ESMC Welcomes EU Focus on Solar Inverter Cybersecurity, Launches New Industry Forum

The European Solar Manufacturing Council (ESMC) has welcomed the European Commission’s newly released Economic Security Doctrine, “Strengthening EU Economic Security”, which flags solar inverters from Chinese suppliers as a high-risk dependency for the European power system. The Commission cited concerns over supplier concentration, cybersecurity vulnerabilities, potential cyber-manipulation, and access to grid-relevant operational data.

According to the Commission’s communication, coordinated cyber-risk assessments under the NIS2 Directive are planned from 2026, alongside certification under the Cyber Resilience Act and the application of non-price resilience criteria under the Net-Zero Industry Act (NZIA).

ESMC said the policy marks an important strategic shift for Europe’s clean energy sector. The council noted that nearly 80% of newly installed photovoltaic (PV) systems in Europe rely on Chinese-manufactured inverters, with just two suppliers dominating the market. This level of concentration, ESMC warned, creates systemic cybersecurity risks, as firmware or software updates could potentially affect millions of systems simultaneously, raising the risk of large-scale power disruptions.

Describing the doctrine as a “wake-up call,” ESMC Secretary General Christoph Podewils said EU member states must now take decisive steps to reduce dependencies and mitigate cyber risks in critical energy infrastructure.

ESMC also welcomed the European Commission’s stated intention to support the development of trusted suppliers of critical sub-components within the EU and in trusted third countries. The council said such measures are essential to reduce structural dependencies and enhance Europe’s clean-energy resilience. It reiterated that European and other Western manufacturers remain at the technological forefront and have sufficient manufacturing capacity to meet Europe’s entire inverter demand.

As part of its response, ESMC called for several policy actions, including the creation of an EU-level whitelist of trustworthy inverter suppliers based on cybersecurity and jurisdictional risk criteria, integration of such a list into NIS2 and NZIA frameworks, the ability for member states to deny grid connections to high-risk inverter hardware, incentives for secure inverter choices under NZIA provisions, and stricter enforcement of the EU’s Foreign Subsidies Regulation.

In parallel, ESMC announced the establishment of a new Inverter, Storage and Energy Management Systems (EMS) Forum, aimed at strengthening Europe’s energy security and strategic autonomy. The forum brings together leading Western manufacturers to promote a resilient, competitive, and cyber-secure ecosystem for inverters, storage systems, and energy management technologies.

ESMC said the forum will focus on both technical and non-technical risk factors, including software governance, ownership structures, external influence, and overall supplier trustworthiness. It will engage with EU and national authorities, contribute to regulatory initiatives such as the NZIA, Cyber Resilience Act, Cyber Security Act and NIS2, and collaborate with grid operators, standardisation bodies, and energy-security agencies.

The founding members of the forum include Enphase Energy, Fronius International, Ingeteam, Kostal, Power Electronics, SMA Solar Technology, SolarEdge, Tesvolt, and Vector Energy.