EU CRA for inverters and battery storage
Inverters and batteries are default class. In a solar installation, typically only the smart meter gateway is critical.
A solar inverter or battery system with a monitoring app, a cloud or remote control by the grid operator falls under the Cyber Resilience Act. It does not need a notified body.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Does the Cyber Resilience Act apply to solar inverters?
Yes, once the inverter connects to an app, cloud, energy manager or network (Art. 2(1) of the Cyber Resilience Act). Inverters and battery storage are not listed in Annex III or IV, so they are default-class products, self-assessed under module A. In a solar installation, typically only the smart meter gateway is critical (Annex IV item 2).
Product classes
When is an inverter or battery system in scope of the EU CRA?
Three questions decide. Does the device have a data connection, direct or indirect, including Modbus, RS485, a Wi-Fi dongle or a service port? Is it placed on the EU market? Do none of the Art. 2 exclusions apply? Then the device is in scope. The manufacturer's own app is part of the product as software (EU Commission guidance, section 2.4). A monitoring portal or control cloud of the manufacturer is part of it if the device needs it for a function (remote data processing, Art. 3(2)).
Spread in this sector
Pick a product
Solar inverter for homes or businesses
Why this class
No category in Annex III or IV; self-assessment under Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Solar inverter for homes or businesses | Default product | No category in Annex III or IV; self-assessment under Art. 32(1) EU CRA. |
| Hybrid inverter with battery connection | Default product | Its core function is still power conversion; no category in Annex III or IV. |
| Battery storage with battery management system and app | Default product | No category in Annex III or IV. |
| Energy manager or HEMS controlling inverter, storage and wallbox | Default product | Controls energy flows, has no security function and is not a metering gateway; default class in our assessment. |
| Data logger with its own application or portal | Default product | Collects and evaluates site data; no category in Annex III or IV. |
| Wi-Fi or LAN dongle acting as a pure network interface, sold separately | Important product, class I (Annex III) | Only where the dongle works as a pure network interface (driver in the inverter): Annex III class I item 10. Dongles with their own logic and cloud connection are, in our assessment, default class like the data logger. |
| Router or LTE modem for site access, sold separately | Important product, class I (Annex III) | Annex III class I item 12 EU CRA. |
| Smart meter gateway in a smart metering system | Critical product (Annex IV) | Annex IV item 2 EU CRA. In Germany a separate device of the metering point operator, not part of the inverter. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
An inverter with no data interface at all is outside the Cyber Resilience Act. Placing on the market counts per unit: units of a series first supplied to distributors or customers from 11 December 2027 on must comply. Units placed on the market earlier only become subject to the requirements after a substantial modification (Art. 69(2)); Art. 14 covers them as well (Art. 69(3)).
Default class
What does the default class mean for an inverter manufacturer?
Default class means the manufacturer assesses conformity itself. The class does not reduce the Annex I requirements of the Cyber Resilience Act. The risk assessment for device, app and portal decides which product requirements of Annex I Part I(2) apply (Art. 13(3)); vulnerability handling under Part II always applies.
Conformity assessment under module A
The manufacturer checks whether the device and its vulnerability handling meet the requirements (internal control, Annex VIII Part I EU CRA). No notified body is required.
Art. 32(1)(a) EU CRA
Technical documentation per device generation
Risk assessment, software bill of materials, a description of portal and remote control and the reasoned support period go into the technical documentation. It stays available for ten years or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
One EU declaration of conformity and CE marking
Where other acts apply alongside the Cyber Resilience Act, such as the Low Voltage, EMC and Radio Equipment Directives, the manufacturer issues a single EU declaration of conformity covering all of them. A copy or the simplified declaration comes with the device, and the device carries the CE marking.
Art. 13(20), Art. 28(3) and Art. 30 EU CRA
Exceptions
When does part of a solar installation become class I or critical?
The class follows the product's core functionality (Art. 7(1) EU CRA), and Implementing Regulation (EU) 2025/2392 holds the technical descriptions. Inverters and storage systems do not appear in it.
Smart meter gateway (critical)
The critical product is the device that controls communication between the components of a smart metering system and authorised third parties such as utility providers. Gateways for gas or heat meters may also be included, provided they meet that description. In our assessment, depending on the system design, the gateway function can sit in the meter; an inverter that only reads meter values is not such a gateway.
Annex IV item 2 EU CRA, Implementing Regulation (EU) 2025/2392
Network adapters and routers (class I)
A separately sold dongle that works as a pure network interface (driver in the inverter) is a network interface under Annex III item 10; a router or internet modem for site access falls under item 12, a VPN gateway under item 5. For class I, module A remains possible where a harmonised standard, common specification or certification scheme at assurance level 'substantial' or higher is applied in full; otherwise a notified body is involved.
Annex III class I items 5, 10 and 12, Art. 32(2) EU CRA
Integration does not change the class
A built-in LTE modem or a microcontroller with security functions does not make the inverter an important product. Art. 7(1), second sentence, of the Cyber Resilience Act states that integration alone does not trigger a stricter procedure.
Art. 7(1) EU CRA
Later reclassification: where appropriate with a transition period
The Commission can amend Annex III by delegated act. Where appropriate, such an act provides a transition period of at least twelve months, shorter only on imperative grounds of urgency (Art. 7(3) EU CRA). There is no such category for inverters today.
Art. 7(3) EU CRA
Obligations
What does an inverter or battery storage manufacturer have to do?
The manufacturer is whoever places the device on the market under its own name or brand, even when a contract manufacturer builds it (Art. 3(13) EU CRA). For a typical device with a portal, that means:
- 01
Risk assessment including remote control
Art. 13(2) and (3) EU CRA
Device, app, portal and every control path are assessed: grid operator power limits, remote configuration by the installer, firmware updates through the cloud.
- 02
Secure default configuration and access control
Annex I Part I(2)(b) and (d) EU CRA
The device ships securely configured and is protected against unauthorised access, implemented for instance through individual credentials at installer and service level and remote access only after authentication. The device reports possible unauthorised access.
- 03
Availability and limited impact on other networks
Annex I Part I(2)(h) and (i) EU CRA
Essential functions stay available after a security incident, and the device keeps its impact on services of other devices and networks to a minimum. Where thousands of inverters share one portal, the risk assessment also covers what a simultaneous attack on all of them would mean for the grid.
- 04
Support period that matches the service life
The support period follows the expected use time, weighed with the other factors in Art. 13(8); five years is the floor. For an inverter that runs 15 years or more, the expected use time is what counts, not the floor (EU Commission guidance, section 5).
- 05
Reporting exploited vulnerabilities and severe incidents
Art. 14(1) to (4) EU CRA
An actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours to the coordinating CSIRT and ENISA; severe incidents follow the same deadlines. The obligation has applied since 11 September 2026, including for installed devices.
Related regulation
Which other rules apply to inverters and storage alongside the Cyber Resilience Act?
Radio Equipment Directive 2014/53/EU and Delegated Regulation (EU) 2022/30
Delegated Regulation (EU) 2022/30 applies cybersecurity requirements from Art. 3(3)(d), (e) and (f) of the Radio Equipment Directive to certain radio equipment, mainly equipment that connects to the internet; point (f) only concerns equipment that enables money transfers. According to recital 30 of the Cyber Resilience Act, Annex I covers every element of those requirements; existing EU type-examination certificates for them remain valid for a transition period (Art. 69(1)).
Grid connection rules and metering law
Grid connection rules and national metering law govern how grid operators control installations and how the smart meter gateway is integrated. They do not replace the product obligations of the Cyber Resilience Act; the inverter's control interface belongs in its risk assessment.
In practice
Where inverter manufacturers typically get stuck
Portal and firmware from different teams
The monitoring portal is often built by a different department from the firmware. If the manufacturer develops or commissions the portal and the device needs it for a function, both form one product, with one risk assessment and one reporting path.
An installed fleet on old firmware
Tens of thousands of devices in the field run different firmware versions. To report, it has to be clear which versions are affected and how many devices carry them.
Own brand on a bought-in device
Putting your logo on an inverter built by a contract manufacturer makes you its manufacturer (Art. 3(13) EU CRA). SBOMs, vulnerability notices and updates have to be agreed with the contract manufacturer in the contract.
Installer access
Installers need access to many sites. One shared service code for every device is a typical finding. In our assessment, a shared password does not meet Annex I Part I(2)(b) and (d); it has to go at the latest for units placed on the market from 11 December 2027. For internet-connected radio equipment, Delegated Regulation (EU) 2022/30 already applies today.
With Kunnus
How Kunnus supports inverter and battery storage manufacturers
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per device generation and firmware version. Electrical safety, EMC and grid compliance testing stay in your existing testing and approval processes.
Worked example
Example: hybrid inverter with storage and portal
A manufacturer sells a hybrid inverter with its own battery, built-in Wi-Fi, an app and a portal through which installers commission sites and roll out updates.
- 1Classdefault for inverter and battery (see above)
- 2Proceduremodule A, internal control; no notified body
- 3The product coversinverter, battery, app (software of the product), installer portal (remote data processing)
- 4Not part of the productthe metering operator's smart meter gateway (critical, a separate device)
- 5Support periodbased on expected use, end date stated with month and year
- 6At the endrisk assessment, technical documentation, SBOM per firmware version, EU declaration of conformity, CE marking, reporting process
Illustrative assumptions. The classification of a specific product depends on its intended purpose and design.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Is the monitoring portal part of the inverter?+
A portal the manufacturer develops for its inverter that supports a device function, such as commissioning, remote configuration or update rollout, is remote data processing and part of the product (Art. 3(2) of the Cyber Resilience Act; EU Commission guidance, section 8.1). Telemetry used only for statistics does not count, but it belongs in the risk assessment.
Is a Wi-Fi dongle sold separately for the inverter class I?+
Only if the dongle works as a pure network interface with the driver running in the inverter: then it is a network interface under Annex III class I item 10 of the Cyber Resilience Act. Dongles with their own logic and cloud connection are, in our assessment, default class like a data logger.
Is an inverter with a Modbus interface and no internet access in scope of the Cyber Resilience Act?+
A Modbus or RS485 interface is a data connection to another device, which is enough for scope (Art. 2(1) of the Cyber Resilience Act); internet access is not required. The inverter stays default class.
What applies to spare parts and replacement units?+
A spare part demonstrably supplied for a repair and identical to the original in its security-relevant properties is outside the Cyber Resilience Act under Art. 2(6). According to the EU Commission guidance (section 4.1, example 39), that can be a whole sub-product of an installation, such as an identical replacement inverter. Otherwise the replacement is a newly placed product.
Does the Cyber Resilience Act apply to manufacturers based in Switzerland?+
The Cyber Resilience Act does not apply to devices sold only in Switzerland. A Swiss manufacturer that sells inverters or storage systems in the EU has the same obligations as an EU manufacturer. It may appoint an EU authorised representative but does not have to (Art. 18). Whoever imports the product into the EU carries the importer obligations of Art. 19 either way.
Does the Cyber Resilience Act apply to medical devices and vehicles?+
No. Medical devices and in-vitro diagnostics (Regulations (EU) 2017/745 and 2017/746) and type-approved vehicles (Regulation (EU) 2019/2144) are excluded by Art. 2(2) of the Cyber Resilience Act. A home battery that works with an electric car is in scope, though; only the vehicle itself is not.
Are your inverters and storage systems ready for the Cyber Resilience Act?
The EU CRA assessment classifies your devices in a few minutes and shows what is still missing, as a first, non-binding estimate.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.