Europe's photovoltaic fleet has grown from 86 GW in 2015 to 406 GW in 2025, and SolarPower Europe expects it to reach 718 GW by 2030. Behind that expansion sits a less visible number: the Bitdefender security researchers who looked into the Solarman platform in 2024 estimated it was coordinating around 195 GW of PV capacity worldwide, through a single cloud back end. That is the scale at which cybersecurity has become a grid-stability question, and it is the backdrop to a new expert report that is likely to shape EU policy on solar for years to come.
The report, "Recommendations to address cybersecurity risk in photovoltaic generation", was prepared by the Working Group on Cybersecurity of the European Commission's Smart Energy Expert Group (SEEG) and presented on 1 October. It brings together experts from transmission and distribution operators, the solar industry, regulators, cybersecurity bodies and academia. The European Solar Manufacturing Council (ESMC) was represented by Jens Holm and Thomas Rührlinger of Fronius; Eurelectric, ENTSO-E, T&D Europe, SolarPower Europe, ENCS and Germany's BSI also contributed.
Three high risks, from the cloud to the factory floor
The analysis divides PV generation into four use cases by size: plug-in residential below 0.8 kW, residential up to 10 kW, commercial and industrial up to 1 MW, and utility-scale above 1 MW. For each, the experts assessed five scalable threat scenarios: attacks through manufacturer cloud platforms, attacks from local networks, attacks via installers or maintenance providers, attacks through aggregators, and the deliberate introduction of backdoors by manufacturers acting on behalf of a nation-state actor.
European inverter makers face a cybersecurity reckoning
Three risks come out as "high". Attacks on manufacturer platforms are rated high for residential and commercial and industrial systems, where millions of inverters sit behind a handful of cloud back ends. Attacks from local networks are rated high for utility-scale sites, where a compromised VPN or remote-access firewall could expose a plant large enough to matter on the frequency reserve balance of the continental European synchronous area, which stands at 3,000 MW. And the risk of intentional backdoors applies across all use cases, with critical impact for everything above the plug-in segment.
Supplier origin moves to the centre of the debate
The report is unusually direct on supplier origin. It notes that many inverter vendors operate what it calls a "split operational architecture": monitoring dashboards hosted on EU servers, while firmware signing, device provisioning and command-and-control remain in third countries. In that configuration, the EU-hosted part gives the appearance of EU jurisdiction, while the security-critical functions sit elsewhere. The experts conclude that no existing EU regulation adequately addresses the risk of intentional backdoors in supply chains, particularly where manufacturers fall under the jurisdiction of countries judged to pose significant cybersecurity risks.
Their central recommendation is to restrict the use of high-risk suppliers, drawing on the criteria set out in the proposal for a revised Cybersecurity Act (CSA2) published by the Commission on 20 January 2026, and on the draft Industrial Accelerator Act (IAA). Crucially, the experts argue that these restrictions should not stop at utility-scale plants. They should also apply to residential systems and to plug-in equipment, since the aggregated capacity of consumer installations is now large enough to disrupt the grid. The IAA, in its current draft, already foresees excluding high-risk suppliers from control systems, SCADA, remote-access systems and firewalls in installations supported by public funding.
Europe’s solar sector urges EU to rebuild the PV value chain
Alongside supplier restrictions, the report sets out several technical measures. Manufacturers of internet-connected PV equipment should run robust vulnerability-handling processes for their cloud platforms, with enforceable patching deadlines, supported where possible by bug-bounty programmes. For utility-scale installations, all internet traffic from inverters should be documented, encrypted and authenticated, outbound connections should be whitelisted to servers in the EU or equivalent jurisdictions, and no inbound traffic should be accepted from outside the local network. For commercial, industrial and utility-scale sites, automatic firmware updates triggered by manufacturers should be replaced with controlled manual updates performed by qualified maintenance providers, who can delay or halt rollouts when authorities flag a heightened threat.
Closing the gaps in EU law
On the legal side, the experts recommend that the Commission classify PV inverters as Class II important products under the Cyber Resilience Act, which would require independent conformity assessment by a notified body rather than self-assessment. They also call for a harmonised cybersecurity standard for inverters, and for the thresholds under the NIS2 Directive and the Network Code on Cybersecurity to be simplified and aligned, ideally at the 1 MW level used by the Network Code on Requirements for Generators. The Network Code itself, which currently contains no cybersecurity provisions, should be extended to require that installers meet verifiable minimum qualifications in cybersecurity.
Inverters open a new front in Europe's energy sovereignty
"The report is an important step forward towards stronger cybersecurity standards for solar PV in Europe," said ESMC Secretary General Christoph Podewils. "We now expect its recommendations to be reflected in EU and Member State policymaking, not least in the ongoing revision of the Cybersecurity Act."
Even with every measure implemented, the experts acknowledge, a residual risk will remain, carried by an installed base that is already in the field and by the sheer concentration of capacity behind individual manufacturers, aggregators and service providers. System operators, they suggest, may have to hold additional frequency reserves or deploy more grid-forming assets to absorb a worst-case loss. For now, the recommendation is to fold cyber-attack scenarios on PV into the risk assessments already required under the Risk Preparedness Regulation and the System Operation Guideline, and to study the grid impact more thoroughly. Europe has built an impressive solar fleet. The question the SEEG report puts on the table is who, in the end, controls it. (hcn)
