Chinese EV chargers in Europe: the AFIR, OCPP and cyber requirements every charger must meet

Operators regularly ask what the arrival of Chinese charger manufacturers means for their networks. The honest answer starts with what is not known, then moves to what is: the rules that apply to a charge point sold in Europe do not depend on where it was built. This article sets out those rules as a procurement checklist, so that the question becomes one about conformity and not about origin.

What the sources support, and what they do not

For electric cars, the data is clear. The IEA reports that EU imports of electric cars rose by 35% to more than 900,000 in 2025, with China accounting for almost 60% of them (IEA, Global EV Outlook 2026). That concerns vehicles, not chargers.

For charge point manufacturers, we found no sourced figure on market share by country of origin in Europe. So we give none, and we make no generalisation about the quality, security or protocol behaviour of any group of manufacturers. Such claims have to be tested model by model, with evidence from the supplier and from your own pilot.

The requirements that apply to every charger

Whatever its origin, a public charge point in the EU falls under the AFIR, a regulation that is directly applicable in all Member States and has applied since 13 April 2024. Check each model against the following.

Remote monitoring and control. Public points must be digitally connected since 14 October 2024, meaning able to exchange information in real time and to be monitored and controlled remotely.

Smart charging. Public points built after 13 April 2024, or renovated after 14 October 2024, must be capable of smart recharging, which means adjusting the charging current in real time from information received electronically.

Ad hoc payment. Points deployed from 13 April 2024 must offer electronic payment by card reader or contactless device. A device linked to the internet, such as a QR code, is accepted only for points below 50 kW. From 1 January 2027, points of 50 kW or more on the TEN-T network or on a secure parking area, including those deployed earlier, must have a card reader or contactless device.

Fixed cable. All public DC points must have a fixed charging cable since 14 April 2025.

Price display. For points of 50 kW or more, the ad hoc price per kWh, and any occupation fee, must be shown before the session starts.

ISO 15118. The delegated regulation 2025/656 requires ISO 15118 parts for points installed or renovated from 8 January 2026, and EN ISO 15118-20:2022 from 1 January 2027.

None of these requirements names OCPP. The regulation does not oblige a given protocol, so a supplier who writes "AFIR compliant" in a brochure has not told you which protocol version or which functions the model actually supports.

Data your backend must be able to feed

Since 14 April 2025, operators must make static and dynamic data available free of charge. The dynamic data includes the operational status, the availability, the ad hoc price, and whether the electricity is entirely renewable. The implementing regulation 2025/655 requires the DATEX II format, at least CEN/TS 16157-10:2022, from 14 April 2026.

This is where the charger and the CSMS meet. If a model does not report its status reliably, you cannot publish a reliable status. Ask suppliers how each state change reaches your backend, and test it on a pilot site before you buy at scale.

Interoperability: the version number is not the evidence

A charger that advertises OCPP 1.6 or 2.0.1 tells you the version, not which parts of the standard it implements or how. This is true of any manufacturer. The Open Charge Alliance runs certification programmes: for 1.6, the Core part is mandatory for both charger and CSMS, and the 2.0.1 programme offers Core, Advanced Security, Smart Charging and ISO 15118 Support. Ask for the certification evidence for each part you rely on, and test the rest yourself: remote start and stop, charging profiles, firmware updates, meter values.

Cybersecurity obligations to plan for

Two EU texts matter for operators who buy connected equipment.

The Cyber Resilience Act applies from 11 December 2027. Notification of actively exploited vulnerabilities and serious incidents applies from 11 September 2026. Chargers are not named in the text; they are covered as products with digital elements.

The NIS2 directive lists, in its energy sector annex, operators of a recharging point who are responsible for its management and operation. Whether it applies to you also depends on your size and on national transposition, which you should check for each country.

For procurement, ask the manufacturer how it handles vulnerability reports and security updates, and for how long it commits to provide them.

This week

Pick the charger models that are most numerous in your estate or your pipeline. For each one, fill a one-page file: OCPP version and certification evidence, ISO 15118 parts and the installation date they apply to, payment device for points of 50 kW or more, status reporting tested, vulnerability and update policy. Do the same for every new supplier, whatever its origin. GFO Omni is a CSMS that supervises charge points over OCPP 1.6, 2.0.1 and 2.1.