Cybersecurity for BESS & PV Inverters: 3 EU Regulatory Frameworks with an 80 % Market Share in China

According to the German government, 70 to 80 percent of the PV inverters used in Europe come from Chinese manufacturers. In parallel, regulatory initiatives are gathering momentum globally, at the EU and federal level, which are classifying this very dependence as a security risk for critical energy infrastructure. The discussion about cybersecurity in renewable energy (EE) installations has intensified significantly.

The energy transition has fundamentally changed the structure of our electricity supply. From a few large, centralized power plants, we have moved towards millions of decentralized, digitally connected actors (such as wind farms, large photovoltaic installations, and virtual power plants). In addition, there are energy management systems (EMS) that are connected in real time to grid operators, marketplaces, and aggregators, and that control the energy flows of a company. From the perspective of IT security, this creates a huge, hard to control attack surface. This is increasingly coming to the focus of geopolitical motivated actors or criminal organizations.

For operators and investors of battery energy storage systems (BESS) and PV plants, this creates a new, three-pronged compliance field. The implementation of NIS-2 in the BSIG and EnWG, the EU Cyber Resilience Act (CRA), and the ongoing reform of the Cybersecurity Act (CSA) with a potential high-risk vendor list. This article classifies the current status and shows what is relevant for operators with immediate effect.

Why the issue is escalating now

The issue is escalating because inverters and battery management systems (BMS) are no longer passive components today; they are interconnected, remotely controllable components with cloud connectivity, firmware updates, and sometimes far-reaching remote control functions. It is precisely this connectivity that is attracting the attention of security authorities – not the solar or storage technology itself, but the control over the digital interfaces.

Among the triggers of the current debate were reports that undocumented communication components were identified in the wiring of Chinese power adapters and in batteries from several Chinese suppliers – according to press reports citing U.S. government officials, some of which included mobile phone modules. These details could not yet be independently verified, but have led to an accelerated regulatory reassessment both in the United States and in the EU.

The German government bases its risk assessment not only on technical criteria, but also explicitly on legal and geopolitical criteria: Chinese companies are subject to far-reaching legal obligations to cooperate with government agencies, which, from a German and European perspective, constitutes a structural risk regardless of the specific case.

The Three Key Areas of the Cybersecurity Debate

The “Regulatory Shock”: NIS-2 and the New IT Security Catalogs

Regulatory pressure regarding cybersecurity is noticeably increasing. Operators of renewable energy facilities are under immense pressure to implement new legal requirements:

• NIS-2 Implementation: The European Cybersecurity Directive now also imposes obligations on many medium-sized operators and suppliers. Whereas previously only facilities with a capacity of 104 MW or more were considered “critical infrastructure” (KRITIS), the scope has now been expanded to include many more. In addition, the KRITIS umbrella law, effective January 2026, expands physical protection requirements for renewable energy facilities, mandates risk analyses, resilience measures, and crisis and emergency management, and establishes reporting obligations. The German Renewable Energy Federation (BEE) is therefore calling for a balanced approach to ensure that smaller operators are not overwhelmed by red tape.
• Updating the IT security catalogs: The Federal Network Agency has tightened the requirements for power grid and system operators. The focus is now much more clearly on process-oriented approaches – that means continuous risk analyses and a functioning business continuity management (BCM) to remain operational in the event of outages.

Technical Vulnerabilities and the “Cloud Dilemma”

The Federal Office for Information Security (BSI) and industry experts are warning of structural shortcomings in the cybersecurity of renewable energy systems in practice:

• Direct Internet Access: In the past, many solar and wind power plants were quickly connected to the grid without giving priority to IT security. Open ports on routers or default passwords often make it easy for attackers.
• Vendor lock-in: A major topic of discussion is the functional dependence of control systems on manufacturers’ clouds (often located outside Europe). If the cloud goes down or is hacked, the operator loses control of the system. The BSI therefore strongly recommends switching to local operation or using highly secure connections (such as VPNs).
• Lack of segmentation: Unlike older fossil-fuel power plants, the networks in renewable energy facilities are often not clearly separated into administrative IT and operational technology (OT).

The Supply Chain as a Point of Entry (Supply Chain Risks)

An attacker does not have to hack every wind turbine or solar park individually. If the software of the manufacturer of the grid-forming inverters or the remote maintenance service provider is compromised, thousands of installations can be manipulated at once. This applies equally to the digital infrastructure of C&I storage or utility-scale BESS. NIS-2 therefore explicitly takes responsibility for the entire supply chain. Operators must actively review their service providers and the cybersecurity of the purchased components.

Systemic risk: A single compromised wind turbine does not pose a threat to the power grid. However, if thousands of decentralized power generators are coordinated to be shut down or manipulated through poorly secured interfaces or botnets, this can jeopardize the stability of the entire power grid.

The regulatory triad for cybersecurity: NIS-2, CRA and CSA reform

Brussels and Berlin have responded to this mix of technical attack surface, market concentration, and geopolitical control. They have not done so with a single law, but with a multi-tiered regulatory framework. It addresses cybersecurity for operators, manufacturers, and individual suppliers separately. These three regulatory frameworks overlap, intermingle, and are relevant to operators of BESS and PV systems:

Quick Overview

Important for classification: The three regulations work in a complementary way. NIS-2 requires the operator, CRA requires the manufacturer, and the CSA reform potentially decides which manufacturers are still allowed to operate. An operator can be set up in accordance with NIS-2 and still use a product that is later included on a high-risk list. Thus, although the issues are legally separate, they cannot be considered in isolation in practice.

What is a “critical component” – and who is allowed to ban it?

The NIS-2 Implementation Act abolished the previous, complex obligation for manufacturers of critical components to provide a declaration of warranty and replaced it with a more flexible, risk-oriented review and prohibition procedure. The Federal Ministry of the Interior (BMI) can prohibit operators of critical systems from using critical components from a specific manufacturer or issue orders if this use is likely to impair public order or safety. During the review, the BMI takes into account, among other things, whether:

• the manufacturer is directly or indirectly controlled by the government of a third country,
• the manufacturer is or can be obliged to cooperate with state authorities or armed forces of a third country,
• the manufacturer was involved in activities that could impair public policy or security of the Federal Republic or other EU/EFTA states.

In the energy sector, critical functions and components have been fundamentally defined since 2025; starting in 2026, they must be reported to the authorities as part of the registration as an operator of critical facilities. Concrete requirements for grid and system control functions already apply to transmission system operators; an expansion to other facility categories is foreseeable.

At the EU level, the debate is taking a step further: the European Investment Bank is already gradually phasing out new financing for projects involving inverters from high-risk countries (China, Russia, Iran, North Korea), with a transition period for ongoing projects until November 1, 2026, and a stricter phase starting in April 2027. According to the Commission, inverters account for around 5 percent of the costs of large solar plants; switching to lower-risk suppliers is expected to increase total project costs by an estimated less than 2 percent.

Component import instead of finished product import as a solution for cybersecurity?

The public often simplifies the debate into a contrast between „Chinese manufacturers vs. European manufacturers”. In practice, at CUBE CONCEPTS we are observing a third, increasingly common approach that combines cybersecurity and cost-effectiveness. Manufacturers import individual components – solar cells or modules, battery cells, power semiconductors – directly from China, assemble the end products (module, inverter, battery storage) in Europe and equip them with European control, communication, and security software.

This is relevant for regulatory classification because both NIS-2/BSIG and the debated high-risk vendor list focus primarily on the legal manufacturer and its control structures – not on the origin of individual components. The mentioned BMI evaluation criteria (control by a third-country government, mandatory cooperation with state agencies) are tailored to the manufacturer in the legal sense, not to the physical supply chain of preliminary products. This opens up a scope for interpretation that has not yet been conclusively clarified in the current legislative texts and consultations:

• Does an inverter whose power semiconductors come from China, but which is finally manufactured by a European company with European firmware, count as a product from a high-risk manufacturer?
• Is a European software and communication layer sufficient to address the remote access and backdoor concerns discussed in connection with Chinese manufacturers – or does a risk remain at the component level, for example in battery cells with factory-integrated BMS firmware?
• How is such a hybrid manufacturing chain mapped within the scope of the CRA conformity assessment (Bill of Materials/SBOM, technical documentation according to Annex VII) when essential preliminary products originate from third-country suppliers?

For planners, operators, and investors, this means that merely checking the country of manufacture falls short. Anyone who wants to make reliable statements about the supply chain should also inquire about the origin of critical intermediate products (cell chemistry, power electronics, communication modules) as well as control over the software and firmware level – regardless of where final assembly takes place.

BESS versus PV Inverters: Different Risk Profiles

The public cybersecurity debate has so far focused heavily on PV inverters because their market concentration among Chinese manufacturers (including Huawei, Sungrow, Ginlong Solis) is particularly pronounced. For BESS operators, several points need to be considered separately:

• Battery management systems (BMS) and power electronics (PCS) are subject to the same fundamental connectivity risks as inverters – reports on undocumented communication modules concern not only inverters but also battery components from several Chinese suppliers, according to press reports.
• Large-scale storage facilities with grid services contracts (regular energy, redispatching) are potentially more sensitive from a network stability perspective than distributed small-scale systems, as they bundle concentrated power with direct system relevance – at the same time, they are generally already subject to stricter requirements today, such as NIS-2 or the BNetzA IT security catalogue, if they are classified as a critical facility.
• Smaller, distributed systems (home storage, small C&I systems) are generally less well regulated, although they are also connected to proprietary cloud services or installer backends, which can pose an aggregated risk.

For operators and investors, this means that the cybersecurity assessment of a project should not only consider the inverter level, but the entire digital chain – BMS, EMS, PCS, communication modules, and the respective backend connections.

Practical implications for operators & investors

• Document supplier selection: Anyone who operates or might become an operator of a critical facility should already document the origin and legal control structure of inverter, BMS, and PCS manufacturers in a verifiable manner – not only when a prohibition order is imminent. This includes the component level: in the case of European final assembly with Chinese preliminary products, a look at the origin of the cell chemistry, semiconductors, and firmware is worthwhile.
• Keep track of deadlines: The CRA reporting obligations for manufacturers take effect starting in September 2026, and the full requirements apply from December 2027. Operators should demand evidence of the CRA roadmap from their suppliers early on, even though the obligation formally lies with the manufacturer.
• Check NIS-2 applicability: Operators that have not previously been classified as subject to KRITIS requirements (such as digital energy services/aggregators) may newly fall under the scope of the BSIG or EnWG due to the expansion of the addressed group.
• Regulatory development is not yet complete: The CSA reform with the potential high-risk manufacturer list is still in the legislative process; an exclusion of certain manufacturers is likely, but the scope and timing are still open.

Timeline: The most important cybersecurity deadlines

FAQ