EU Energy Experts Urge Restrictions on High-Risk Solar Components
A European Commission expert group says inverters and solar software from high-cybersecurity-risk suppliers should face limits across the whole market.
The Smart Energy Expert Group's cybersecurity working group, under the European Commission, published a report recommending restrictions on solar components and software from suppliers that pose high cybersecurity risks. According to aitimes.com, the recommendations cover the entire solar market, from small plug-in panels to residential, commercial, industrial and large-scale plants.
The report, titled "Recommendations on Responding to Cybersecurity Risks of Solar Power Generation," is based on expert discussions held in 2025 and 2026. It classifies three high-level risks: attacks via manufacturer platforms connected to multiple inverters, intentional backdoors inserted by manufacturers under state-actor influence, and attacks through the local networks of large solar plants.
Proposed measures
The group recommended restricting components and software from third-country suppliers posing particularly serious cybersecurity risks, including hardware and software vendors as well as inverter makers. It also proposed limiting automatic manufacturer firmware updates at commercial and large-scale plants, requiring qualified maintenance operators to test and apply updates manually instead.
A further recommendation would classify inverters as "Important Products Class II" under the Cyber Resilience Act, which would require independent conformity assessment by notified bodies. The report did not name any specific country or company as a high-risk supplier.
The EU's solar capacity grew from 86 GW in 2015 to 406 GW in 2025 and is projected to reach 718 GW DC by 2030. The bloc has proposed an amendment to the Cybersecurity Act that could provide criteria for defining high-risk suppliers, while the main obligations of the Cyber Resilience Act are set to apply from December 2027.
Quick answers
What did the EU expert group recommend for solar equipment?
It recommended restricting solar components and software from third-country suppliers posing particularly serious cybersecurity risks, and limiting automatic manufacturer firmware updates at commercial and large-scale plants.
Did the report name any high-risk supplier or country?
No. The report did not designate any specific country or company as a high-risk supplier.
When do the Cyber Resilience Act's main obligations apply?
The main obligations under the EU Cyber Resilience Act are set to apply from December 2027.