DfT Consults on a Minimum Cyber Security Standard for Chargepoints
The UK Department for Transport has opened a consultation on cyber security rules for public electric car chargers. Published on 29 October and open until 20 December 2026, it proposes a common minimum standard for every public charge point sold or installed in Great Britain, electrive reported on 2 November.
Key takeaways
- Public chargers would have to comply with the ETSI EN 303 645 standard for connected devices.
- The European EN 18031 standard may be accepted as an equivalent route.
- Physical anti-tamper protection and accurate electricity meters would become mandatory.
- Existing chargers would not need to be retrofitted.
Why the rules are needed
Public chargepoints in Britain currently have no specific cyber security requirements. Home chargers and small non-domestic units are already covered by the Electric Vehicles (Smart Charge Points) Regulations 2021, so the gap concerns the public network that drivers use away from home.
The DfT lists threats such as a direct attack on charge points, or chargers being manipulated or misused to compromise other parts of the charging network. An incident of that kind could disrupt charging services and affect businesses, drivers and wider national infrastructure.
What chargers would have to meet
On the software side, ETSI EN 303 645 sets a baseline for connected devices, covering authentication, secure software updates and the handling of vulnerabilities. The DfT is also considering EN 18031 as an equivalent standard, which would let manufacturers build one product for both the UK and the EU instead of meeting two separate sets of rules.
Hardware rules are part of the package. Chargers would need protective seals, sensors that detect unauthorised access and an alert whenever someone tries to reach the internal components. Each unit would also need an electricity meter that complies with the Measuring Instruments Regulations 2016, with at least Class B accuracy, meaning measurements within 2 per cent. The aim is to stop meter tampering and protect both drivers and operators from fraud.
Who it covers and what comes next
If adopted, the requirements would apply to public chargers sold or installed after they take effect. Equipment already in the ground would not have to be upgraded, but any replacement unit would have to comply. The DfT is also considering a second phase with further requirements for charge point operators and e-mobility service providers.
Responses can be sent through an online survey, by email to the OZEV cyber security team or by post. The deadline is 11.59pm on 20 December 2026.
What it means for you
Nothing changes at the plug for now, and no charger you use today will be switched off because of these proposals. If the rules are adopted, new chargers should be harder to hack or tamper with, and the energy shown on the screen should match what you are billed for within 2 per cent. Drivers, fleet managers and charging firms can all respond before 20 December.
Find out more in our electric cars section or see the best first electric cars.
Sources
- GOV.UK: Public electric vehicle charge points: cyber security (consultation, 29 Oct 2026) (accessed 4 Nov 2026)
- electrive: UK reviews cybersecurity requirements for public EV chargers (2 Nov 2026) (accessed 4 Nov 2026)
Found a mistake? Report an error
