Lawmakers call for EU-wide Chinese inverter restrictions, decry ‘energy security risks’

The letter, leaked by Politico, points to actions taken by the Lithuanian, Czech and German cybersecurity agencies to either ban or warn against the risks that Chinese-made PV inverters can pose to European grid security. These risks arise primarily through remote cloud access to the inverters by the companies, or by hackers gaining access to the vendors’ cloud servers.

The signatories of the letter urge the Commission to accelerate the process of risk assessment and to introduce “concrete proposals” to restrict “high-risk” vendors in the market and support European inverter manufacturers.

“When the ongoing studies are completed and potential legislation is tabled, as much as two years may have passed. By that time, Europe risks having lost its remaining PV inverter manufacturers. Western companies are drastically losing market share in Europe, though they currently still retain the capacity to meet European demand. If one of them succumbs to unfair competition from China, the Union could soon be left without any non-Chinese alternatives,” the letter said.

Europe’s inverter market has been dominated by Chinese suppliers recently; data from PV wholesale platform sun.store shows that Huawei, Sungrow, GoodWe and Deye are all in the top five vendors for string and hybrid inverters, and the open letter claimed that Huawei alone had suppled 115GW of inverters to Europe in 2023 and that “80%” of all new PV inverter capacity in 2024 was of Chinese origin.

Simultaneously, non-Chinese inverter manufacturers have been struggling to turn profits as competition from China intensifies and the European residential solar market has slowed. The industry group SolarPower Europe has previously called for greater support for European inverter producers, like SMA Solar and Fronius, and for tighter cybersecurity restrictions on digital inverter infrastructure.

The European Solar Manufacturing Council (ESMC) said it “fully endorses” the letter.

The letter concluded: “Without immediate and binding EU action, Europe risks not only its energy security but also the viability of all remaining European manufacturers in this sector.”

Solar cybersecurity

Speaking to PV Tech, Erika Langerova, head of cybersecurity research at UCEEB, a research centre under the Czech Technical University in Prague, said the letter is “sufficient, and if implemented correctly, it should work. I think Brussels learned from previous mistakes which were made when implementing the 5G toolbox.”

The 5G toolbox introduced certain cybersecurity measures to the telecoms sector, governing the EU’s 5G infrastructure. Notably, the measures allowed states to restrict or ban certain firms from the sector, akin to how the UK restricted Huawei’s access to the telecoms sector over cybersecurity concerns, but did not name any particular companies.

Similar restrictions have not yet emerged for the solar sector, despite the rapid growth of the technology across Europe. Last month, Huawei was readmitted to SolarPower Europe’s membership ranks following legal disputes.

A June report from cybersecurity company Forescout found that Europe’s solar sector was more exposed to cybersecurity risks than any other region of the world. This is due to the high instances of inverters which are open to external internet access, often via cloud servers managed by companies outside of the EU. Bad actors accessing these servers could damage or shut off individual inverters, potentially causing local or nationwide blackouts or damage to critical infrastructure. PV Tech Premium took a deep dive into European solar’s cybersecurity risks last month.

EU-wide restrictions would be a major shakeup for the sector. “I think heated and very ugly discussions are incoming, also a lot of lobbying and attempts to bribe decision makers to stop these efforts,” Langerova told PV Tech. “For China, the EU is a big market and they won’t be willing to let it go easily.”