What is on the table — and what is not
A report is not a regulation. That is the first sentence this story needs. A cybersecurity working group of the European Commission's Smart Energy Expert Group (SEEG) has published a report titled "Recommendations to address cybersecurity risk in photovoltaic generation". In it, the group recommends restricting components and software from suppliers with high cyber risk — for rooftop systems as much as for utility-scale parks.
A recommendation means nothing is decided yet. Two legislative processes are running in parallel that could turn it into rules: the planned revision of the Cybersecurity Act (CSA2) and the Industrial Accelerator Act (IAA), through which the EU also intends to raise "Made in EU" requirements. While those are open, the report signals direction — not law.
And: no country and no company is named. The report describes risk classes, not a list of addresses. Anyone who turns this story into a name has not read it.
Three attack surfaces the report names
The report names three routes through which a storage or inverter system becomes attackable:
1. The manufacturer's cloud platform. Whoever runs monitoring and control through a vendor cloud gives that cloud an attack surface — and gives the vendor control over the data flow.
2. Left-behind access ("backdoors") attributed to state actors. The report discusses risks from state actors without assigning them to a country.
3. Direct attack on large plants via the local network. Not over the internet, but over what is cabled on site.
The most interesting point is structural: the so-called "split operational architecture" — monitoring hosted in the EU, while firmware updates are controlled from another jurisdiction. To the operator it looks like a European solution; technically the switch sits elsewhere.
Why this shifts procurement
Until now a storage system was bought on three things: capacity, output, price. Cybersecurity was a line in the annex, if that.
If the recommendation becomes a rule, a fourth dimension arrives that cannot be compared in a datasheet: who can push software onto the device? From where? And what happens when that connection is cut — does the unit keep running?
That hits a rental fleet twice. First, because fleets are monitored through portal software today: if the vendor cloud goes away, the view of the fleet goes away. Second, because units stay in the fleet for five to eight years — a certificate that fitted at purchase has to still fit in year five.
Four questions that belong in the tender now
These four are worth asking regardless of whether CSA2 arrives. They cost nothing but an email:
1. Where does the update chain sit? Who signs the firmware, and from which jurisdiction is it delivered?
2. What keeps running without the cloud? Can the unit charge and discharge in island mode when the vendor connection is cut?
3. What role does remote service play? Is it optional, switchable off, or a precondition for operation?
4. What evidence exists in writing? Not "we are secure", but test report, standard, date.
The last point matters most — and it is where most offers get thin. A statement about security without a document is an opinion.
Where the details come from
This text is based on reporting on the SEEG report: mvapulse.com – "EU Expert Group Proposes Curbs on High-Risk Solar Suppliers" (9 October 2026), which relays the recommendations, the three risk vectors and the composition of the working group. Supplemented by pv-magazine.de – "Beschränkungen auch bei Batteriezellen drohen" (26 October 2026) on CSA2, the IAA and the "Made in EU" requirements.
For calibration: the report is a recommendation to the Commission, not law in force; both legislative processes named are unfinished. The attack surfaces listed are the report's, not our assessment of individual suppliers. The figure of 86 GW (2015) to 406 GW (2025) of installed PV capacity in the EU comes from the same reporting and is not broken down further there. This text does not rate manufacturers or countries of origin.