience Act’s important class II category, which would require independent assessment before sale. It also wants NIS2 to cover companies able to control enough capacity to threaten grid stability, regardless of their size or location, and urges steps to reduce dependence on non-EU companies able to influence devices at scale.
Cloud Access Can Scale Grid Risk
Home batteries and other connected equipment can respond to electricity-system needs, but shared remote-control infrastructure also creates a route for one technical failure to affect many devices. That makes the scale of control a relevant measure of cyber risk: a small provider could manage enough capacity to matter even if it falls below company-size thresholds in existing rules.
The regulator’s concern is not that a grid disruption has occurred. It is that a weakness in a common platform could reach multiple homes and devices at once, potentially changing electricity demand or supply. Independent checks and oversight focused on remotely controlled capacity could address risks that product-by-product rules or size-based company coverage may miss.
For households, the proposals concern the security and reliability of connected energy services, rather than an announced change to battery use or consumer obligations. The inspectorate’s wider point is that device security and energy-system resilience need to be considered together as more equipment connects to remote platforms.
Top picks for "dutch regulator flag"
As an affiliate, we earn on qualifying purchases.
EU Rules Leave Coverage Gaps
Under the Cyber Resilience Act, products such as connected energy devices face general cybersecurity requirements, but manufacturers assess their own compliance under the current approach. The relevant requirements apply to products placed on the EU market from December 11, 2027. The inspectorate argues for tailored standards and independent assessment for products whose compromise could have a wider effect.
NIS2, the EU directive on cybersecurity risk management, applies largely according to an entity’s size, although national authorities can designate some smaller firms. The inspectorate says this can leave smaller providers, as well as some energy companies and manufacturers without an EU establishment, outside its reach. It also notes that a provisional list under the Network Code on Cybersecurity, with obligations due to take effect in mid-2028, does not yet include manufacturers or energy-management providers.
The warning comes as connected equipment is spreading. The inspectorate says the number of heat pumps and EV chargers in the Netherlands grew fivefold from 2019 to 2024. Separately, a European Commission expert group recommended this month that solar inverters be classed as important class II products, but said its analysis did not cover batteries, heat pumps or EV chargers.
“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid.”
— Harm van den Brink, security researcher at the European Network for Cyber Security
Scope and Policy Response Remain Open
The position paper sets out the Dutch inspectorate’s recommendations; it does not itself change EU law. It is not yet clear whether the European Commission or EU lawmakers will adopt its proposed capacity-based NIS2 coverage, product categories or limits on non-EU dependencies. The source material gives no timetable for a formal decision on these proposals.
The scale of real-world exposure is also uncertain. The inspectorate describes ways devices could be affected and cites a grid-imbalance threshold, but does not report that a coordinated attack has caused such an imbalance. The Commission expert group’s current recommendation covers solar inverters, while batteries, heat pumps and EV chargers were outside that analysis and may be considered later.
EU Review Will Shape Coverage
The next step is whether EU institutions take up the inspectorate’s proposals as cybersecurity rules and standards are developed. The existing CRA requirements for relevant products are scheduled to apply from December 11, 2027, while the Network Code on Cybersecurity obligations are due from mid-2028. Those dates do not establish that the regulator’s recommended changes will be in force by then.
The Commission expert group’s later consideration of batteries, heat pumps and EV chargers could clarify whether more products join solar inverters in an enhanced category. Until policy decisions are made, the inspectorate’s paper is a warning and a set of proposals, not a new legal requirement for manufacturers, service providers or households.
Key Questions
What is the Dutch regulator warning about?
It says shared cloud platforms used to manage home batteries and other energy devices could let one fault or cyberattack affect many connected systems at once, potentially posing a risk to grid stability.
Has a cyberattack disrupted the electricity grid?
The source material does not report a grid disruption caused by such an attack. The inspectorate describes potential attack routes and risks, not a confirmed incident.
What changes does the inspectorate want?
It proposes independent assessment for certain energy devices and NIS2 coverage based on the amount of power a company can control remotely, rather than company size alone. It also calls for reduced dependence on non-EU providers able to influence devices at scale.
Do the proposals change the rules for households now?
No. The position paper makes recommendations to EU policymakers; it does not create new household requirements or immediately change the law.
When do the cited EU requirements take effect?
The source says relevant Cyber Resilience Act requirements apply to products placed on the EU market from December 11, 2027. Network Code on Cybersecurity obligations are due to take effect in mid-2028; the proposed changes have not been confirmed as adopted.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
