Home chargers in Great Britain have had to meet cyber security requirements under the Electric Vehicles (Smart Charge Points) Regulations 2021. Public chargers have no equivalent rules. The Department for Transport (DfT) wants to change that. On 29 October 2026 it opened a consultation proposing that public charge points meet a named cyber security standard, include physical anti-tamper protection, and be fitted with meters that comply with UK measurement law. The consultation closes at 11:59pm on 20 December 2026.

Nothing has been decided yet. These are proposals, and several details, including how compliance would be checked, are still open. Below is what the documents say, what they leave open, and where the plan fits among the rules that already cover charging hardware and operators.

The Gap the Proposal Targets

The consultation document says there are currently no specific cyber security requirements for public charge points. That stands out because the hardware and organisations either side of public charging are already covered, or are due to be.

According to the consultation document, domestic and small non-domestic charge points (excluding public charge points) fall under the Electric Vehicles (Smart Charge Points) Regulations 2021. Those regulations are due to be revoked and replaced by the proposed Energy Smart Appliance Regulations. At the other end of the scale, public charging organisations that control 300 megawatts or more of electrical load in aggregate across their network will be in scope of the Network and Information Systems (NIS) Regulations 2018. That change is subject to the passage of the Cyber Security and Resilience Bill through Parliament. The document adds that most organisations will not initially fall within the scope of NIS.

So home wallboxes and the very largest charging networks sit inside a regulatory framework, or will once the bill passes, while the public charge point device itself does not. The consultation is meant to cover that middle layer.

What Is Being Proposed

The GOV.UK consultation page lists four main proposals:

  • A baseline standard. Public charge points sold or installed in Great Britain would have to comply with the cyber security standard ETSI 303 645. The consultation document notes that domestic and small non-domestic charge points are already required to be built to this standard.
  • A possible alternative route. The government is considering allowing compliance through the cyber security standard EN 18031 as an alternative. The document says it is considering treating EN 18031 as an equivalent standard, partly to help manufacturers sell in both the UK and the EU.
  • Physical anti-tamper protection. Chargers would need to be built with physical anti-tamper protections. The consultation document says the measures under consideration include a tamper-protection seal or sticker, a tamper-protection sensor, and a notification to the end-user if there is an attempt to access internal components.
  • Compliant meters. Public charge points would have to be fitted with meters that comply with the Measuring Instruments Regulations 2016. The consultation document says this requires a minimum of a Class B meter, which it describes as capable of measuring active electrical energy to within 2% accuracy.

The metering proposal goes beyond cyber security in the narrow sense. The consultation document says the meter requirement would support consumer and charge point operator interests by ensuring the accuracy of public charge points. Billing accuracy and tamper resistance are being handled in the same package.

Why the DfT Says It Matters

According to PA's report, carried by the Irish News, the DfT identified a range of risks to the charging network, including direct attacks on specific charge points and more widespread attacks on the overall infrastructure. EV Fleet World put the second risk more precisely: charge points being manipulated or misused to compromise other parts of the charging network.

The 300 MW threshold for NIS coverage shows that the government treats aggregate charging load at large operators as infrastructure. Neither the consultation documents nor the news reports cited here describe any specific past incident in Great Britain.

Phase One, and a Possible Phase Two

The consultation describes a staged approach. Phase one, which is what is under consultation now, sets a consistent baseline for public charge point devices. According to the consultation document and EV Fleet World, a second phase could potentially place further cyber security requirements on public charge points and on the organisations that control them, requiring charge point operators (CPOs) and e-mobility service providers (eMSPs) to follow a framework for cyber security best practice. No phase two proposal has been published.

Separately, the consultation document says the Department for Energy Security and Net Zero (DESNZ) and DfT intend to consult separately on requiring charge points to be equipped with the EV-to-charge-point communication standard ISO 15118-20. That consultation is described as intended; the documents cited here do not say it has opened.

What Is Still Undecided

The consultation document says the compliance route has not been settled. DfT will develop an approach to enforcement informed by further stakeholder engagement. Options it lists include self-assessment by organisations against the relevant test specifications, with a regulator (to be determined) carrying out spot checks, or requiring accredited third-party testing and certification. The consultation asks respondents about the costs and benefits of each approach.

On existing hardware, the document says that if the proposals proceed, DfT intends to apply the requirements to sold and installed public charge points only, and that it will not require retrofitting. Devices would need to be replaced with compliant ones when they come to the end of their life cycle and are decommissioned. The documents cited here do not set a commencement date. Any timeline will depend on the government's response once the consultation closes.

What It Means for Drivers

For now, nothing changes. Drivers can charge where they charge today. The proposals as described in the documents cited here add no new access rules, payment rules or pricing requirements. Any requirements would apply only after the government reviews the responses and publishes final rules, and no date has been set for that.

If the proposals go ahead in their current form, drivers would see the changes in three places:

  • Billing accuracy. Meters would have to comply with the Measuring Instruments Regulations 2016, with a minimum of Class B, which the consultation document describes as accuracy to within 2%. The document notes these regulations already apply to public charge points used for trade, which it says currently includes most public charge points.
  • Tamper resistance. Chargers would have physical protection against interference, such as seals, sensors and notifications, according to the consultation document.
  • Software baseline. Public chargers would have to meet a recognised cyber security standard, ETSI 303 645 or possibly EN 18031. Today no charge-point-specific rule exists for public chargers.

The separate ISO 15118-20 consultation is intended but not yet confirmed as open, according to the consultation document. Home charging is not part of this consultation, because domestic charge points are already covered by the 2021 Smart Charge Points Regulations.

Who Should Respond

The consultation will interest charge point manufacturers, CPOs, eMSPs and others involved in procuring or hosting public charging. According to the GOV.UK consultation page, responses can be made online, by email to [email protected], or by post to the OZEV cyber security team at the Department for Transport, and the consultation closes at 11:59pm on 20 December 2026.

For site hosts and operators, the open questions are how compliance would be assured and how existing hardware is treated. Those are the issues most likely to affect procurement and upgrade plans, and the consultation questions cover both.

Sources