What are the three serious cybersecurity risks identified by the European Commission's Smart Energy Expert Group for solar PV systems?

The study highlights attacks on manufacturer platforms, intentional backdoors by nation-state actors, and attacks on utility-scale installations. These vulnerabilities could cause grid imbalances, congestion, or widespread power outages if exploited by malicious actors.

How should internet communication from inverters in utility-scale solar installations be controlled to mitigate cybersecurity threats according to the new study?

All traffic must be documented, encrypted, and authenticated, with outbound connections restricted to whitelisted EU servers. No inbound communications should be permitted from outside these secure, jurisdiction-controlled environments to prevent unauthorized access.

How do the revised Cybersecurity Act and Industrial Accelerator Act aim to mitigate backdoor risks in solar PV supply chains?

These acts restrict the use of high-risk suppliers, particularly those from jurisdictions posing significant cybersecurity threats. This mitigation strategy applies broadly, including to residential installations and plug-in equipment, to ensure supply chain integrity.

Study raises alarm over cybersecurity of solar PV systems

As Europe’s solar PV penetration grows rapidly – from 86GW in 2015 to 406GW in 2025 and projected to reach 718GW by 2030 – it is considered to present an increasing cybersecurity risk to the electricity system as these installations are now widely connected to the internet.

Should the installations be exploited, it could cause imbalances, congestion in the grid or voltage disturbances that, in the worst case, could lead to widespread power outages.

The risk is further exacerbated with serious vulnerabilities in inverters being discovered by security researchers, rising geopolitical tensions and the EU's heavy dependence on PV equipment of Chinese origin.

A new study from the cybersecurity working group of the European Commission’s advisory Smart Energy Expert Group has identified three particularly serious risks.

Attacks on manufacturer platforms to which PV installations are connected, especially for residential, commercial and industrial installations.

Introduction of intentional backdoors in the central platform or in the inverter hardware or firmware by the manufacturer on behalf of a nation state actor, applicable to all use cases.

Attacks on utility-scale installations through local networks in which the threat actor gains access to a remote access firewall.

To address these issues, the working group recommends several mitigating measures, starting with manufacturers of internet-connected devices used in the installations being required to establish robust vulnerability handling processes for their cloud platforms, with clear and enforceable timelines for patching.

Bug bounty programmes should be encouraged to further incentivise independent security research.

The use of components and software from suppliers subject to the jurisdiction of third countries identified as posing significant cybersecurity risks also should be restricted, drawing on the criteria established in the proposed revised Cybersecurity Act.

For commercial, industrial and utility-scale installations, automatic firmware updates triggered by manufacturers should be replaced by controlled manual updates conducted by qualified maintenance providers.

For utility-scale installations, internet communication from inverters should be systematically controlled: all traffic should be documented, encrypted, and authenticated; outbound connections should be restricted to whitelisted servers located within the EU or under equivalent jurisdictions; and no inbound communications should be permitted from outside the local network.

The group also recommends that cyber attack scenarios on are incorporated into electricity system risk assessments conducted for instance under the risk preparedness regulation and the system operation guideline.

Legal gap analysis

The working group also performed a legal gap analysis to determine how well existing EU legislation can be used to enforce mitigating measures against the cybersecurity risks.

A top finding is that the Cyber Resilience Act applies to inverters but does not provide strong enough verification to enforce the recommended mitigation measures. To strengthen the verification, a harmonised standard for PV inverters should be developed and inverters should be classified as important products, so that they must undergo an independent conformity assessment by a notified body.

Another finding is that the NIS2 directive and NCCS provide meaningful coverage for utility-scale producers and aggregators but the thresholds in these regulations should be aligned to make them easier to apply for competent authorities.

The NIS2 directive coverage also should be completed with the inclusion of PV installers alongside installers as managed service providers and PV installations owned by essential entities outside the electricity sector.

Another finding is that the Network Code on Requirements for Generators (RfG), which applies to all PV installations larger than 0.8kW, does not include cybersecurity requirements and its extension is recommended to require that the owners of installations use installers with verifiable minimum qualifications in cybersecurity.

The work group also notes that no existing regulation adequately addresses the risk of intentional backdoors in supply chains, particularly from manufacturers subject to the jurisdiction of countries identified as posing significant cybersecurity risks. This risk should be mitigated by restricting the use of high-risk suppliers through the revised Cybersecurity Act and the Industrial Accelerator Act and that these restrictions apply also to residential installations, including plug-in equipment.