A SEEG report warns that cybersecurity risks in EU solar PV installations are rising as solar capacity expands, with potential attacks threatening supply disruption, grid overload, or voltage disturbances.

The report recommends policy and technical measures: require manufacturers to implement robust vulnerability handling for cloud platforms with deadlines, promote bug bounty programs, mandate secure traffic and approved servers for utility-scale installs, restrict components from high-risk suppliers based on risk assessments, replace automatic firmware updates with controlled manual updates and testing for backdoors, and emphasize secure design and training for residential systems.

It places the analysis in the regulatory context of the Cyber Resilience Act, NIS2, NCCS, and RfG, noting the EU’s country-neutral stance on inverter funding guidance while planning further discussions with China.

Gaps identified in EU rules include CRA not requiring independent verification for inverter safeguards or classifying inverters as important products; the proposal calls to classify PV inverters as Class II important products, harmonize NIS2/NCCS thresholds, extend supply-chain risk focus to high-risk suppliers and residential plug-in equipment, and incorporate PV cyberattack scenarios into risk assessments under EU instruments like Risk Preparedness Regulation and System Operation Guideline.

Three high-risk scenarios are outlined: attacks on manufacturer platforms connected to PV installations, deliberate backdoors by manufacturers for state actors, and attacks on utility-scale installations via local networks.

The complete report is available from the European Commission, with related industry analyses underscoring cybersecurity controls after outages and concerns about dependence on Chinese technology.

Risk factors include explosive growth of EU solar capacity—from 86 GW in 2015 to 406 GW in 2025 and a projected 718 GW DC by 2030—paired with rising internet-connected monitoring and control, amplifying exposure amid geopolitical tensions and reliance on Chinese PV equipment.

Projected impact: if solar generation is compromised, it could create supply-demand imbalances, grid congestion, voltage disturbances, and even power outages.