EV charging cybersecurity in Europe: which rules apply and what to secure first

A charge point is a networked device: firmware, a communication module, remote control and payment. Europe has no single cybersecurity rule written for charging. Several texts overlap, each with its own dates and scope, and it is easy to mix them up.

Where the exposure is

The link between charger and CSMS. Remote monitoring and control are required by the AFIR for public points, so, as good practice, this channel should be authenticated and protected.

The CSMS and its back end. It can command many chargers at once and holds usage data. A breach there has a wider effect than one compromised charger.

Third-party integrations. Roaming platforms, payment providers and energy-market partners all connect to your systems.

Firmware and supply chain. Components come from several manufacturers, and a flaw in one model can affect every site that uses it.

On the protocol side, OCPP 1.6 and 2.0.1 are not compatible. The 2.0.1 foundation includes enhanced security with TLS, and its certification programme offers an Advanced Security option. Knowing which of your chargers speak which version is the first security question.

Which European texts apply

AFIR. It requires public points to be remotely monitored and controlled, and the delegated regulation 2025/656 sets ISO 15118 requirements for public points installed or renovated from 8 January 2026, then ISO 15118-20 from 1 January 2027. Plug and Charge remains optional for the operator. If you offer it, both ISO 15118-2 and ISO 15118-20 apply. The AFIR does not name OCPP.

Radio equipment directive (2014/53/EU). Do not confuse it with RED III, which is the renewable energy directive and has nothing to do with security. The delegated regulation 2022/30 covers network protection, personal data and privacy, and fraud for radio equipment connected to the internet. It was due to apply from 1 August 2024, and a later act, according to Kiwa, postponed it to 1 August 2025. Whether it covers a given charger is a common interpretation, not a text that names charge points: ask your manufacturer for its position.

Cyber Resilience Act (Regulation 2024/2847). The CRA applies from 11 December 2027. The notification duty for actively exploited vulnerabilities and serious incidents applies earlier, from 11 September 2026. Charge points are not named in the text; they fall under products with digital elements. Products placed on the market before 11 December 2027 are in scope only after a substantial modification, except for that notification duty.

NIS2 (Directive 2022/2555). Annex I lists, in the energy sector, the operators of a recharging point who manage and run it and provide a charging service to end users, including on behalf of a mobility service provider. Whether your company is covered also depends on its size and on how your country transposed the directive. Check that with your legal adviser.

No ENISA publication specific to charging cybersecurity was found, so no agency recommendation is cited here. Non-official guidance exists, such as the requirements published by ENCS and E.DSO.

Measures to prioritise

Authenticated, encrypted communication between each charger and the CSMS, with certificates managed over time.

A segmented back end, so that optimisation or public-facing services cannot reach the control functions directly.

Strict validation of every external feed and message before it can trigger an action.

An audit trail of remote commands and configuration changes.

Controlled firmware updates, with a record of the version on each charger.

Named accounts and limited rights for staff and partners.

Cybersecurity clauses in contracts with roaming, payment and hardware suppliers.

In procurement

Ask for OCPP 2.0.1 with its security options on new chargers, and for ISO 15118 compliant with the dates above. Ask each manufacturer how it handles vulnerabilities, firmware updates and the radio equipment delegated act.