Summary
- The Department for Transport proposes a common cybersecurity baseline for public EV charge points.
- The consultation considers ETSI EN 303 645, alternative European standards, and physical tamper protection.
- Responses are invited until 20 December 2026, with implementation and assurance arrangements still under consideration.
The UK Department for Transport is consulting on cybersecurity requirements for public electric vehicle charge points, proposing a common security baseline for connected charging equipment sold or installed in Great Britain.
The consultation, published on 29 October, would introduce requirements covering digital product security, physical tamper protection, and electricity metering. It also considers how the proposed British rules could recognise equivalent European standards to avoid unnecessary duplication for manufacturers supplying multiple markets.
At the centre of the proposals is ETSI EN 303 645, a cybersecurity standard developed for connected consumer devices. The department is considering requiring public charge points to comply with this framework, supported by assessment arrangements based on associated testing specifications.
Manufacturers may alternatively be permitted to demonstrate compliance through EN 18031, a European standards family associated with cybersecurity requirements under the Radio Equipment Directive. The government is examining whether such equivalence could provide appropriate protection while supporting access to both the British and European markets.
The proposals remain under consultation and have not yet become operative product requirements. The government is seeking views on the appropriate standards, the costs of compliance, and the methods by which products should demonstrate that they meet the proposed baseline.
Public EV charging equipment operates at the intersection of electrical infrastructure, connected-device software, payment systems, and remotely administered services. Charge points may communicate with central management systems and can be connected to wider networks used for monitoring, billing, and maintenance.
That connectivity creates opportunities for efficient operation and remote management, but it also introduces potential security exposure. A compromised charge point could be manipulated directly or potentially used as a route to other components within a charging network, depending on the architecture and permissions involved.
The Department for Transport has identified both of these scenarios among the risks it intends to address. Its proposed baseline would focus initially on the security of the devices themselves, with further requirements for operators and connected services potentially considered in a later phase.
Physical security forms a separate part of the consultation. Public charging equipment is often installed in accessible locations, allowing legitimate users to interact directly with the device while also creating opportunities for interference with its housing or internal components.
The department is considering additional anti-tamper measures, including approaches that could make unauthorised access more difficult to conceal or provide notification when equipment has been opened.
Meter integrity is also included. The consultation proposes that public charge points incorporate meters compliant with the Measuring Instruments Regulations 2016, supporting consistent measurement and reducing the risk of manipulation affecting the electricity supplied and billed.
The government is examining how the proposed product requirements would interact with existing and developing legislation. Domestic charge points already fall within a separate regulatory framework, while larger charging operators may face additional duties under proposed changes to the UK’s Network and Information Systems regime.
The consultation identifies public charging organisations controlling 300 megawatts or more of electrical load across their networks as potentially falling within the scope of future NIS-related requirements, subject to the relevant legislation progressing through Parliament.
Meanwhile, European manufacturers are preparing for the Cyber Resilience Act’s wider product security obligations. The proposed recognition of equivalent standards would help determine whether suppliers need separate compliance processes when selling similar charging equipment across different jurisdictions.
Assurance arrangements are also unresolved. Options include supplier self-assessment with regulatory spot checks or third-party certification through accredited organisations. The balance between these approaches could affect compliance costs, market access, and the practical ability to verify manufacturers’ claims.
The Department for Transport is accepting responses until 11:59pm on 20 December 2026. The consultation will inform whether the proposed requirements proceed, how compliance would be demonstrated, and the timetable for introducing new obligations.
