Home battery and inverter safely online: what you arrange yourself

Last updated 25 October 20269 min read

What changed: Sources tightened: the CRA reporting and update duties described more precisely, sources from the Dutch Data Protection Authority and EUR-Lex added, and the rules for devices with a radio connection added. The description of the risks and solution directions from the RDI position paper has been made more precise.

Short answer

A home battery, inverter or charger that you control through an app is a device on the internet. Keep it safe: install updates, replace the default password right away, turn on two-step verification and secure your wifi. From 11 December 2027 manufacturers must provide security updates during the support period, for products placed on the market from that date.

A home battery, inverter or charger is usually online. What you arrange yourself (updates, password, wifi) and which EU rules apply from 2027.

All articles

Why the government is looking at this now

Home battery

In October 2026 the Rijksinspectie Digitale Infrastructuur (RDI), the Dutch digital infrastructure inspectorate, presented a position paper on devices that control a lot of power over the internet: solar inverters, home batteries, EV chargers and heat pumps. The RDI calls them high-power IoT. The accompanying news item of 7 October 2026 sums up the core. Many of those devices depend on the same digital back end: the servers and software of a manufacturer, an energy management system or an aggregator. Through that single entry point you can control a great many devices at once.

The RDI names three ways in which this can go wrong:

a manufacturer or provider accidentally rolls out a faulty update or setting;
malicious actors exploit a vulnerability in the devices or systems;
a state with malicious intentions can have coercive means at its disposal to force manufacturers and providers of energy management systems, aggregators and cloud platforms under its jurisdiction to cooperate.

If that happens to a great many devices at once, supply and demand of electricity can swing suddenly and sharply. That can disturb the power grid. According to the RDI the risk arises when a large number of devices is influenced at the same time. The greatest risk lies with the back-end systems of manufacturers, energy management systems and aggregators, and the cloud platforms they use. A lot of power drops out or comes on at once: according to the RDI, from 3 gigawatts a sudden imbalance between supply and demand can lead to disruptions. In the position paper the RDI names no brands or countries as a source of the risk. Two of the three causes, a faulty update and the abuse of a vulnerability, can occur at any manufacturer and provider. It is about how the system is built.

The same connection also brings opportunities: connected devices can help keep the grid stable and counter congestion. Read more about smart home energy control, about grid control and about a dynamic energy contract.

What the rules already ask, and what comes in 2027

The European Cyber Resilience Act (CRA) sets requirements for the digital security of products with digital elements. For solar inverters, home batteries and chargers too, the CRA is an existing rule. The CRA applies in steps.

The CRA in two steps

When	What applies to manufacturers then
Since 11 September 2026	Manufacturers must report actively exploited vulnerabilities and severe incidents to the designated CSIRT (in the Netherlands the NCSC) and to ENISA. That also applies to products that were placed on the market earlier.
From 11 December 2027	The most other rules apply, for products placed on the market from that date. A product that is already on the market is covered only after a substantial modification. Manufacturers must then, among other things, design their products securely, deal with vulnerabilities and provide security updates during the support period, and give information on safe use. Products that comply get a CE marking. Importers and distributors must then also check whether a product complies with the CRA.

When

What applies to manufacturers then

Since 11 September 2026

Manufacturers must report actively exploited vulnerabilities and severe incidents to the designated CSIRT (in the Netherlands the NCSC) and to ENISA. That also applies to products that were placed on the market earlier.

From 11 December 2027

The most other rules apply, for products placed on the market from that date. A product that is already on the market is covered only after a substantial modification. Manufacturers must then, among other things, design their products securely, deal with vulnerabilities and provide security updates during the support period, and give information on safe use. Products that comply get a CE marking. Importers and distributors must then also check whether a product complies with the CRA.

These are duties for the manufacturer, not for you: the reporting duty applies since 11 September 2026, also for products already on the market. Most other rules apply from 11 December 2027, for products placed on the market from that date. You can ask about them when you buy: see the checklist below.

For devices with a radio connection (wifi, Bluetooth or 4G) that can communicate over the internet, directly or through another device, cybersecurity requirements from the Radio Equipment Directive have applied since 1 August 2025, through Delegated Regulation (EU) 2022/30. Harmonised standards (EN 18031) have been drawn up for them. From 11 December 2027 that regulation is repealed and the CRA replaces it.

According to the RDI the CRA rules are still fairly general for this kind of device: the CRA mostly sets general requirements for high-power IoT. That is why the RDI describes three possible directions. Status: proposal of the regulator, not yet law. The RDI writes that an answer at European level is necessary.

European requirements per type of device and the associated back end, taking the risks to the power grid into account. An independent check before the device is allowed on the market is a possibility. Today the manufacturer checks this itself.
Bringing parties that control a lot of power remotely under the European cybersecurity rules for organisations (NIS2), regardless of their size or location.
Additional measures to strengthen digital autonomy. Parties that can control many devices remotely are partly located outside the European Union, and according to the RDI that creates geopolitical risks. Vital processes should become less dependent on them.

What is still to come: agreements on controllability

Status: assignment given, no requirements or date yet. The Dutch cabinet has instructed the Dutch standards institute NEN to develop technical agreements for heat pumps, EV chargers, home batteries and solar inverters, and a standard for home energy management systems (HEMS). Those agreements are meant to set out which requirements devices must meet to be controllable. The cabinet is also working on European standards. Cybersecurity is explicitly included in that effort, according to the cabinet.

The parliamentary document names no requirements or date for those agreements yet. So do not base a purchase on what may come.

What you arrange yourself: checklist

The government rules are about manufacturers. These are the things you control yourself.

Six things you arrange yourself

What	Why	How
Install updates	You keep online criminals out: through one device they can otherwise reach your wifi network. With the latest software, known vulnerabilities are fixed in time.	When you get a new device, check straight away whether there is an update, and switch on automatic updating. If that is not possible, put a reminder in your calendar to check at least twice a year.
Replace the default password	Changing your password and username (where possible) is one of the most important steps in securing new equipment.	Never keep using a password set by the manufacturer: replace it straight away with a password of your own.
Turn on two-step verification	With two-step verification a stolen password is not enough to log in.	Turn it on in the account of the app, if the app offers it. The Dutch Data Protection Authority also says it is advisable to use multi-factor authentication when the device or platform offers it.
Secure your wifi and router	Through your router, cybercriminals can reach other smart devices in your home, and the router is the one most often forgotten.	Choose WPA2 and a wifi password of at least 20 characters and replace the default admin password of your router.
Know who can steer remotely	Not only the manufacturer can influence a device remotely: so can an energy management system, an aggregator or an installer.	Ask your installer: see the questions below.
Ask about the support period	From 11 December 2027 manufacturers must provide security updates during the support period, for products placed on the market from that date. A product that is already on the market is covered only after a substantial modification.	When you buy, ask how long the manufacturer promises updates. Is the software badly outdated and are there no more updates? Then you can consider replacing the device and its software.

What you can ask your installer

Four questions you can ask any installer:

Is the battery or inverter running the latest software, and are automatic updates on?
Which account is the installation on, and can I set the password and two-step verification there myself?
Which parties have access to steer remotely, and how do I switch that off?
Does the battery still work (for example for self-consumption or backup power) if the internet connection drops?

This article is about the digital side. Still exploring? Then read about choosing a home battery and about where to place a home battery, the physical side of safety. More about having a home battery installed is on our product page.

Not sure how your system is set up? Book an advice call.

Sources

Get more out of your own power. Four things to watch for

Your energy use

Planning to drive, cook or heat electrically? Factor that into how many panels you install now.

Spread the yield

Spread panels across roof faces so you generate through the day and use more of your own energy.

Your data

Ask your installer where your system's data is stored and which parties have remote access.

Boost your energy

A smart home battery stores today's power for later, so you use more of your own electricity after sunset.

We install your home battery

Usually within three weeks. Our installers fit the battery neatly and safely by your fuse box. We leave your home clean and make sure you know exactly how it all works.

Charge smart when power is cheap
Keep power until you need it

Book an appointment

Frequently asked questions

Any device on the internet can have a weak spot. You reduce the risk with updates, your own strong password, two-step verification and a secured wifi. The risk the RDI describes lies mainly with the back-end systems through which a great many devices are controlled at once.

A European regulation with requirements for the digital security of products with digital elements. Since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents, to the designated CSIRT (in the Netherlands the NCSC) and to ENISA. From 11 December 2027 the most other requirements apply, such as secure design and security updates, for products placed on the market from that date. A product that is already on the market is covered only after a substantial modification.

Not just like that. The internet connection is usually also how the manufacturer's updates reach the device. What still works without a connection differs per system. Better: keep it up to date and secure your account and wifi. Ask your installer which parties can steer it remotely.

Nothing has been decided yet. The RDI sees three possible directions: European requirements per type of device with possibly an independent check, appropriate cybersecurity requirements for parties that control a lot of power remotely, and more digital autonomy. That is a proposal of the regulator, not yet law.

Discover what smart energy can do for you

In about an hour you get insight into your savings, the options for your home and when the investment pays back. Straightforward, honest advice so you know exactly where you stand.