Britain’s Department for Transport opened a consultation on Tuesday proposing a legal cybersecurity baseline for every public electric vehicle charger sold or installed in Great Britain, a gap the department says currently has no specific mandate.
The paper carries four preferred interventions and closes at 11:59pm on 20 December 2026. No final rule has been announced.
What the proposals would actually require
Manufacturers would have to show compliance with ETSI EN 303 645, the consumer internet-of-things standard already familiar to smart-plug and camera builders. The department suggests accepting the European EN 18031 route as an alternative so equipment certified for the EU does not need a second assessment.
Physical hardening is the second pillar. Chargers would need tamper-evident seals and casing sensors that register an attempt to open the unit, with users notified when internals have been reached.
Metering gets pulled in as well. New public charge points would carry Class B meters meeting Measuring Instruments Regulations 2016 accuracy, inside a 2% tolerance, to blunt tampering for billing fraud.
What the paper leaves out
Nothing already installed has to change. The department rules out mandating retrofits, so a non-compliant charger only leaves service when it reaches end of life and is replaced.
Verification stays open too, with self-assessment plus inspections and third-party certification both on the table.
A second phase would reach charge point operators and e-mobility service providers through a best-practice framework. Organisations controlling 300MW or more already fall toward NIS Regulations 2018 duties once the Cybersecurity and Resilience Bill passes.
Separately, DESNZ and DfT plan their own consultation on mandating ISO 15118-20, the plug-and-charge communication standard whose relay weaknesses researchers have demonstrated.
Domestic chargers sit outside the scope entirely. They remain under the 2021 Smart Charge Points Regulations.
