TL;DR
The European Commission has restricted funding for projects using high-risk Chinese-made inverters, signaling a policy shift. However, experts warn that this move alone won’t address broader cybersecurity risks in the solar sector, which are more complex and multifaceted.
The European Commission has announced restrictions on funding for solar projects that use high-risk inverter vendors, primarily targeting Chinese-made inverters. This move aims to support European energy independence but does not fully address the sector’s cybersecurity challenges, which are more complex and systemic.
Earlier this year, the European Commission signaled its intention to restrict EU funding for projects relying on inverters from high-risk vendors, notably Chinese manufacturers. This policy is expected to impact approximately 10-20% of solar project financing in Europe and is likely to extend into wind and battery storage systems.
Despite the significance of these funding restrictions, industry experts and cybersecurity specialists emphasize that the real cybersecurity issues are broader. The draft Cyber Security Act 2 (CSA 2), published by the European Commission, explicitly includes solar energy as a sector requiring further assessment, with discussions ongoing among policymakers, industry groups, and manufacturers.
The debate extends beyond the origin of inverter components. Many Western inverters rely on Chinese-made parts, and some Western manufacturers maintain supply chain ties within China. Experts argue that banning Chinese inverters alone will not eliminate cybersecurity risks, which also stem from interconnected devices, network vulnerabilities, and human factors.
Implications of Policy on Solar Sector Cybersecurity
The European policy shift highlights a strategic effort to reduce dependence on foreign suppliers and enhance energy security. However, cybersecurity experts warn that focusing solely on hardware origin overlooks the more pervasive vulnerabilities in connected systems. The move risks creating a false sense of security if broader systemic issues are not addressed, including supply chain complexity, network security, and human vulnerabilities. Ultimately, the policy could reshape industry dynamics but may not significantly improve cybersecurity resilience without comprehensive standards and practices.
Shophubio Solar Grid Tie Inverter 1600W, Inverter with MPPTs, IP65 Waterproof, Wireless APP Monitoring for Home Balcony Power Station System(1600w)
【High Accuracy】- The 1600W solar inverter is equipped with high-precision instruments to accurately monitor the working status of…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Broader EU Cybersecurity Initiatives and Industry Response
The European Union’s cybersecurity strategy is evolving, with the draft CSA 2 explicitly identifying solar and energy infrastructure as critical sectors. The EU’s recent funding restrictions follow broader efforts to diversify supply chains and reduce reliance on Chinese technology, driven by geopolitical and industrial policy considerations.
Industry stakeholders have expressed mixed reactions: some see the restrictions as necessary for strategic independence, while others warn they could disrupt supply chains, inflate costs, and distract from more pressing cybersecurity vulnerabilities.
Historical incidents, such as cyberattacks exploiting network vulnerabilities in Denmark and Poland, demonstrate that adversaries often target network and human vulnerabilities rather than hardware origin alone. These cases underscore the importance of comprehensive cybersecurity measures across the entire energy infrastructure ecosystem.
“Focusing only on banning Chinese inverters oversimplifies the cybersecurity challenge. The real threats lie in interconnected systems, human vulnerabilities, and supply chain complexity.”
— Uri Sadot, founder of SolarDefend
Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About Effectiveness and Scope
It remains unclear how effective the proposed restrictions will be in reducing actual cybersecurity threats. Experts warn that hardware bans do not address vulnerabilities in software, network infrastructure, or human factors. Additionally, the extent of reliance on Chinese-made components within Western-manufactured inverters complicates the impact of such bans. The timeline for implementing comprehensive standards and the industry’s response to potential supply chain disruptions are still developing.
ZIBOO FT-1000W Solar Panel Tester MPPT Meter – 1000W Max Power, 80V/35A PV Module Tester for Voc/Isc, Open Circuit Voltage & Short Circuit Current, with Backlight & Data Hold
⚡ Professional-Grade PV Testing Measures maximum power (Pmax) up to 1000W, open-circuit voltage (Voc: 12-80V), and short-circuit current…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps in EU Cybersecurity Policy and Industry Adaptation
Policymakers in Brussels are expected to finalize the details of the cybersecurity regulations, including standards for asset visibility and incident response. Industry stakeholders are preparing for potential supply chain adjustments and increased cybersecurity investments. Public consultations and technical assessments are ongoing, with further policy proposals anticipated in the coming months. The industry will closely watch how these measures influence market dynamics and cybersecurity practices.
Cybersecurity in Electrical Power Systems Engineering: A Practical Guide and Applications to Protecting Smart Grids, SCADA, and Critical Power Infrastructure from Cyber Attacks
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Will banning Chinese inverters eliminate cybersecurity risks?
No, experts warn that hardware restrictions alone will not eliminate risks. Cybersecurity vulnerabilities also exist in network infrastructure, human factors, and interconnected devices.
How much of Europe’s solar capacity relies on Chinese-made inverters?
Approximately 300 GW of Chinese-made inverter capacity is installed across Europe, which will remain operational for years regardless of new restrictions.
Are Western manufacturers immune from cybersecurity risks?
No, many Western inverters rely on Chinese components, and some maintain Chinese supply chain ties, making the distinction less clear-cut.
What measures could better address cybersecurity in solar energy?
Implementing clear technical standards, improving asset visibility, and adopting practical cybersecurity practices are essential for a comprehensive approach.
When will the EU finalize its cybersecurity regulations for energy?
While specific timelines are still being discussed, formal proposals and regulations are expected within the next year as part of ongoing policy development.
Source: PV Magazine
