The Department for Transport wants every public electric vehicle charger sold or installed in Great Britain to meet a named cyber security standard, carry physical tamper protection and use certified meters. The consultation runs until 20 December 2026. If adopted, it would close a gap that has left roadside chargers with fewer device-level security rules than the wallbox on a driveway.
What happened
On 29 October 2026 the Department for Transport (DfT) opened a consultation on giving public EV charge points a consistent cyber security baseline. Responses are due by 23:59 on 20 December 2026. The proposals are not yet law. DfT has not chosen a regulator, set a timetable or decided how compliance would be checked.
Under the proposals, public chargers sold or installed in Great Britain would have to comply with ETSI EN 303 645, possibly with the European EN 18031 accepted as an alternative. They would also need physical anti-tamper protection and an electricity meter that meets the Measuring Instruments Regulations 2016, at minimum Class B.
DfT calls this a first phase. A second phase could require charge point operators (CPOs) and e-mobility service providers to follow a cyber security best-practice framework.
The detail
At the moment the rules for chargers depend on where the charger sits and who owns it. Domestic and small non-domestic smart chargers already have to meet ETSI EN 303 645 under the Electric Vehicles (Smart Charge Points) Regulations 2021. At the other end of the scale, charging businesses that control 300 megawatts or more of electrical load across their network will come under the NIS Regulations 2018 and the cyber assessment framework profile that goes with them. That change depends on the Cyber Security and Resilience Bill passing.
That leaves most of the public network uncovered. DfT says plainly that public charge points have no specific cyber security requirements today and that most operators will not initially fall under NIS.
DfT chose ETSI EN 303 645 because industry knows it, many public units are already built to it, and it comes with a test specification, ETSI TS 103 701. It covers common device weaknesses including authentication, secure updates and vulnerability remediation.
EN 18031 is a common route for meeting the cyber security requirements of the EU Radio Equipment Directive. DfT found the two standards overlap heavily, with remaining gaps mostly superficial. For example, ETSI gives the owner more say over updates, while EN 18031 expects most to install automatically. Accepting EN 18031 as equivalent would mean a manufacturer already compliant with EN 18031 would not also have to meet ETSI EN 303 645, easing sales of the same product across Great Britain, Northern Ireland and the EU.
The physical measures would broadly mirror what domestic chargers already face. Units would have to resist physical damage. They would carry a seal that breaks if someone opens the casing and a sensor that detects any breach of it, and they would notify the owner when someone tries to reach the internal components. The metering requirement targets fraud. Class B meters are conformity assessed to measure energy to within 2 per cent.
DfT is weighing two ways to check compliance. One is self-assessment against ETSI TS 103 701 backed by spot checks from a regulator. The other is mandatory testing and certification by an accredited third party. The rules would apply only to chargers sold or installed after they take effect, with no retrofitting. Existing units would be replaced with compliant ones as they reach the end of their life.
Why it matters for UK organisations
Public chargers now sit in supermarket car parks, motorway services, council streets and fleet depots. Each is a networked computer bolted into a public place. DfT’s own list of risks covers direct attacks on chargers and the use of a compromised unit as a way into the rest of the charging network.
Several groups will feel the effects. Manufacturers, importers and distributors would carry the main legal duty, because the proposals apply to anyone who sells or installs a charger in GB. Operators will have to account for it when buying equipment and planning replacements. Retailers, councils and fleet operators that host chargers will need to update procurement specifications.
It also shows UK cyber regulation building in layers: product standards for devices, NIS duties for large operators and possibly a service-provider framework later. Compliance teams need to track all three.
Expert view
This is a sensible and fairly modest proposal, and I think it is overdue. ETSI EN 303 645 is a baseline. It removes the cheap wins behind most real problems with connected devices. In my experience, the weaknesses that matter in field kit are rarely exotic. They are shared credentials, debug interfaces left enabled, firmware updates nobody signs or checks, and management services exposed to networks they should never be on. Reaching a baseline that deals with those would improve the estate a great deal.
Including physical protection is the right call. A charger in a public car park can be reached by anyone with a screwdriver and a quiet hour. When we test devices the public can touch, the casing and service ports are often the real attack surface. Seals and sensors do not prevent tampering, but they make it visible, and visibility is what an operator needs in order to respond.
The weak point is assurance. Self-assessment with occasional spot checks is cheap, but it only works if the regulator actually checks. Third-party certification costs more but gives buyers evidence they can rely on. I would argue for certification at least for higher-power units and anything connected to payment or grid-balancing functions. Ruling out retrofits is practical, but it means non-compliant chargers will stay in service for years.
What to do now
- Respond to the consultation. Manufacturers, CPOs and hosts have until 20 December 2026. DfT specifically wants cost data broken down into one-off, annual, per-unit and ongoing costs, and views on implementation timelines.
- Map your installed base. Record which chargers you own or host, who makes them, their firmware versions, and whether the vendor claims ETSI EN 303 645 or EN 18031 conformance.
- Put the standard in procurement now. Ask for evidence of conformance against ETSI TS 103 701, a published vulnerability disclosure route and a guaranteed security update period in new contracts.
- Segment the network. Keep chargers and their management links off corporate networks. This matches the Cyber Essentials firewalls and secure configuration controls.
- Control access and updates. Remove default or shared credentials and confirm that firmware updates are applied and verified, in line with the Cyber Essentials user access control and security update management controls.
- Plan for physical tampering. Include tamper alerts in site monitoring and agree with operators who responds when a casing alarm fires.
Bottom line
DfT wants public EV chargers to meet the same cyber baseline as home units, with tamper detection and certified meters on top. The detail on enforcement is still open. Anyone who makes, runs or hosts chargers should respond before 20 December and start buying to the standard now, because units bought today will still be in service when the rules apply.
Sources
- GOV.UK (Department for Transport): Public electric vehicle charge points: cyber security
- GOV.UK (Department for Transport): Cyber security for public electric vehicle charge points (consultation document)
- EV Fleet World: Government launches consultation to shield public EV chargers from cyberattacks
- DM News: DfT opens consultation on cyber-security requirements for public EV charge points
