IN Brief:
- The Department for Transport proposes baseline cybersecurity requirements for new public EV charge points sold or installed in Great Britain.
- The consultation covers ETSI EN 303 645, possible recognition of EN 18031, physical anti-tamper measures and Class B electricity meters.
- Responses close on 20 December, with conformity assessment arrangements and implementation timescales remaining under consideration.
The Department for Transport has proposed mandatory cybersecurity requirements for new public electric vehicle charge points sold or installed in Great Britain. The consultation, opened on 29 October, covers compliance with ETSI EN 303 645, physical protection against tampering and electricity metering accuracy. Ministers are also considering whether the European EN 18031 standard should provide an alternative means of satisfying the proposed cybersecurity requirements.
The measures would introduce a consistent baseline for equipment used across Britain’s public charging network, where charge points communicate with operators and supporting digital systems. Existing smart charging regulations impose cybersecurity requirements on domestic and certain small non-domestic installations, but public charge points are excluded from those provisions. The proposed framework would apply security requirements directly to the public charging equipment entering the market.
ETSI EN 303 645 establishes security provisions for connected products, including the protection of sensitive information, software maintenance and the management of vulnerabilities. Applying it to public charging equipment would require manufacturers to demonstrate that appropriate security measures have been incorporated into their products. The Department for Transport considers the standard suitable for addressing common device-level risks across charging equipment supplied by different manufacturers.
Public charge points contain controllers and communications equipment used to authorise sessions, exchange operational information and report equipment status. They may also communicate with payment systems and remote management platforms. Compromising these functions could interrupt charging services, alter operating instructions or provide a route for unauthorised access to other connected systems.
The proposed standard would address those risks through controls covering device configuration, software updates, vulnerability handling and communications security. The requirements must be implemented within the equipment’s hardware and software architecture, while the charging operator remains responsible for managing the connected systems and operational processes under its control.
Manufacturers often supply related charging products to public, domestic and commercial customers. Using a recognised baseline could allow common security features to be incorporated across several product ranges. The Department for Transport nevertheless recognises that charging equipment is also sold internationally, creating a need to consider how British requirements interact with standards used in other markets.
The consultation therefore proposes recognising EN 18031 as a potentially equivalent compliance route. Developed to support cybersecurity requirements under the European Union’s Radio Equipment Directive, EN 18031 overlaps substantially with ETSI EN 303 645. Manufacturers already designing public charging equipment around the European provisions could be able to use that conformity evidence in Great Britain if equivalence is accepted.
The two standards differ in some requirements, including their treatment of software updates. The Department for Transport notes that ETSI EN 303 645 includes greater involvement by the device user in certain update processes, while EN 18031 explicitly requires most updates to be automatic. The consultation seeks evidence on whether those differences affect the level of protection provided and whether another route to regulatory alignment would be preferable.
Physical security forms a separate part of the proposals because public chargers can be accessible to people other than their owners, operators and authorised maintenance personnel. Tampering with an enclosure may expose internal communications or metering equipment, creating opportunities to interfere with charging operations or the measurement of electricity supplied.
The government is considering requirements for resistance to physical damage, tamper-evident seals, sensors that detect enclosure breaches and notifications when unauthorised access is attempted. Manufacturers would need to balance those protections with legitimate servicing requirements. Charge points must allow suitably qualified personnel to inspect and maintain electrical components without treating every authorised access operation as a security incident.
Enclosure protection also interacts with electrical safety. Charging equipment can contain circuits operating at hazardous voltages, while higher-power installations include substantial electrical conversion and switching equipment. Mechanical protection, safe isolation arrangements and monitoring systems must operate together so that maintenance can be performed without compromising the device’s electrical or cybersecurity functions.
Electricity metering is included because charging transactions depend on accurate measurement of energy transferred to vehicles. The Department for Transport proposes requiring all new public charge points within scope to include active electrical energy meters compliant with the Measuring Instruments Regulations 2016, with Class B as the minimum accuracy classification.
Class B compliance provides an accuracy requirement of 2% under the applicable conformity assessment conditions. The regulations already apply to public charging equipment used for trade where electricity is sold by measured quantity, covering much of the existing market. The new proposal would establish a requirement for compliant metering across public charge points sold or installed in Great Britain, including equipment whose commercial arrangements might otherwise fall outside the existing application.
The metering specification affects how manufacturers design and validate their equipment. Measurement systems must accommodate the current and voltage characteristics of the charging circuit, while their installation must protect the accuracy and integrity of recorded consumption. Higher-power chargers using direct current present different measurement arrangements from alternating-current devices, and forthcoming regulatory changes are expected to address additional requirements for DC energy meters.
Conformity assessment remains under consideration. One approach would allow relevant organisations to assess their own equipment against the standard and associated test specifications, with a designated regulator conducting checks. Another would require accredited third-party testing and certification. Both approaches would place responsibilities on those supplying equipment, although the precise enforcement arrangements have not been settled.
The Department for Transport is seeking evidence on the costs and practical implications of these options. Physical alterations to charging equipment can require changes to enclosure design, sensors and internal component arrangements, while software changes may be introduced through a different development process. Manufacturers would need sufficient implementation time to incorporate the requirements into new products and obtain the necessary conformity evidence.
The proposals would apply to public charge points sold or installed after the relevant rules enter into force. Existing installations would not have to be retrofitted solely to comply with the new requirements. Equipment reaching the end of its service life would, however, need to be replaced by compliant products once the regulatory framework applies.
Separate legislation could introduce additional cybersecurity obligations for organisations controlling substantial charging capacity. Proposals associated with the Cyber Security and Resilience Bill would bring operators controlling at least 300MW of aggregate electrical load within the relevant Network and Information Systems arrangements, subject to the Bill’s passage through Parliament. Those obligations concern charging organisations rather than the product-level requirements in the current consultation.
The government also intends to examine the ISO 15118-20 vehicle-to-charge-point communications standard through separate work involving the Department for Energy Security and Net Zero. Vehicle communications, charge point cybersecurity and electrical control must be coordinated, but each introduces different technical and regulatory requirements.
Consultation responses are due by 11:59pm on 20 December 2026. The Department for Transport will use the evidence to determine the final standards, assurance procedures and implementation arrangements before introducing any mandatory requirements. Manufacturers and charging operators can therefore assess the proposals against their existing equipment specifications and planned product development programmes.
