The United Kingdom Reviews Cybersecurity Requirements for Charging Points
According to the department, several potential threats to the UK’s charging networks have been identified, including “a direct attack on charging points, or the tampering with or misuse of such points to compromise other parts of the charging network.” The Department for Transport (DfT) has noted that incidents of this nature could disrupt charging services and potentially impact businesses, drivers, and the national infrastructure as a whole.
In response to these concerns, the DfT is currently proposing the implementation of mandatory security standards for public charging points. Specifically, it is proposing compliance with the ETSI EN 303 645 cybersecurity standard, which covers basic protective measures for connected devices. These measures include authentication, secure software updates, and vulnerability management. Furthermore, the adoption of the European standard EN 18031 as an equivalent compliance pathway is being considered; this would help manufacturers avoid having to meet different requirements for the UK and EU markets.
These proposals go beyond software security and could include a requirement for physical anti-tampering measures at public charging points, such as security seals, sensors to detect unauthorized access, and notifications in the event of an attempt to access internal components. Additionally, there is a proposal that all public chargers be equipped with electricity meters that comply with the Measuring Instruments Regulations 2016. To ensure the accuracy of electricity supply measurements, it is essential that these devices meet the minimum requirements for "Class B" accuracy, which is defined as 2% precision. The primary objective of this measure is to reduce the risk of meter tampering and to protect both consumers and charging point operators against fraud.
The Department for Transport (DfT) has indicated that there are currently no specific cybersecurity requirements in place for public charging points. However, domestic chargers and small non-domestic chargers are already subject to the requirements set out in the Electric Vehicles (Smart Charge Points) Regulations 2021. If the proposed requirements are approved, they would apply to public chargers that are newly sold or installed. While it would not be mandatory to retrofit existing equipment, any replacement units would be required to comply with these standards.
This consultation will remain open until December 20, 2026. The Department is also considering a second phase, which would introduce new cybersecurity requirements for charge point operators and providers of electric mobility services. Those interested in participating in the consultation may submit their responses via the online form, by email, or by post.
