Europe’s photovoltaic fleet has grown from 86 GW in 2015 to 406 GW in 2025, and SolarPower Europe expects it to reach 718 GW by 2030. Yet much of that capacity is monitored and controlled through a small number of cloud platforms. When Bitdefender security researchers looked into the Solarman platform in 2024, they estimated it was coordinating around 195 GW of PV capacity worldwide through a single cloud back end. At that scale, cybersecurity becomes a question of grid stability, and that is the backdrop to a new expert report that could shape EU policy on solar for years to come.
The report, “Recommendations to address cybersecurity risk in photovoltaic generation,” was prepared by the Working Group on Cybersecurity of the European Commission’s Smart Energy Expert Group (SEEG) and presented on 1 October. The working group brings together experts from transmission and distribution operators, the solar industry, regulators, cybersecurity bodies and academia. Contributors included the European Solar Manufacturing Council (ESMC), represented by Jens Holm and Thomas Rührlinger of Fronius, as well as Germany’s Federal Office for Information Security (BSI).
Three high risks, from cloud to factory floor
The analysis divides PV generation into four use cases by size: plug-in systems below 0.8 kW, residential up to 10 kW, commercial and industrial up to 1 MW, and utility-scale above 1 MW. For each, the experts assessed five threat scenarios that could affect many systems at once: attacks through manufacturer cloud platforms, local networks, installers or maintenance providers, and aggregators, as well as the deliberate introduction of backdoors by manufacturers acting on behalf of a foreign state.
European inverter makers face a cybersecurity reckoning
The experts rate three risks as high. Attacks on manufacturer platforms are rated high for residential, commercial and industrial systems, which depend heavily on manufacturer clouds. Attacks from local networks are rated high for utility-scale sites, where a compromised VPN or remote-access firewall could expose a plant large enough to make a dent in the 3,000 MW of reserve that the continental European grid holds to cover sudden losses of generation. And the risk of intentional backdoors applies across all use cases, with critical impact for everything above the plug-in segment.
A question of jurisdiction
On supplier origin, the report notes that many inverter vendors operate what it calls a “split operational architecture”, in which monitoring dashboards are hosted on EU servers, while firmware signing, device provisioning and command-and-control remain outside the EU. In that configuration, the EU-hosted part gives the appearance of EU jurisdiction, but the security-critical functions sit elsewhere. The experts conclude that no existing EU regulation adequately addresses the risk of intentional backdoors in supply chains, particularly where manufacturers fall under the jurisdiction of countries judged to pose significant cybersecurity risks.
Their central recommendation is to restrict the use of high-risk suppliers, drawing on the criteria set out in the proposal for a revised Cybersecurity Act (CSA2), published by the Commission on 20 January 2026, and on the draft Industrial Accelerator Act (IAA). The experts want these restrictions to cover residential systems and plug-in equipment as well as utility-scale plants, arguing that the combined capacity of consumer installations is now large enough to disrupt the grid. The IAA, in its current draft, already plans to exclude high-risk suppliers from control systems, SCADA, remote-access systems and firewalls in installations supported by public funding.
Europe’s solar sector urges EU to rebuild the PV value chain
The report also proposes several technical measures. It wants manufacturers of internet-connected PV equipment to run robust vulnerability-handling processes for their cloud platforms, with enforceable patching deadlines, supported where possible by bug-bounty programmes. For utility-scale installations, all internet traffic from inverters should be documented, encrypted and authenticated. Outbound connections should be limited to approved** servers in the EU or equivalent jurisdictions, and no inbound traffic should be accepted from outside the local network. For commercial, industrial and utility-scale sites, automatic firmware updates triggered by manufacturers should give way to controlled manual updates performed by qualified maintenance providers, who can delay or halt rollouts when authorities warn of a heightened threat.
Closing the gaps in EU law
On the legal side, the experts recommend that the Commission classify PV inverters as Class II important products under the Cyber Resilience Act. This would require independent conformity assessment by a notified body, so manufacturers could no longer simply assess their own products. They also call for a harmonised cybersecurity standard for inverters, and for simpler, aligned thresholds across the relevant EU rules, ideally at 1 MW. The Network Code on Requirements for Generators, which currently contains no cybersecurity provisions, should also be extended to require installers to meet verifiable minimum qualifications in cybersecurity.
Inverters open a new front in Europe's energy sovereignty
The European solar manufacturers welcomed the findings. “The report is an important step forward towards stronger cybersecurity standards for solar PV in Europe,” said ESMC Secretary General Christoph Podewils. “We now expect its recommendations to be reflected in EU and Member State policymaking, not least in the ongoing revision of the Cybersecurity Act.”
Even with every measure in place, the experts acknowledge, some risk will remain, because of the many devices already in the field and the sheer concentration of capacity behind individual manufacturers, aggregators and service providers. System operators, they suggest, may have to hold additional frequency reserves or deploy more grid-forming assets to absorb a worst-case loss. For now, the recommendation is to include cyber-attack scenarios for PV in the risk assessments already required under the Risk Preparedness Regulation and the System Operation Guideline, and to study the grid impact more thoroughly. Europe has built a large solar fleet**, and** the question the SEEG report puts on the table is who, in the end, controls all that capacity. (hcn)
