Cybersecurity: Inverters, Storage & EMS

Solar inverters, battery energy storage systems, battery management systems (BMS) and energy management systems (EMS) are connected, software-driven devices. They receive remote updates, exchange data with cloud platforms and can be controlled from outside. With hundreds of gigawatts installed across Europe, they have become critical digital infrastructure: if they are compromised, generation and storage could be switched off or manipulated at scale, putting grid stability at risk.

Technical and non-technical risks

Technical risks – vulnerabilities in hardware, firmware and software – must be addressed through secure-by-design products, strict standards and independent testing. But technical measures alone are not enough. Non-technical risks are just as decisive: who owns and controls the manufacturer, which government can compel it to act, and who operates remote access and software updates. A product can meet every technical standard and still pose a risk if its manufacturer is subject to the jurisdiction of a high-risk country.

Our position

• Address technical and non-technical risks together in EU law – in the revision of the Cybersecurity Act (CSA2), the Cyber Resilience Act, NIS2 and the Industrial Accelerator Act.
• Restrict components, software and remote access from high-risk suppliers for inverters, storage, BMS and EMS – in all segments, from utility-scale plants to residential and plug-in systems.
• Classify inverters and related energy devices as important products under the Cyber Resilience Act, with independent conformity assessment.
• Secure and control the communication and data flows of installed devices, including remote updates.
• Apply the exclusion of high-risk inverters from EU funding consistently in all Member States and support programmes – and apply the same logic to storage and energy management systems.

The EU has started to act: in April 2026 the Commission excluded inverters from high-risk countries from EU funding, and in October 2026 an expert report under the Commission’s Smart Energy Expert Group recommended restricting high-risk suppliers in all PV segments. ESMC was represented in the expert group. European and other Western manufacturers can deliver – EU inverter production capacity alone already exceeds Europe’s annual solar market. This work is led by the Inverter, Storage and EMS Forum (ISEF).