The UK Department for Transport has opened a consultation on cyber security rules for public electric vehicle charge points. Its proposals aim to create one clear security baseline for devices sold or installed in Great Britain.
The consultation was published on 29 October 2026 and closes at 11:59pm on 20 December 2026. It focuses on new public charge points rather than requiring existing units to be upgraded.
Public Chargers Need Protection
Public charging infrastructure is becoming critical digital infrastructure. A successful attack could disrupt drivers, affect charging businesses, and create wider risks for energy systems.
The government identifies two main risk areas. First, attackers may target a charge point directly. Second, criminals may manipulate a charger to compromise other parts of the charging network.
Today, there are no device-specific cyber security requirements for public charge points in Great Britain. Domestic and small non-domestic smart chargers already follow the Electric Vehicles (Smart Charge Points) Regulations 2021.
Larger charging organisations may also face wider obligations. Operators controlling 300 megawatts or more of electrical load across their networks are expected to fall within the Network and Information Systems Regulations 2018, subject to the Cyber Security and Resilience Bill.
The National Cyber Security Centre’s Cyber Assessment Framework supports organisations in assessing cyber resilience. It focuses on managing risk, protecting systems, detecting incidents, and minimising their impact.
ETSI 303 645 as the Baseline
The central proposal is to require public EV charge points sold or installed in Great Britain to comply with ETSI EN 303 645. This standard sets baseline security requirements for consumer internet-connected devices.
ETSI 303 645 addresses common weaknesses in connected products. Its provisions include authentication, secure software updates, and vulnerability remediation.
The Department for Transport considers the standard suitable because it is familiar to industry. Many public charge point manufacturers already apply it, particularly because similar expectations exist in other markets.
The standard also has a companion assessment specification, ETSI TS 103 701. This can help manufacturers and assessors test whether a product meets the baseline requirements.
The obligation would apply to organisations that sell or install public charge points in Great Britain. Manufacturers, importers, and distributors placing devices on the market would therefore be affected.
A Possible Route Through EN 18031
The government is also considering EN 18031 as an equivalent compliance route. This European standard family supports cyber security requirements under the EU Radio Equipment Directive.
CEN and CENELEC describe EN 18031-1 as setting common security requirements for internet-connected radio equipment. Other parts address devices handling personal, traffic, or location data, as well as equipment processing monetary value.
The Department for Transport found substantial overlap between ETSI 303 645 and EN 18031. It assesses the remaining differences as superficial or of minimal security importance.
One example concerns updates. ETSI 303 645 gives more weight to consumer involvement in update processes, while EN 18031 explicitly requires most updates to be automatic. The government considers this difference unlikely to weaken security materially.
Allowing EN 18031 could reduce duplicate work for manufacturers selling in Great Britain, Northern Ireland, and the EU. The government says it will keep this equivalence under review as the EU Cyber Resilience Act develops.
Physical Tamper Protections
Digital controls alone may not address every risk. Public chargers are exposed in accessible locations, so physical interference remains a concern.
The consultation proposes anti-tamper requirements beyond ETSI 303 645. These would help prevent fraud and cyber attacks launched through physical interfaces.
The proposed protections include:
- Adequate protection against physical damage.
- A tamper-evident seal or sticker on non-serviceable internal components.
- A sensor that detects a breach of the charger casing.
- A notification to the end user when internal components are accessed.
These measures resemble existing requirements for domestic charge points under the EVSCP regulations. However, the government acknowledges that earlier implementation of tamper protections created challenges around clarity and lead times.
It therefore wants evidence on the most practical design and implementation approach. The consultation also asks where sensors and seals should be placed and whether better tamper-proofing methods exist.
Accurate Metering to Reduce Fraud
Meter tampering is another identified risk. Incorrect measurement could harm both drivers and charge point operators.
The proposal would require every public charge point sold or installed in Great Britain to include a meter compliant with the Measuring Instruments Regulations 2016. At minimum, it would need to be a Class B meter.
A Class B meter must measure active electrical energy to within 2% accuracy. The requirement would support fair billing and reduce opportunities for fraud through manipulated measurements.
The rules would apply to all new public charge points, including those used for trade. Meters approved under the EU Measuring Instruments Directive would also be permitted.
The Department for Business and Trade plans to amend the MIR by the end of 2027. The change would allow remote display options for active electrical energy meters in charge points and other smart energy appliances.
How Compliance Could Be Checked
The government has not yet fixed its enforcement model. It is consulting on two possible assurance approaches.
One option would require organisations to self-assess using ETSI TS 103 701 and related specifications. A regulator would then carry out spot checks.
The other option would require third-party certification through an accredited testing and certification body. This could provide stronger independent assurance, but may increase cost and administrative work.
The Department for Transport would also need a method to verify existing EN 18031 compliance if that standard is accepted as equivalent. Stakeholder feedback will shape the final approach.
Implementation and Business Impact
If adopted, the requirements would apply only to public charge points sold or installed after the rules take effect. Retrofitting existing chargers would not be required.
When old devices reach the end of their service life, replacements would need to meet the new requirements. The government encourages early adoption, while recognising that hardware changes can take time.
The consultation asks businesses for detailed cost evidence. Responses should distinguish one-off, annual, per-unit, and ongoing compliance costs where possible.
The government estimates a net annual direct cost to businesses, but wants better evidence before finalising policy. It is particularly interested in marginal costs beyond normal production practices.
What Stakeholders Should Consider
Manufacturers, importers, distributors, and charge point operators should review the proposals carefully. The outcome could affect product design, procurement, certification, and market access.
Key issues for respondents include:
- Whether ETSI 303 645 is the right baseline for public chargers.
- Whether EN 18031 should be accepted as an equivalent standard.
- The practical value and cost of tamper sensors and seals.
- Whether Class B metering should apply to every new public charger.
- Whether self-assessment or third-party certification is more appropriate.
- Reasonable implementation timelines for software and hardware changes.
A second phase could introduce further obligations for charge point operators and e-mobility service providers. This may involve a best-practice framework covering the organisations that control public charging devices.
Separately, the Department for Transport and the Department for Energy and Net Zero plan to consult on requiring ISO 15118-20 communication capability. The government says it will align timelines across the two workstreams.
Sources: UK DfT
