UK consults on a cyber baseline and anti-tamper rules for public charge points
The Department for Transport opened a consultation on requiring public electric-vehicle charge points sold or installed in Great Britain to meet the ETSI EN 303 645 security standard, and said a separate consultation on the vehicle-to-charger communication standard would follow.
The UK Department for Transport opened a consultation on October 29 on cyber security requirements for public electric-vehicle charge points, closing on December 20. The consultation document sets out four proposals: that public charge points sold or installed in Great Britain comply with the ETSI EN 303 645 security standard; that an alternative compliance route through EN 18031 might be allowed; that they be built with physical anti-tamper protections; and that they be fitted with electricity meters complying with the Measuring Instruments Regulations 2016.
The department wrote that there are currently no specific cyber security requirements for public charge points, and that most organizations operating them will not initially fall within the scope of the Network and Information Systems Regulations 2018. Domestic and smaller non-domestic charge points are already covered by the Electric Vehicles (Smart Charge Points) Regulations 2021, which the document says are due to be revoked and replaced under the proposed Energy Smart Appliance Regulations. Public charging organizations controlling 300 megawatts or more of electrical load in aggregate across their networks come within the NIS regulations, which would require them to meet requirements based on the National Cyber Security Centre’s cyber assessment framework — a change the document notes is subject to the passage of the Cyber Security and Resilience Bill. The Department for Energy Security and Net Zero consulted on that layer separately: its consultation on a Tier 1 cyber assessment framework for large load controllers opened on June 23 and closed on September 1, 2026. The Department for Transport’s document describes those proposals as still being consulted on.
The document also states that DESNZ and the transport department intend to consult separately on requiring charge points to be equipped with ISO 15118-20, the communication standard between a vehicle and a charge point. That consultation has not opened, and the proposals published on October 29 place no requirement on vehicles.