An expert group advising the European Commission has recommended restricting components and software from high-risk suppliers in every segment of the European Union’s PV market, from plug-in systems to utility-scale plants.

The report, “Recommendations to address cybersecurity risk in photovoltaic generation,” was prepared by the cybersecurity working group of the European Commission’s Smart Energy Expert Group (SEEG). It reflects a consensus among the group’s experts and “does not represent the opinion of the European Commission,” according to the document.

An 11-member subgroup carried out the analysis. It included representatives of SolarPower Europe, ENTSO-E, Eurelectric, Germany’s Federal Office for Information Security (BSI) and the Council of European Energy Regulators (CEER), as well as two members from the European Solar Manufacturing Council (ESMC).

The experts said the European Union’s installed PV capacity grew from 86 GW in 2015 to 406 GW in 2025. They said the risk has become more urgent because of serious vulnerabilities found in inverters, rising geopolitical tensions and “the EU’s heavy dependence on PV equipment of Chinese origin.” The report does not designate any country or company as a high-risk supplier.

The report assessed risks across four segments: plug-in residential, residential, commercial and industrial (C&I), and utility-scale. It measured impact by the amount of generation an attacker could control, compared with the continental European grid’s 3,000 MW of frequency containment reserves.

It identified three high risks: attacks on manufacturer cloud platforms connected to large numbers of inverters; backdoors introduced by manufacturers on behalf of a nation-state, which it said applies to all segments; and attacks on utility-scale plants through local networks.

Source link