UK reviews cybersecurity requirements for public EV chargers

The UK Department for Transport (DfT) has launched a consultation on proposed cybersecurity requirements for public EV charging points, which could lead to the establishment of a common minimum standard for chargers sold or installed across Britain.

Image: Connected Kerb

According to the department, several potential threats to UK charging networks have been identified – including “a direct attack on charge points or where they are manipulated or misused to compromise other parts of the charging network”. The DfT has said that such incidents could disrupt charging services and potentially affect businesses, drivers, and wider national infrastructure.

In response, the DfT is now proposing mandatory security standards for public charge points, namely: compliance with the ETSI EN 303 645 cybersecurity standard, which covers baseline protections for connected devices including authentication, secure software updates, and vulnerability management. It is also considering accepting the European EN 18031 standard as an equivalent route to compliance, helping manufacturers avoid having to meet separate requirements for the UK and EU markets.

These proposals also go further than software security; public charge points could be required to incorporate physical anti-tampering measures, including protective seals, sensors to detect unauthorised access, and notifications when someone attempts to access internal components. Additionally, it proposes that all public chargers should include electricity meters compliant with the Measuring Instruments Regulations 2016. These would need to meet at least Class B accuracy requirements, meaning measurements of electricity supplied must be accurate to within two per cent. The measure is intended to reduce the risk of meter tampering and protect consumers and charge point operators against fraud.

The DfT said there are currently no specific cybersecurity requirements for public chargepoints, although domestic and small non-domestic chargers are already subject to requirements under the Electric Vehicles (Smart Charge Points) Regulations 2021. If adopted, the proposed requirements would apply to newly sold or installed public chargers. Existing equipment would not need to be retrofitted, but replacement units would have to comply.

The consultation is open until 20 December 2026, with the department also considering a possible second phase introducing further cybersecurity requirements for charge point operators and e-mobility service providers. Those interested in contributing to the consultation can submit their responses via online form, email, or post.