EV Charger Cybersecurity, Data and Remote Control

A home charge point is now a networked computer with a mains cable attached, and the rules treat it that way. In Great Britain, the Electric Vehicles (Smart Charge Points) Regulations 2021 came into force on 30 June 2022 and apply to private charge points sold in Great Britain after that date¹. They require smart functionality, minimum security, encrypted communications and secure software updates, and they place the duties on the seller rather than the householder¹.

The security requirements sit in Schedule 1 to the regulations and are mostly based on the existing cyber security standard ETSI EN 303 645². Charge points sold before 30 December 2022 are not required to comply with those Schedule 1 security requirements, so an older unit sits outside the security regime even though the general smart charging duties applied from June 2022¹.

For a household, the practical effect is that a compliant charger keeps working when the internet drops, reports its energy use to within 10%, and can be told remotely to delay or shift a charge². What it does not do is remove dependence: the charger still needs the grid, still needs a supplier or an aggregator to send the signals, and still depends on the maker's servers and app for remote control.

What cybersecurity rules apply to home EV chargers in Great Britain

Two regimes overlap. The first is electrical. All EV charging installations must continue to comply with BS 7671, the Wiring Regulations governing electrical installations, and in England and Wales an installation must be notified to local authority building control because it involves creating a new circuit³. Mode 3 equipment, the type used for home charging, must also conform to the Electrical Equipment (Safety) Regulations 2016 and the Electromagnetic Compatibility Regulations 2016 as amended⁴.

The second regime is digital. The Electric Vehicles (Smart Charge Points) Regulations 2021 cover charge points sold in Great Britain only, so Northern Ireland sits outside them². They apply to the sale of private charge points sold in Great Britain after 30 June 2022, and they require all new domestic and business charge points to include smart functionality to support off-peak, lower-cost charging². The regulations are a legal requirement rather than optional guidance: domestic EV chargers must be capable of responding to signals to shift charging to off-peak periods⁵.

The Building Regulations 2010 also carry a minimum standard for an electric vehicle charge point under regulation 44J, which is the hook for the new build requirements in Approved Document S⁶. Those requirements are about provision and cable routes rather than cybersecurity, but they matter here because they determine which chargers exist in which buildings and therefore which units fall under the smart charge point rules.

The dividing line for a householder is simple. If the charger was sold in Great Britain after 30 June 2022, the smart functionality duties apply. If it was sold before 30 December 2022, the security duties in Schedule 1 do not¹. Everything else, including the electrical standards, applies regardless of when it was bought.

The Electric Vehicles (Smart Charge Points) Regulations: what they require

The regulations do three things at once: they mandate smart functionality, they mandate a minimum security baseline, and they set rules about how the device behaves on the network. Those selling a charge point must ensure it meets the security requirements set out in Schedule 1, which are mostly based on ETSI EN 303 645². The NICEIC summarises the same duty as a requirement that charge points meet minimum security requirements in addition to the smart functionality rules³.

The smart functionality duty is the one most householders notice, because it changes when the car charges. The security duty is the one they rarely see, because it operates in the background: encryption, authentication, update integrity and tamper resistance. The regulations also include a safety override. Regulation 8 requires that a relevant charge point must not follow certain user inputs where this would create a safety risk¹. In other words, a remote or app command cannot be allowed to override a safety condition.

There is a separate consumer connectable product security regime that applies to a range of smart products, and charge points for electric vehicles are not covered by it⁷. That exclusion matters: it means the EV-specific regulations are the operative security rules for chargers, rather than the general consumer product regime.

Security requirements: passwords, encryption, tamper protection and security logs

The Schedule 1 requirements are technical, and the legislation states them directly. Communications sent from the charge point must be encrypted¹. The charge point must incorporate software which is able to be securely updated, using adequate cryptographic measures with verification of authenticity and integrity¹. Those two duties cover the two most common failure modes in connected devices: interception of traffic, and malicious or corrupted firmware.

The BSI Kitemark for Smart EV Chargers tests against a comparable list. Its cybersecurity tests cover security scans, data protection, secure software updates and network security testing, and it verifies that personal data is encrypted and safe from unauthorised access⁸. The Kitemark scheme is built on the UK Smart Charge Regulations, ETSI EN 303 645 and IEC 61851-1⁸.

Tamper protection and security logging are part of the same family of controls. The regulations' safety override in regulation 8 is a form of tamper resistance in the physical sense: the device must refuse inputs that would create a safety risk¹. On the digital side, the requirement that inaccuracies in reported data must not be systematic is a control against a device quietly misreporting what it has done².

For a household, these requirements are the difference between a charger that can be patched and one that cannot. A unit that cannot receive verified updates keeps whatever vulnerabilities it shipped with for its whole service life.

Smart functionality: off-peak defaults, randomised delays and offline charging

Smart functionality is not a marketing label. It is a defined behaviour set. A charge point must be configured to operate a default randomised delay of up to 600 seconds, which is 10 minutes, at each charging instance². The same guidance requires the charger to be capable of remotely increasing that randomised delay up to 1800 seconds, or 30 minutes, in the event this is required in future regulation². The two figures serve different purposes: the 10 minute default is what happens now, and the 30 minute capability is headroom for later rules.

The reason for the delay is grid management. If every charger on a street started drawing power the moment its owner plugged in, the local network would see a spike. Randomising the start spreads that demand. Some smart chargers go further and automatically power EVs during off-peak hours when electricity costs are lower⁹.

Offline behaviour is the third pillar. A charge point must be configured such that when it loses communications network connectivity it is still able to charge². That is a deliberate design requirement, and it means a broadband outage does not strand the car.

Maker implementations vary. Growatt's smart charger, for example, lists PV Linkage mode, Fast mode and Off-Peak Mode as its working modes, alongside protection features including overload, over and under voltage, lightning, over temperature, earth leakage, short circuit, fault current and 6mA DC RCD protection⁹. Those modes are the maker's own description of its product, not a regulatory requirement, but they show how the mandated off-peak behaviour is presented to owners.

What data your charger collects and who can see it

A smart charge point is a metering device as well as a charging device. It must have the capability to measure or calculate every one second the electrical power it has imported or exported, in watts or kilowatts, and must be capable of providing that information via a communications network². That is a high-resolution record of when a household draws power and how much.

The accuracy rule is explicit: all information referenced in that sub-section must be accurate to within 10%, and any inaccuracies must not be systematic². The BSI Kitemark scheme tests energy metering accuracy for billing purposes as part of its smart charging tests, alongside demand management, compatibility and user interface⁸.

The data does not stay on the device. Charging data feeds into mapping and planning work: one collaborative project gathered information from a range of data sources, including local authorities¹⁰. For smart metering more broadly, energy suppliers get accurate and reliable readings automatically over the DCC network, enabling billing only for energy used¹¹. A charger's own metering is separate from the smart meter, but the two sit in the same household data picture.

Who can see charger data depends on the arrangement. The maker's app sees it, any aggregator or flexibility service the household signs up to sees it, and the supplier may see it if the tariff depends on charging behaviour. The regulations require encryption of communications from the charge point, which protects the traffic in transit¹, but encryption in transit does not determine who is entitled to the data at the other end.

Remote control: how chargers are managed and the role of OCPP

Remote control is the point of a smart charger. The regulations assume a device that can receive signals and act on them, which is why the randomised delay must be remotely extendable to 1800 seconds if future rules require it². The protocol that carries most of this traffic is OCPP, the Open Charge Point Protocol. Growatt's smart charger, for instance, is described as working with OCPP protocol⁹.

OCPP is an open application protocol between a charge point and a central management system. Its significance for a household is that it separates the hardware from the back office: a charger speaking OCPP can be managed by a different platform from the one that made it, which is what allows aggregators, suppliers and flexibility services to send commands without the maker being the only route. It is also what allows a charger to be enrolled in a demand response scheme.

The commands that travel this way are start, stop, schedule and rate limits. The safety override in regulation 8 caps them: a relevant charge point must not follow certain user inputs where this would create a safety risk¹. So remote control is real but bounded, and the boundary is safety rather than convenience.

There is a documented case of remote restriction in practice. For the Easee One EV Charger Backplate, where a mislabelled unit is confirmed to be incorrectly wired and without external PEN protection, charging is temporarily paused until remediation is completed¹². That is a safety-driven remote action rather than a cyber one, but it shows that a connected charger can be stopped by a party other than its owner.

BSI Kitemark certification: what it covers and why it matters

The BSI Kitemark for EV chargers covers two assessment areas: electrical safety and digital smart security¹³. The electrical safety element can be assessed independently or combined with the digital security assessment criteria¹³. Testing and certification is offered for charge points both for home and commercial use¹³.

The digital security certification exists to demonstrate compliance with named instruments. BSI states that its Kitemark Certification for Digital Security of EV Chargers ensures compliance with regulations such as UK Smart Charge Regulation and ETSI EN 303 645¹³. The scheme supports legislative, market access, specifier and compliance requirements, and tests EV chargers against various electrical safety criteria¹³.

The Kitemark for Smart EV Chargers is built on UK Smart Charge Regulations, ETSI EN 303 645 and IEC 61851-1⁸. Its cybersecurity tests cover security scans, data protection, secure software updates and network security testing, and its smart charging tests cover demand management, compatibility, user interface and energy metering accuracy for billing purposes⁸.

For a household, certification is evidence rather than a guarantee. It shows that an independent body has assessed the unit against the same standards the regulations reference, which is useful where a buyer wants to check a claim that a charger is compliant. It does not replace the regulations, and it does not make the charger independent of the maker's cloud.

Which chargers are exempt from the rules

The exemptions fall into two groups: territorial and building-related. The smart charge point regulations cover charge points sold in Great Britain only, so Northern Ireland is outside them². Charge points for electric vehicles are also excluded from the separate consumer connectable product security regime⁷.

On the building side, Approved Document S exempts a building with only covered parking spaces from installing charge points, though cable routes must still be provided; charge points installed voluntarily in that situation fall outside section 6 guidance but must still meet other relevant standards including electrical safety¹⁴. The underlying legislation is consistent: where all parking spaces are within a covered car park, the requirement to install an electric vehicle charge point does not apply, and cable routes must still be provided for a minimum of one in five parking spaces¹⁵.

Planning exemptions are a different matter and are often confused with regulatory exemptions. Home EV chargers, public charging points and business installations fall under permitted development rights in England, with exceptions including listed buildings, conservation areas and world heritage sites³. Usually no planning permission is needed because the installation falls within permitted development rights, with exceptions for listed buildings, conservation areas or cross-pavement solutions¹⁶.

What happens if a charger breaches the regulations

Regulation 15 provides for the Secretary of State to enforce the Electric Vehicles (Smart Charge Points) Regulations 2021, and the regulations define enforcement authority as the Secretary of State¹. Enforcement therefore sits with central government, not with a local authority or an energy regulator. The regulations set the enforcement route rather than a single published penalty figure.

Adjacent energy obligations show the shape of enforcement in this area. The government has stated that failure to comply with smart meter repair rules could result in the energy regulator putting companies on notice or enforcing fines¹⁷. That is a different regime, but it indicates that non-compliance in connected energy devices is treated as an enforcement matter rather than a technicality.

Installation breaches carry their own consequences. Without the correct permissions, enforcement action may be taken against the householder¹⁸. In a designated area such as a conservation area, there are increased chances that if an application is accepted there will be conditions attached, affecting the size, appearance and placement of the charger¹⁸. Trailing a cable across the pavement without permission is an offence, as it breaches the Highways Act 1980 Section 162 and Section 178¹⁹.

Product safety failures are handled separately again. A safety report on the ROMADA New Energy EV Charger and Cable found that improvements were required to the product documentation, markings and instructions²⁰. That is the documentation side of compliance, and it is the part a buyer can check before installation.

What documents must come with a charger when I buy it

The regulations place the security duties on those selling charge points, and the requirements themselves are set out in Schedule 1². Beyond the product itself, an installed charger should be supported by paperwork. A compliance certificate serves the purpose of proving the work complies with building regulations²¹. Installation must be in line with the current edition of BS 7671, the national standard for electrical installations¹⁶.

The grant-funded route adds its own documentation requirements. Chargepoint installations under the electric vehicle chargepoint grant for renters and flat owners must be carried out as per BS EN 61851, the IET wiring regulations BS 7671, the IET Code of Practice for Electric Vehicle Charging Equipment Installations, and the Electricity Safety, Quality and Continuity Regulations²². Those are installation standards rather than product documents, but they are the standards an installer is expected to work to.

Documentation quality is a known weak point. The ROMADA safety report required improvements to product documentation, markings and instructions²⁰. For a household, the practical checklist is the compliance certificate, the installer's notification to building control in England and Wales, and the maker's own security and update documentation.

Do the rules still apply if I switch energy supplier?

Yes. The obligations attach to the charge point and the seller, not to the energy supply contract, so changing supplier does not change them. Ofgem states that a household does not need to do anything if its current supplier goes out of business: it is moved automatically to a new supplier and supply is not interrupted²³. The charger's smart functionality and security requirements are unaffected by that change.

Where supplier arrangements do interact with charging is through tariffs and flexibility services. A charger enrolled in a smart tariff or an aggregator's scheme depends on the supplier or platform to send the signals, and that dependency ends when the arrangement ends. The charger itself remains compliant either way.

Where the independence stops

A compliant charger gives a household control over when it draws power, and it gives the grid a way to ask for that timing to shift. That is genuine value: off-peak charging, randomised starts and remote scheduling all reduce cost and load. The security requirements mean the device can be patched, its traffic encrypted and its reported data trusted to within 10%¹.

The dependence that remains is structural. The charger needs the grid, and it needs a supplier or platform to send the signals that make smart charging worthwhile. Remote control runs through the maker's servers and the household's network link, and while the charger must still charge when that link fails², the smart behaviour stops with it. Certification such as the BSI Kitemark is evidence of assessment against the standards, not a transfer of control to the owner¹³.

For a household weighing energy independence, the honest position is that a smart charger is a managed device on someone else's protocol. It reduces cost and carbon, and it can be stopped or delayed by parties other than the driver, within the safety limits the regulations set¹.