UK proposes mandatory cybersecurity standards for public EV chargers

UK public charge points would have to meet a mandatory cybersecurity standard, comply with Class B metering accuracy within two per cent, and carry physical anti-tampering hardware under proposals the Department for Transport (DfT) opened to consultation. The consultation runs until 20 December 2026.

The department said it has identified several potential threats to UK charging networks, including "a direct attack on charge points or where they are manipulated or misused to compromise other parts of the charging network". Such incidents could disrupt charging services and affect businesses, drivers and wider national infrastructure, the DfT said.

What would the new rules require?

The core proposal is mandatory compliance with ETSI EN 303 645, a cybersecurity standard covering baseline protections for connected devices. Those protections include authentication, secure software updates and vulnerability management (the practice of finding and fixing security flaws before attackers exploit them).

The DfT is also considering accepting the European EN 18031 standard as an equivalent route to compliance. This would let manufacturers avoid meeting separate requirements for the UK and EU markets — a single approval covering both, rather than two certification runs.

The proposals extend beyond software. Public charge points could be required to incorporate:

• physical anti-tampering measures, including protective seals;
• sensors to detect unauthorised access;
• notifications when someone attempts to reach internal components.

Why metering rules are in a cybersecurity consultation

All public chargers would need electricity meters compliant with the Measuring Instruments Regulations 2016, meeting at least Class B accuracy. In practice, measurements of electricity supplied must be accurate to within two per cent. The DfT frames this as a fraud-prevention measure: it is intended to reduce the risk of meter tampering and to protect both consumers and charge point operators.

Which chargers are covered?

The scope matters for manufacturers and operators. There are currently no specific cybersecurity requirements for public chargepoints, the DfT said. Domestic and small non-domestic chargers are already regulated under the Electric Vehicles (Smart Charge Points) Regulations 2021.

If adopted, the new requirements would apply to newly sold or installed public chargers. Existing equipment would not need retrofits, but replacement units would have to comply — effectively setting a transition pace tied to the natural equipment replacement cycle rather than a fixed deadline for the installed base.

What comes next?

The consultation closes on 20 December 2026, with responses accepted via online form, email or post. The DfT is also considering a second phase that would introduce further cybersecurity requirements for charge point operators (the companies running charging networks) and e-mobility service providers.

Watch two things after the deadline: whether the government confirms EN 18031 as an equivalence route, which shapes certification costs for suppliers serving both UK and EU markets, and whether the second phase imposes network-level obligations on operators rather than only on hardware.