EU inverter restrictions could shift from countries to individual high-risk suppliers

The European Union may change its approach to cybersecurity requirements for solar inverters by targeting individual “high-risk” suppliers rather than countries of origin.

The shift emerges from a draft report by the European Parliament’s Committee on Industry, Research and Energy (ITRE), seen by pv magazine. The document proposes a series of amendments to the European Commission’s legislative proposal for the Cybersecurity Act 2 (CSA2).

CSA2 is a draft EU regulation proposed in January and is not yet in force. It is intended to update the bloc’s original 2019 cybersecurity rules, strengthen the security of digital supply chains, streamline product certification and expand the powers of the EU’s cybersecurity agency.

One of the key changes proposed in the draft report is Amendment 28, which would modify how suppliers are classified as “high-risk.”

Under the Commission’s January proposal, a supplier may be considered “high-risk” if it is established in a third country identified as posing cybersecurity concerns, or if it is owned or controlled by entities from such a country.

Amendment 28, by contrast, would require an individual assessment of each supplier.

Country of origin, ownership and control, however, would remain factors in the assessment, alongside other considerations, but links to a high-risk third country would not automatically result in classification as a “high-risk” supplier. In other words, such links would form part of the assessment rather than, on their own, determine that a supplier is “high-risk.”

If adopted, the proposed measure would mark a significant change from an earlier EU cybersecurity-related move affecting inverters and energy storage products, announced in late April.

At the time, the European Commission decided to restrict EU funding – including financing through the European Investment Bank and European Investment Fund – for solar, wind and energy storage projects using inverters from suppliers associated with countries classified as “high-risk,” namely China, Russia, Iran and North Korea, citing cybersecurity concerns.

A few days later, the Chinese government strongly criticized the measure.

“Without any factual evidence, the EU has for the first time designated China as a so-called ‘high-risk country’ and, on this pretext, banned financial support for projects using Chinese inverters,” China’s Ministry of Commerce (MOFCOM) said at the time.

“The EU’s designation of China as a ‘high-risk country’ will undermine mutual trust between China and the EU, disrupt bilateral economic and trade cooperation, destabilize industrial and supply chains both within the China–EU context and globally, and even carry the risk of decoupling and further supply chain disruption,” the ministry said.

Overall, the proposed amendments would substantially reshape Articles 100 to 104 of CSA2, including by shifting the framework toward individual assessments of high-risk suppliers and revising the criteria used in that process. The identification of specific high-risk suppliers and any restrictions applying to them would, however, be determined at a later stage under the procedures established by CSA2.

The implementation of the framework would not necessarily mean an EU-wide ban on all inverters supplied by a company designated as high-risk. Under the proposed rules, the European Commission could restrict specified entities from using, installing or integrating components from high-risk suppliers in designated key ICT assets. The extent of the restrictions, the components affected and transition periods for phasing out existing equipment should be determined by further implementing provisions.

Following ITRE’s final approval, CSA2 should move toward consideration by the European Parliament, while the European Council develops its position. Negotiations between Parliament and the Council, typically through trilogues involving the European Commission, would then follow. Once Parliament and the Council formally approve an agreed text, CSA2 would be published in the EU Official Journal and subsequently enter into force.