EV Charger Cybersecurity Requirements: UK, EU and US

Short answer: a connected charger is an internet device that switches high power, and regulators now treat it that way. In the EU, internet-connected chargers have to meet RED cybersecurity rules (EN 18031) since 1 August 2025, with the Cyber Resilience Act following. In the UK, private chargers must meet the Smart Charge Points Regulations 2021. In the US, federally funded sites follow 23 CFR 680 plus state and utility rules. Ask the supplier for evidence, not promises.

Rules by market

Market	Main rule	Applies to	Status
EU	RED Delegated Regulation 2022/30; EN 18031-1/-2/-3	Chargers with Wi-Fi, cellular or other radio connection to the internet	In force since 1 Aug 2025
EU	Cyber Resilience Act (2024/2847)	Products with digital elements	Reporting from 11 Sep 2026; main duties from 11 Dec 2027
EU	AFIR (2023/1804)	Public chargers: communication and data standards	See importing into the EU and UK
UK	Smart Charge Points Regulations 2021	Private charge points sold in Great Britain	In force
UK	Public Charge Point Regulations 2023	Public chargers: reliability, data, payment	In force
US	23 CFR 680 (NEVI)	Federally funded fast-charging stations	In force; check current text
US	State and utility rules	Varies	Check per project

This is an overview, not legal advice; confirm the current text for your market.

What the rules ask for in practice

Reading across the regulations and the standards, a connected charger should have:

1. No universal default password. Every unit gets a unique credential, or the user must set one on first use.
2. Signed firmware. The charger accepts only updates signed by the manufacturer — see OTA firmware updates.
3. Encrypted communication with the back end (TLS) and certificate checks.
4. Secure storage of keys and credentials, and protection of personal data such as RFID tags and user accounts.
5. Tamper protection for local interfaces: service ports, USB, debug pins.
6. A way to report vulnerabilities and a published process for security patches.
7. A support period: how long the manufacturer will provide security updates.

OCPP security profiles

OCPP defines how a charger secures its connection to the back end.

Profile	Transport	Authentication	Use
1	Unencrypted WebSocket	Basic (username and password)	Closed private networks only
2	TLS	Server certificate + Basic authentication	Common minimum for production
3	TLS	Server and client certificates	Strongest; recommended for public networks

OCPP 2.0.1 builds these profiles into the specification; OCPP 1.6 supports them through the security extension. The back end must support the same profile. For the version differences, see OCPP 1.6J vs 2.0.1.

What to ask a charger supplier

Question	A good answer
Which security profile does the charger support?	Profile 2 and 3, tested with named back ends
Do you have RED / EN 18031 evidence for the EU?	A test report or declaration naming the model and the standard
How are default credentials handled?	Unique per device, or forced change at first use
How do you sign and deliver firmware?	Signed images; keys kept at the manufacturer
How long are security updates supported?	A stated number of years, in the contract
Where do I report a vulnerability?	A named security contact and a response process

Put the answers into the tender specification so that they are part of the contract.

Don’t forget the site

Many incidents come from the installation, not the charger: a service laptop left on the network, a router with a default password, an open port. Segment the charger network from the business network, change defaults and keep a list of what is connected. See charger connectivity options for how the link itself is built.

VULTAE position

VULTAE chargers support OCPP 1.6J and 2.0.1 and communicate over Wi-Fi, 4G and Ethernet. For a project in the EU or UK, tell us the destination and the back end; we will confirm the security features and the available evidence for the exact model before quotation.