In January, at the Pwn2Own Automotive contest in Tokyo, security researchers took over a 50kW DC rapid charger from Alpitronic, one of Europe's biggest rapid-charger makers. The same team broke into an Autel charger that day, then a Phoenix Contact CHARX SEC-3150 charging controller, a ChargePoint Home Flex and a Grizzl-E Smart the next. Across three days the contest paid out $1,047,000 for 76 previously unknown vulnerabilities.
Those flaws went to the manufacturers to fix, which is how the contest works. But a fix only protects your car park if somebody actually installs it on your chargers. On most commercial sites, nobody can tell you who that somebody is.
That's the uncomfortable bit. A commercial EV charger is a small computer bolted to your electricity supply, with a SIM card or network cable, a payment terminal, a cloud login and remote control over how much power it draws. Most sites treat it as a parking accessory, so nobody owns its security.
Here's what the rules do and don't cover, what's changing between now and 2028, and a checklist you can work through in an afternoon.
What the law already requires (less than you'd think)
The main rule is the Electric Vehicles (Smart Charge Points) Regulations 2021. They apply to charge points sold in Great Britain since 30 June 2022. The security requirements in Schedule 1 apply to units sold from 30 December 2022. Those requirements are based on the ETSI EN 303 645 consumer IoT standard: no universal default passwords, secure software updates, encrypted communications, protection against tampering, and a published way to report vulnerabilities.
Read the exclusions carefully, because they cover more of a commercial estate than most people realise:
- Public charge points are excluded. If customers or the public plug in, these regulations don't set a security baseline for that unit.
- Rapid charge points of 50kW or more are excluded, whoever uses them.
- Anything sold before 30 December 2022 escaped the security schedule.
So a typical site with a couple of staff wallboxes from 2021, a bank of public 22kW posts and two rapids may have no unit at all that falls under the security rules. The Public Charge Point Regulations 2023 cover payment, pricing, helplines and (for rapids) 99% reliability. They don't add a cyber standard.
None of this makes the kit unsafe. It does mean the law isn't doing your due diligence for you.
What's changing: load control licensing
The bigger change is coming through the government's Smart Secure Electricity Systems (SSES) programme. It deals with organisations that can remotely switch electricity demand up or down in "energy smart appliances". That includes EV chargers.
The timeline, from Ofgem's August 2026 decision and DESNZ's consultations:
- Regulations to be laid in autumn 2026 and to take effect by March 2027.
- A load control licence will be required by March 2028, after a 12-month transition.
- Two roles will need a licence (or an exemption). Load controllers send the signals that turn devices up or down. Flexibility service providers contract with a customer to do it.
- In scope: EV smart charge points, excluding public and rapid charge points, plus heat pumps and other electric heating up to 45kW, home batteries and private EVs' batteries.
- The biggest players (300MW or more of controllable load) are expected to be brought under the NIS Regulations 2018 as a new essential service, with a cyber assessment framework drawn up by DESNZ, Ofgem and the National Cyber Security Centre. DESNZ opened its consultation on that framework on 23 June 2026.
What this means for a business with chargers:
- You won't need a licence. The end user of the appliance isn't captured.
- Your back-office provider might. If whoever runs your charge point software shifts your charging into cheaper hours, or sells that flexibility to the grid, it's doing load control. DESNZ has proposed an exemption for providers whose only customers are larger non-domestic consumers. It doesn't cover small business consumers: those using up to 200,000kWh a year, or with fewer than 50 employees and turnover or a balance sheet of £6.5m / £5m or less. A lot of gyms, pubs, golf clubs and small depots fall under that line. Their providers are the ones the regime is aimed at.
- Ask now, not in 2028. "Will you need a load control licence for what you do on my chargers, and are you planning to get one?" is a fair question in any new back-office contract. A provider that has never heard of SSES is telling you something.
Separately, the Cyber Security and Resilience Bill, which widens the NIS regime, was at Report stage in the House of Lords as of 20 October and hasn't yet received Royal Assent. It's aimed mainly at essential services and their suppliers, not at a car park with six chargers. But it shows where policy is heading.
The afternoon checklist
You don't need a security team for this. You need one person, the installer's handover pack and a login to the charging back office.
1. Write the inventory down. For every charger, record make, model, power, serial number, firmware version, install date, and whether it's private, public or rapid. Then you know which units sit inside the 2021 security rules and which sit outside them. Most sites have never done this.
2. Find out how each charger connects. Built-in 4G SIM, ethernet back to your building, or Wi-Fi? A charger on your guest Wi-Fi or your office network is a weak spot sitting on the same network as your tills or laptops. Chargers should be on their own network segment (a separate VLAN) or their own SIMs, ideally on a private network from the SIM provider rather than the open internet.
3. Get rid of shared and default logins. Check the back-office portal, the installer's commissioning app and any local web page on the charger itself. Every person gets a named account. Remove leavers. Turn on two-factor login wherever it's offered. If the installer still has full admin access a year after handover, ask why.
4. Ask your back-office provider three questions.
- Which OCPP security profile do our chargers use? Profile 1 is basic password authentication with no encryption. Profiles 2 and 3 add TLS encryption, and profile 3 adds per-charger certificates. On a commercial site, profile 1 shouldn't be the answer.
- Who installs firmware updates, and how quickly? Put a number in the contract, such as critical security fixes applied within 30 days of the manufacturer releasing them.
- Who gets told if something goes wrong, and within how many hours?
5. Check the manufacturer. Does it publish a vulnerability disclosure policy and a security update support period? For private units sold since December 2022 it should. For public and rapid units, ask, and treat "we don't have one" as a buying signal against that brand.
6. Lock the physical side. Public chargers have a payment terminal, a cabinet and often a service port. Check that tamper alerts actually reach someone, that cabinets are locked and keyed to the operator rather than left on a generic key, and that staff know what a skimmer or tampered card reader looks like.
7. Tell your insurer. If you have cyber cover, make sure the policy knows the chargers exist and who operates them. If a charger is the way into your network, you don't want to find out at claim time that it wasn't declared.
8. Keep an exit route. If your provider can't answer questions 4 and 5, you want to be able to leave. That's the practical case for OCPP-compliant hardware. You can move your chargers to a better back office without ripping them out. More on vendor lock-in here.
Our take
The risk to most commercial sites isn't a Hollywood grid attack. It's duller. A charger sitting on the office network with the installer's password, firmware that hasn't been updated since commissioning, and a back-office contract that says nothing about either. The Tokyo results show the kit can be broken into. The 2021 regulations leave public and rapid units outside the security baseline. SSES will bring in rules for whoever controls your load, but not until 2028.
So it's on you. The good news is that the fix is mostly paperwork and three firm questions, and you can sort it the same week you read this.
If you're about to buy chargers, put the same questions to the installer as part of our eight installer checks. And if reliability is already an issue on your site, start with our guide to why commercial chargers fail. Unpatched firmware is often the same root cause.
Want someone to run the checklist with you?
We'll survey your chargers, map what you've got and how it connects, check it against the 2021 regulations and the coming load-control rules, and tell you in plain English what to fix first. No obligation.
Site SurveyRead this article in the app at energy-partners.co.uk/insights/ev-charger-cyber-security-commercial-sites-uk. Energy Partners installs and manages commercial EV charging, solar and battery storage for UK venues — talk to us.