The Netherlands’ digital infrastructure inspectorate, the Rijksinspectie Digitale Infrastructuur, says a faulty update or cyberattack on manufacturer and aggregator platforms could switch enough inverters, home batteries, heat pumps and EV chargers at once to destabilize the grid. It argues in a recently published position paper that the EU Cyber Resilience Act and NIS2 directive only partly cover the companies behind those platforms.

The biggest risk sits not in individual devices but in the backend systems of manufacturers, energy management system providers and aggregators, and in the cloud platforms they use, according to the inspectorate. Because large groups of devices connect to the same backend, a single point of entry can control many of them.

A sudden imbalance between supply and demand of 3 GW or more can disrupt the grid, the regulator says, citing research by SolarPower Europe. It says the number of heat pumps and EV chargers in the Netherlands grew fivefold between 2019 and 2024.

The inspectorate identifies three ways large numbers of devices could be affected simultaneously. A manufacturer or other party with remote access could push a faulty update or setting, attackers could exploit vulnerabilities in devices or their control platforms, or a state could compel manufacturers and service providers under its jurisdiction to cooperate.

Under the EU Cyber Resilience Act, such devices face only general cybersecurity requirements and manufacturers assess their own compliance, while the requirements apply only to products placed on the EU market from Dec. 11, 2027.

NIS2 applies mainly according to company size rather than the capacity a company can control remotely, so smaller companies fall outside unless designated by national authorities, as do energy companies and manufacturers without an EU establishment.

Source link