The Department for Transport (DfT) has launched a consultation on requirements to meet a consistent baseline of cybersecurity for public electric vehicle charge point devices in Britain. The
The Department for Transport (DfT) has launched a consultation on requirements to meet a consistent baseline of cybersecurity for public electric vehicle charge point devices in Britain.
The consultation, which is open until 20 December 2026, explores ways to enforce a strict cybersecurity baseline and physical anti-tamper protections on all public electric vehicle chargers sold or installed in Britain, with the support of external industry and specialist consultant advisors.
Despite rapid network expansion, there are currently no specific cybersecurity mandates for public infrastructure. Securing these chargers against hacking threats is vital to protecting the integrity of the network, preventing localised infrastructure blackouts, and maintaining driver confidence.
A range of risks to the charging ecosystem have been identified, which include risks involving direct attacks on charge points and risks where charge points are manipulated or misused to compromise other parts of the charging network.
The landscape for cybersecurity for EV charging is developing in different ways.
Domestic and small non-domestic charge points (excluding public charge points) must comply with cyber requirements set out in the Electric Vehicles (Smart Charge Points) Regulations 2021 (EVSCP). These requirements are due to be revoked and replaced as part of the proposed Energy Smart Appliance Regulations in due course.
For large-scale public networks, the rules are different. Public charging organisations controlling 300 megawatts or more of electrical load, in aggregate across their network, will be in scope of the Network and Information Systems Regulations 2018 (NIS). This will require these organisations to meet cybersecurity requirements set out in the profile based on the National Cybersecurity Centre’s cyber assessment framework. This change is subject to the passage of the Cybersecurity and Resilience Bill through parliament. Details of these proposals are being consulted on by the Department for Energy and Net Zero (DESNZ).
Most organisations will not initially fall within the scope of the NIS regulations. However, many devices are likely to have some protections given requirements in other markets, such as the European Union.
In the first phase of action, DfT plans to introduce a consistent baseline level of cybersecurity for public charge point devices. This consultation seeks views on a preferred option for intervention.
Proposals include:
A second phase could potentially place further cybersecurity requirements on public charge points and on the organisations that control these devices, requiring charge point operators (CPOs) and e-mobility service providers (eMSPs) to follow a framework for cybersecurity best practice.
Alongside this consultation on the cybersecurity of public charge points, the DESNZ and DfT intend to separately consult on requiring charge points to be equipped with the EV-to-charge-point communication standard ISO 15118-20.
The DfT stressed that it’s seeking to enhance cybersecurity in this sector while maintaining the momentum of the public charge point rollout, “ensuring business confidence by creating a policy that is harmonised across the sector”.
More details of the consultation and how to respond are on the official gov.uk website.
