Skip to main content
Open consultation

Cyber security for public electric vehicle charge points

Published 29 October 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/consultations/public-electric-vehicle-charge-points-cyber-security/cyber-security-for-public-electric-vehicle-charge-points

This consultation seeks views on proposals for a consistent baseline of cyber security for public electric vehicle (EV) charge points sold and installed in Great Britain (GB).

Our proposals include: 

Policy background

As the UK public EV charging network develops, ensuring the network is secure and resilient against potential  cyber attacks will be important in maintaining  the integrity of, and confidence in, our charging network. Such attacks could potentially disrupt and negatively impact drivers, businesses and national infrastructure.

Cyber security for EV charging is developing in the following ways: 

There are currently no specific cyber security requirements for public charge points and most organisations will not initially fall within the scope of the NIS regulations. However, many devices are likely to have some protections given requirements in other markets, such as the European Union.

The Department for Transport (DfT) is developing options to mitigate cyber security risks for public EV charging, with the support of external industry and specialist consultant advisors. In the first phase of action, DfT plans to introduce a consistent baseline level of cyber security for public charge point devices. This consultation seeks views on a preferred option for intervention.

A second phase could potentially place further cyber security requirements on public charge points and on the organisations that control these devices, requiring CPOs and e-mobility service providers (eMSPs) to follow a framework for cyber security best practice.

Alongside this consultation on the cyber security of public charge points, DESNZ and DfT intend to separately consult on requiring charge points to be equipped with the EV-to-charge-point communication standard ISO 15118-20. We continue to work closely with DESNZ to ensure alignment on timelines for stakeholders. Further information will be provided in due course.

Cyber security standards for manufacturers

DfT has been exploring ways to develop a consistent baseline of cyber security requirements for public charge points. 

A range of risks to the charging ecosystem have been identified, which could be mitigated by imposing cyber security requirements on public charge points. These include: 

  • risks involving direct attacks on charge points 
  • risks where charge points are manipulated or misused to compromise other parts of the charging network 

Many manufacturers produce charge points that are used in multiple different settings (for example, domestic and depot, as well as public). For this reason, there may be a benefit in harmonising cyber security requirements across private and public charge points where possible.  

We are also seeking to enhance cyber security in this sector while maintaining the momentum of the public charge point rollout, ensuring business confidence by creating a policy that is harmonised across the sector.

General cyber security questions

Question: Do you agree or disagree that public charge points sold or installed in GB require additional cyber security measures to mitigate common device-level cyber security risks? If you disagree, explain your answer.

Question: In your view, what would be the benefits, if any, of implementing requirements to strengthen the cyber security of public charging devices? Provide reasoning and evidence relating to benefits for consumers, businesses, infrastructure and any other categories.

Cyber security standard: ETSI 303 645

ETSI 303 645 is a cyber security standard that brings together good practices for internet-connected devices. The standard provides a baseline level of cyber security by addressing the most widespread security risks.[footnote 1] Provisions cover topics such as: 

  • authentication
  • secure updates 
  • vulnerability remediation

Under the EVSCP regulations, manufacturers of domestic and small non-domestic EV charge points (excluding public charge points) are currently required to build their devices to the cyber security standard ETSI 303 645. This requirement is expected to be retained when those regulations are revoked and replaced by the Energy Smart Appliance Regulations in due course.

We have considered the applicability of the cyber security standard ETSI 303 645 to public charge points. We believe that compliance with this standard would set a robust baseline for the cyber security of public charge points.

This standard is also well known to industry and, in many cases, is already built into public charge points. 

We believe that ETSI 303 645 is the most relevant and appropriate cyber security standard for public charging devices. It is also useful as it offers an accompanying test specification: ETSI TS 103 701, which provides guidance on assessing and assuring that a product complies with the provisions in ETSI 303 645.

We propose that cyber security requirements would be applied to anyone who sells or installs charge points in GB. This would primarily include manufacturers, as well as those importing or distributing public charge points to place them on the GB market. This approach is informed by the regulatory framework we plan to use, should we proceed with these proposals.   

We, therefore, propose that charge points sold and installed in GB are compliant with the cyber security requirements set out in the standard ETSI 303 645. 

We are aware that many public charge point manufacturers operate internationally and that there would be potential benefit in considering ways to harmonise cyber security standards with the rest of Europe. We have, therefore, included some questions later in this consultation on the potential to allow compliance with European standards as an equivalent alternative standard to ETSI 303 645.

ETSI 303 645 questions

Question: Do you agree or disagree that public charge points sold and installed in GB should be manufactured and configured to comply with ETSI 303 645? If you disagree, explain your answer.

Question: Which standards, if any, do you think would be an appropriate alternative to ETSI 303 645 for public charge points?

Question: In your view, what, if any, would be the costs and benefits of requiring public charge points to be built in compliance with ETSI 303 645? Provide evidence in your response.

Question: Do you agree or disagree that requirements for device compliance with ETSI 303 645 should be applied to public charge points sold and installed in GB? If not, explain your answer.

Equivalent standards: EN 18031

Within the EU, the Radio Equipment Directive (RED) requires that public charge points must be built in compliance with specific cyber security requirements. A common route for RED compliance is via the EN 18031 standard. These requirements are due to be replaced by the EU’s Cyber Resilience Act (CRA), which will come into force at the end of 2027.  

EN 18031 is a family of European standards developed to support the cyber security requirements of the EU’s RED. Similarly to ETSI 303 645, it is a standard that sets baseline requirements for the security of internet-connected radio equipment.

We have, therefore, explored the potential use of the EN 18031 standard for public charge points in GB. Given that many public charge point manufacturers operate internationally and across the UK internal market, this would have the benefit of harmonising requirements with both Northern Ireland and the EU.

We have found that the requirements in ETSI 303 645 and EN 18031 overlap significantly. Most of the gaps that do exist are superficial and assessed as not affecting security. Differences that relate to security are assessed to have minimal impact. For example, ETSI 303 645 has more requirements for consumer (in this case, most likely a CPO) involvement in update processes, whereas EN 18031 explicitly requires most updates to be automatic. We believe that this difference and others like it would have little to no security impact.

We are, therefore, considering treating EN 18031 as an equivalent standard for cyber security in public charge points. This would mean that those manufacturers who are already compliant with EN 18031 would not need to be additionally compliant with ETSI 303 645. 

This proposed approach is intended to support businesses in selling their devices in both the UK and the EU without unnecessarily increasing the financial and administrative burden. 

The possibility of allowing compliance with EN 18031 as an equivalent standard will be kept under review as cyber security standards in the CRA are confirmed. Where possible and appropriate, we will seek to develop regulatory provisions that support businesses to sell public charge points across the EU and Northern Ireland and GB, without undue additional costs.

Equivalent standards: EN 18031 questions

Question: In your view, does the EN 18031 standard provide a suitably equivalent level of cyber security to ETSI 303 645? If not, explain why not.

Question: Do you agree or disagree that when a public charge point is manufactured to the EN 18031 standard, this should, in your view, be treated as indirectly complying with ETSI 303 645 for this policy? Explain your answer.

Question: In your view, is there a better way to support charge point manufacturers selling their devices across the EU, Northern Ireland and GB, other than allowing compliance with EN 18031?

Additional physical protections

While requiring compliance with ETSI 303 645 will sufficiently protect against many common device-level cyber security risks, there are some risks that may require further intervention. 

We suggest that further action should be taken beyond the requirements set out in the ETSI standard to help prevent fraud and cyber attacks initiated via physical interfaces. 

We propose mitigating these risks by requiring additional physical anti-tamper protections on public charge points. 

Manufacturers of domestic charge points are required by the EVSCP regulations to conform to additional physical tamper-proof requirements that go beyond ETSI 303 645. These are listed in schedule 1 of the regulations  and will be updated by the Energy Smart Appliance regulations (PDF), which are in development.  

Public charge points face similar risks relating to physical vulnerabilities, potentially exacerbated by their location in public places.

To mitigate the associated risks, we are considering aligning with the requirements for domestic charge points by requiring specific additional physical tamper-proof protections, including requiring public charge points to:

  • be manufactured or configured to provide an adequate level of protection against physical damage 

  • have a tamper-protection seal or sticker that will be broken if an attempt is made to access the non-serviceable components inside the casing  

  • have a tamper-protection sensor on or within their casing to detect any breach of the casing

  • be manufactured or configured so that if there is any attempt to access its internal components, it notifies the end-user

In our development of these requirements, we are mindful of previous challenges faced by organisations in implementing the physical tamper protections required by the EVSCP  regulations. We continue to work closely with DESNZ to ensure alignment for stakeholders.

Based on DESNZ’s process evaluation, the key issues identified related primarily to the importance of clarity in the requirements and ensuring that the regulations provided a sufficient length of time for implementation.

We are, therefore, seeking opinions on the most effective way to implement these proposed requirements. 

Additional physical protections questions

Question: In your view, do public charge points require additional physical tamper protections, beyond ETSI 303 645, to sufficiently protect them? If not, why not?

Question: In your view, what, if any, are the vulnerabilities specific to public charge points which necessitate additional physical tamper protections?

Question: In your view, should public charge points be fitted with tamper detection sensors? If not, explain your answer.

Question: If implemented, where on the charge point should the tamper detection sensors be placed?

Question: In your view, should public charge points be fitted with tamper detection seals? If not, explain your answer.

Question: In your view, are there more appropriate methods of tamper-proofing public charge points than those suggested in this consultation? Provide details.

Question: Do you agree or disagree that public charge points should be manufactured and configured so that if there is any attempt to access their internal components, it notifies the owner?

Question: In your view, what, if any, are the costs and benefits of requiring the specified additional physical protections set out in this consultation? Provide evidence to support your response.

Metering requirements

Public charge points are also at risk of meter tampering for fraud. To mitigate this risk, we propose requiring public charge points to be manufactured or configured with a meter that is compliant with the requirements for active electrical energy meters set out in the Measuring Instruments Regulations (MIR) 2016. This requires a minimum of a Class B meter, as defined by MIR.  

These regulations already apply to public charge points used for trade (those selling electricity by reference to a measurement of quantity), which currently includes most public charge points. This proposal would place a requirement on manufacturers to ensure a MIR-compliant active electrical energy meter is included in all public charge points sold or installed in GB.

This change would support consumer and CPO interests by ensuring the accuracy of public charge points. MIR Class B compliance ensures that these devices are conformity assessed and verified as capable of measuring active electrical energy consumed in a circuit or transferred between circuits to within 2% accuracy.  

MIR compliance would also permit active electrical energy meters approved under the Measuring Instruments Directive (MID) 2014/32/EU to be used in public charge points.

Requiring the use of these meters would also ensure that the interests of businesses are protected by reducing the risk of fraud via meter tampering. 

DESNZ consulted on making similar changes via the proposed Energy Smart Appliance Regulations, requiring that private charge points in scope of the regulations must include a meter that is compliant with MIR Class B requirements.

The Department for Business and Trade (DBT) will be amending MIR to permit a remote display option for active electrical energy meters within charge points and other energy smart appliances by the end of 2027.

DBT will also be launching a call for evidence later this year on the upcoming changes to the MID introduced by the EU’s targeted technical amendment (Directive 2026/706), which includes introducing requirements for DC active electrical energy meters.

Metering requirements questions

Question: Do you agree or disagree that all public charge points should be fitted with a minimum of Class B meters, as defined in the Measuring Instruments Regulations 2016? If you disagree, explain your answer, including, if possible, an alternative suggestion.

Question: In your view, what, if any, are the costs and benefits of requiring the use of meters in public charge points that are compliant with requirements in the Measuring Instruments Regulations 2016? Provide evidence to support your response.

Compliance and assurance

Subject to the regulatory proposals in this consultation proceeding, DfT will develop an approach for enforcing these requirements, which will be informed by further stakeholder engagement. 

This could include: 

  • requiring in-scope organisations to self-assess their compliance with the regulations using the ETSI test specification 103 701 and other relevant specifications, with a chosen regulator (to be determined by DfT), then undertaking spot checks to monitor compliance with all requirements 

  • requiring in-scope organisations to seek third-party certification via an accredited test and certification house 

We will also develop an approach for checking compliance with EN 18031, should this equivalence be permitted.

Compliance and assurance questions

Question: In your view, what, if anything, would be the most appropriate method of assuring compliance with these proposals? Explain your answer.

Question: In your view, what would be the costs and benefits of assuring compliance via self-assessment with spot checking by a regulator? Provide evidence to support your response.

Question: In your view, what would be the costs and benefits of assuring compliance by requiring organisations to seek accredited third-party testing and certification? Provide evidence to support your response.

Question: In your view, what, if anything, would be the most appropriate method for assuring compliance with physical tamper protections?

Question: For devices already in compliance with EN 18031 or other future equivalent EU standards, what would be the most appropriate method of confirming this existing compliance?

Implementation

Should these proposals be taken forward, we would encourage relevant industry stakeholders to implement changes as soon as they are able to. However, we understand that physical changes in particular can take longer to implement via product development cycles, so we are seeking views and evidence on appropriate implementation timelines for the relevant cyber security standards and the physical tamper protections.

We will review implementation timelines for metering requirements to seek alignment with planned changes in the EU and by DBT.

If proceeded with, we intend to apply the requirements in these proposals to sold and installed public charge points only. We will not require retrofitting. When devices come to the end of their life cycle and are decommissioned, they will need to be replaced with compliant devices.

We have estimated the net annual direct cost to businesses of implementing these regulations. Our current estimates are based on previous analysis for EVSCP and the proposed ESA regulations, as well as industry engagement and our own research.  

As such, we would like to gather further information on potential costs via this consultation to ensure we have a more accurate understanding of how these proposals might impact businesses.  

When answering cost-related questions, where possible, provide a detailed breakdown of costs by one-off, annual, per-unit and ongoing. We are seeking to understand marginal costs: the additional cost to become compliant with proposed requirements, beyond your usual production practices.

Implementation questions

Question: In your view, do the requirements put forward in these proposals conflict with or duplicate any existing requirements that apply to public charge points? If yes, explain this conflict/duplication.

Charge point manufacturers questions

Question: Do you already build your charge point devices to be compliant with ETSI 303 645 or EN 18031? If so, which standard(s)?

Question: If yes, how much did it cost your organisation to build these compliant devices? If no, provide your best estimate of how much it would cost you to become compliant with each. If possible, provide a detailed breakdown of costs by one-off, annual, per-unit and ongoing.

Question: Do you already build your charge points to be compliant with any of the physical anti-tamper requirements proposed in this consultation? If so, which ones?

Question: If you already build your charge points to include a tamper detection sensor or tamper detection seal, how much did it cost your organisation to manufacture devices with these additional protections? If not, provide your best cost estimate. If possible, provide separate detailed breakdowns of costs by one-off, annual, per-unit and ongoing, for both the sensor and seal.

Question: Do you already fit your charge points with Class B electricity meters compliant with requirements set out in the Measuring Instruments Regulations 2016 (MIR)?

Question: If yes, how much does it cost your organisation to use these meters, in comparison to using meters which are not compliant with MIR requirements? If not, provide your best cost estimate.

Question: What, if any, other costs or benefits (both monetised and non-monetised) could the proposals put forward in this consultation bring to your organisation?

Question: How can industry best be supported in implementing these proposals if they are proceeded with?

Charge point operator questions

Question: Do you charge points currently comply with any of the requirements proposed in this consultation? If so, which ones?

Question: How much, if at all, does compliance with these requirements impact the purchase cost?

All organisation questions

Question: In your experience, what is the average life-span of a charge point from the point of installation to the point of replacing? 

Question: How long would it reasonably take to implement these proposed requirements for new public charge points?

How to respond

We will only accept responses received before the closing date: 11:59pm on 20 December 2026.  

The easiest way to respond is to use the online response form. It includes the option to save and continue your response if you are unable to complete it in one go.  

If you cannot use the online form, email or post your response to us:  

Email: ozevcybersecurity@dft.gov.uk

Write:   

OZEV cyber security policy
Office for Zero Emission Vehicles  
Department for Transport
33 Horseferry Road
London, SW1P 4DR 

If you send your response by email or post:  

  • answer the questions asked in the consultation and, if required, provide further comments and evidence  
  • tell us if you are responding as an individual or on behalf of an organisation

If responding on behalf of an organisation, you need to:  

  • make it clear who the organisation represents  
  • outline how the views of members were assembled (where applicable)  

You will receive an acknowledgement of receipt if you submit your response by email. Check your junk/spam folder if you do not receive this within 15 minutes of sending your email. If you do not find a receipt, email ozevcybersecurity@dft.gov.uk with ‘missing receipt’ in the subject line.

Full list of questions

This list of questions provides an overview of what we are asking.

About you

Question: What is your name? 

Question: What is your email address? 

Question: Are you responding on behalf of an organisation?

General cyber security

Question: Do you agree or disagree that public charge points sold or installed in GB  should require additional cyber security measures to mitigate common device-level cyber security risks? If you disagree, explain your answer.

Question: In your view, what would be the benefits, if any, of implementing requirements to strengthen the cyber security of public charging devices? Provide reasoning and evidence relating to benefits for consumers, businesses, infrastructure and any other categories.

ETSI 303 645

Question: Do you agree or disagree that public charge points sold and installed in GB should be manufactured and configured to comply with ETSI 303 645? If you disagree, explain your answer.

Question: Which standards, if any, do you think would be an appropriate alternative to ETSI 303 645 for public charge points?

Question: In your view, what, if any, would be the costs and benefits of requiring public charge points to be built in compliance with ETSI 303 645? Provide evidence in your response.

Question: Do you agree or disagree that requirements for device compliance with ETSI 303 645 should be applied to public charge points sold and installed in GB? If not, explain your answer.

Equivalent standards: EN 18031

Question: In your view, does the EN 18031 standard provide a suitably equivalent level of cyber security to ETSI 303 645? If not, explain why not.

Question: Do you agree or disagree that when a public charge point is manufactured to the EN 18031 standard, this should, in your view, be treated as indirectly complying with ETSI 303 645 for this policy? Explain your answer.

Question: In your view, is there a better way to support charge point manufacturers selling their devices across the EU, Northern Ireland and GB, other than allowing compliance with EN 18031?

Additional physical protections

Question: In your view, do public charge points require additional physical tamper protections, beyond ETSI 303 645, to sufficiently protect them? If not, why not?

Question: In your view, what, if any, are the vulnerabilities specific to public charge points which necessitate additional physical tamper protections?

Question: In your view, should public charge points be fitted with tamper detection sensors? If not, explain your answer.

Question: If implemented, where on the charge point should the tamper detection sensors be placed?

Question: In your view, should public charge points be fitted with tamper detection seals? If not, explain your answer.

Question: If implemented, where on the charge point should the tamper detection seals be placed?

Question: In your view, are there more appropriate methods of tamper-proofing public charge points than those suggested in this consultation? Provide details.

Question: In your view, what, if any, are the costs and benefits of requiring the specified additional physical protections set out in this consultation? Provide evidence to support your response.

Metering requirements

Question: Do you agree or disagree that all public charge points should be fitted with a minimum of Class B meters, as defined in the Measuring Instruments Regulations 2016? If you disagree, explain your answer, including, if possible, an alternative suggestion.

Question: In your view, what, if any, are the costs and benefits of requiring the use of meters in public charge points which are compliant with requirements in the Measuring Instruments Regulations 2016? Provide evidence to support your response.

Compliance and assurance

Question: In your view, what, if anything, would be the most appropriate method of assuring compliance with these proposals? Explain your answer.

Question: In your view, what would be the costs and benefits of assuring compliance via self-assessment with spot checking by a regulator? Provide evidence to support your response.

Question: In your view, what would be the costs and benefits of assuring compliance by requiring organisations to seek accredited third-party testing and certification? Provide evidence to support your response.

Question: In your view, what, if anything, would be the most appropriate method for assuring compliance with physical tamper protections?

Question: For devices already in compliance with EN 18031 or other future equivalent EU standards, what would be the most appropriate method of confirming this existing compliance?

Implementation

Question: In your view, do the requirements put forward in these proposals conflict with or duplicate any existing requirements that apply to public charge points? If yes, explain this conflict/duplication.

Charge point manufacturers

Question: Do you already build your charge point devices to be compliant with ETSI 303 645 or EN 18031? If so, which standard(s)?

Question: If yes, how much did it cost your organisations to build these compliant devices? If no, provide your best estimate of how much it would cost you to become compliant with each. If possible, provide a detailed breakdown of costs by one-off, annual, per-unit and ongoing.

Question: Do you already build your charge points to be compliant with any of the physical anti-tamper requirements proposed in this consultation? If so, which ones?

Question: If you already build your charge points to include a tamper detection sensor or tamper detection seal, how much did it cost your organisation to manufacture devices with these additional protections? If not, provide your best cost estimate. If possible, provide separate detailed breakdowns of costs by one-off, annual, per-unit and ongoing, for both the sensor and seal.

Question: Do you already fit your charge points with Class B electricity meters compliant with requirements set out in the Measuring Instruments Regulations 2016 (MIR)?

Question: If yes, how much does it cost your organisation to use these meters, in comparison to using meters that are not compliant with MIR requirements? If not, provide your best cost estimate.

Question: What, if any, other costs or benefits (both monetised and non-monetised) could the proposals put forward in this consultation bring to your organisation?

Question: How can industry best be supported in implementing these proposals if they are proceeded with?

Charge point operators

Question: Do your charge points currently comply with any of the requirements proposed in this consultation? If so, which ones?

Question: How much, if at all, does compliance with these requirements impact the purchase cost?

All organisations

Question: In your experience, what is the average life-span of a charge point from the point of installation to the point of replacing?

Question: How long would it reasonably take to implement these proposed requirements for new public charge points?

The easiest way to submit your answers is to use the online response form. For other ways to submit your answers, see how to respond.

Further information

Freedom of information

Information provided in response to this consultation, including personal information, may be subject to publication or disclosure in accordance with the Freedom of Information Act 2000 (FOIA) or the Environmental Information Regulations 2004.

If you want information that you provide to be treated as confidential, please be aware that, under the FOIA, there is a statutory code of practice with which public authorities must comply and which deals, amongst other things, with obligations of confidence.

In view of this, it would be helpful if you could explain to us why you regard the information you have provided as confidential. If we receive a request for disclosure of the information, we will take full account of your explanation, but we cannot give an assurance that confidentiality can be maintained in all circumstances. An automatic confidentiality disclaimer generated by your IT system will not, of itself, be regarded as binding on the department.

Data protection

The Department for Transport (DfT) is running this consultation, which is asking for your views on cyber security for public electric vehicle charge points.

Your personal data collected through this consultation is processed in line with our online forms, surveys and consultations privacy notice.

View our DfT online form and survey privacy notice for more information on how your personal data is processed in relation to this survey.

Do not include personal information in your responses unless specifically requested.

Artificial intelligence

Artificial intelligence (AI) may be used to analyse responses to this consultation. Where the consultation asks for directly identifiable information, such as your name or contact details, this will be removed before processing with AI tools.

  1. EN 303 645 to V3.1.3 - CYBER: Cyber security for consumer internet of things: baseline requirements. ↩

Back to top