EU Expert Group Warns Of Cybersecurity Risks In Solar Inverter Infrastructure
The Smart Energy Expert Group recommends restricting Chinese inverters and mandating independent security certifications to protect the power grid from potential cyberattacks.
An official advisory body to the European Commission, the Smart Energy Expert Group (SEEG), has warned that the cybersecurity of solar installations across Europe is significantly inadequate. The group’s report identifies three high-risk scenarios, including attacks via manufacturer cloud platforms, the potential for state-mandated backdoors, and vulnerabilities in local networks at utility-scale sites.
The SEEG warns that attackers could potentially manipulate enough inverter capacity to destabilize the continental European power grid. The group defines 3,000 megawatts as the critical threshold above which severe grid disruptions could occur. The report highlights that many manufacturers use a split operational architecture where monitoring dashboards are hosted in Europe, while firmware updates and control services are managed from countries deemed to pose a cybersecurity risk.
Existing regulations are currently insufficient to address these threats. The Cyber Resilience Act allows manufacturers to self-certify their products without independent testing, while the Network Code on Requirements for Generators focuses solely on electrical standards rather than cybersecurity. Furthermore, the NIS2 directive excludes consumer-level installations from its scope.
To mitigate these risks, the SEEG has proposed six recommendations. These include banning manufacturers from high-risk countries, such as China, and reclassifying inverters as class II products under the Cyber Resilience Act to mandate independent conformity assessments. The group also suggests restricting inverter internet traffic to servers located within the European Union or equivalent jurisdictions.
Additional proposals involve requiring professional installers to meet cybersecurity standards and shifting firmware update management for commercial and utility-scale systems from manufacturers to qualified local maintenance providers. This would allow authorities to block or delay updates during periods of heightened threat levels. Previous security research, such as the 2025 SUN:DOWN report, has already documented significant vulnerabilities in inverter communication protocols and cloud platforms.
