Home Batteries That One Cloud Can Switch Off
One of the quieter shifts of the energy transition is that a growing share of power consumption and generation runs on internet-connected devices. A solar inverter, a home battery, an EV charger or a heat pump no longer belongs only to the household: a manufacturer or service provider can control it remotely from the cloud. According to a position paper published on 7 October by the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI), this has created a new grid risk that EU rules only partly address (RDI, 2026a).
One back end, many devices
The RDI calls devices that control significant electrical power over the internet "high-power IoT". They include chargers, inverters, home batteries and heat pumps, but also connected ovens, washing machines and dishwashers. Their numbers are rising fast: the Netherlands had five times as many heat pumps and chargers in use in 2024 as in 2019.
The problem is not the individual device. Most of them run on the back end of the same manufacturer, energy management provider or aggregator, so a single point of access can control a very large number of devices at once.
The biggest risk lies not in the individual device but in the shared cloud back end.
The authority names three scenarios: a faulty update or setting, malicious exploitation of a vulnerability, and a state compelling a manufacturer or provider to act.
When the grid tips over
Europe's power grid is in balance when frequency is at 50 Hz. If it leaves the 49.99–50.01 Hz band, the large system operators activate frequency control. Citing an industry analysis, the RDI writes that a sudden imbalance of 3 GW can already disturb the grid. If an event drops frequency by 1 Hz per second, protection mechanisms cannot respond in time. The authority adds that the 3 GW figure is not an estimate of today's Dutch device fleet, nor a sign that home batteries are about to cause a nationwide blackout.
Where the rules fall short
The paper examines three pieces of EU legislation and finds gaps in each:
- Cyber Resilience Act (CRA). From 11 December 2027, every new product placed on the EU market must comply. For these devices, however, only general requirements apply, the manufacturer checks its own compliance, and there is no detailed European security standard. Devices placed on the market before December 2027 are exempt unless substantially modified later.
- NIS2 directive. It covers medium-sized and large energy companies. A small company that controls a lot of power remotely falls outside it unless the authorities designate it. Energy companies and manufacturers based outside the EU are not covered; only cloud and ICT service providers are.
- Network Code on Cybersecurity (NCCS). Its obligations take effect in mid-2028. The preliminary list includes aggregators, producers and charge point operators, but not manufacturers or energy management providers.
Three proposals
The RDI proposes three directions (RDI, 2026b):
- Device-level requirements. EU standards per device type that take grid risk into account, and classifying these devices as "important products, class II" under the CRA. An independent body, not the manufacturer, would then check them before they reach the market.
- Oversight of remote operators. Every company that controls enough power to endanger the grid should fall under NIS2, regardless of its size or where it is based.
- Digital autonomy. Some of the companies able to influence these devices at scale operate outside the EU, which creates a geopolitical dependency risk.
“Inverters, chargers and heat pumps make our electricity system smarter and more sustainable.”
The same gap everywhere in the EU
The CRA and NIS2 are EU law, so the gap the Dutch authority describes exists in every member state. Wherever solar panels and home batteries are spreading fast, and grid operation leans increasingly on these flexible devices, the questions become more pressing. Who controls these devices, from where, and who is responsible if a faulty update switches off thousands of them at once? The RDI's proposals target EU-level change, so the answer will have to come from Brussels.
A growing number of home batteries, solar inverters, EV chargers and heat pumps are connected to the internet, and many of them run on the same cloud back end operated by a manufacturer, an energy management provider or an aggregator. In a position paper published in October, the Dutch Authority for Digital Infrastructure (RDI) argues that these back ends are where the biggest risk lies. A faulty update, an exploited vulnerability or a manufacturer under pressure from a hostile state could switch large numbers of devices on or off at once. Research suggests a sudden imbalance of 3 GW can already disturb the grid. The RDI says EU cybersecurity rules only partly cover this risk. It proposes independent certification, device-specific EU standards and bringing companies that control enough power remotely under the NIS2 directive, whatever their size or location. Because the rules are European, the same gap exists in every member state.
One of the quieter shifts of the energy transition is that a growing share of power consumption and generation runs on internet-connected devices: solar inverters, home batteries, EV chargers and heat pumps. In the Netherlands, five times as many heat pumps and chargers were in use in 2024 as in 2019. Most of them run on the cloud back end of a manufacturer, an energy management provider or an aggregator.
According to a position paper published on 7 October by the Dutch Authority for Digital Infrastructure (RDI), that creates a new risk. If one central system switches many devices off or on at once, because of a faulty update, an exploited vulnerability or a manufacturer under pressure from a hostile state, it could push grid frequency out of balance. Research suggests a sudden imbalance of 3 GW can already disturb the grid if frequency leaves its safe band.
The authority says EU rules only partly address this. From December 2027 the Cyber Resilience Act sets only general requirements for these devices, and manufacturers certify their own compliance. The NIS2 directive is based on company size rather than the power a company controls, and barely reaches manufacturers outside the EU. The RDI therefore proposes device-specific EU standards, independent certification, and bringing every company that controls enough power to endanger the grid under NIS2, regardless of size or location. It also wants the EU to reduce its dependence on companies outside the Union that control European devices at scale. Because the rules are European, the same gap exists in every member state, and the answer will have to come from Brussels.
The IEA expects the first annual fall in renewable additions in 21 years, the biggest six-year expansion on record, and a grid that is now the main thing standing in the way.
A new report projects data centres' water footprint reaching 9.32 trillion litres by 2030, but the number is only meaningful once you know what it counts, and who is making the case.
From 4 November, companies that want to buy biomethane can post their demand on the European Commission's platform and producers can bid from January. Here is what to do now and what the scheme will not give you.
The Joint Research Centre mapped 1,300 hydrogen plants against local water resources and found the EU's targets reachable without a water crisis, though southern Europe and parts of central Europe will need careful planning.
