What do the UK's product security rules mean for installers of smart inverters, batteries and EV chargers?

Which rules apply to the kit you install?

It depends on the product, and the rules are changing. This is the picture as of September 2026.

EV charge points and smart meters are excluded from PSTI, because other rules already cover them.

What does PSTI actually require?

The Product Security and Telecommunications Infrastructure (PSTI) regime sets three requirements for consumer connectable products made available in the UK:

1. No universal default or easily guessable passwords. Each device needs a unique password, or the user sets one. Passwords can't be based on counters, serial numbers or other public information.
2. A way to report security problems. The manufacturer must publish how to report a vulnerability and when you'll hear back.
3. A published minimum security update period. The manufacturer must say, in plain language, how long the product will get security updates.

The Office for Product Safety and Standards (OPSS) enforces it, with fines of up to £10 million or 4% of worldwide turnover. Distributors must not supply products they know don't comply.

The GOV.UK guidance doesn't say whether an installer who buys kit from a wholesaler and fits it counts as a distributor. If you supply the product as well as fitting it, it's safest to assume the distributor duties apply to you and take advice if you're unsure. Either way, don't fit a connected product that doesn't come with a statement of compliance.

The update period is the requirement installers most often overlook. An inverter or battery may carry a longer warranty than its promised security update period, and that gap matters to a customer who'll live with the kit for years. Check it before a product goes on your price list.

What do the EV smart charge point rules mean at handover?

The 2021 regulations made home chargers "smart" by law. A compliant charger must communicate over a network, respond to signals by changing when or how fast it charges, and keep charging if it loses its connection. Since 30 December 2022, it must also meet security rules drawn from ETSI EN 303 645 and PAS 1878, including unique passwords, protected updates and encrypted communications.

Two requirements show up at the customer's front door. Default charging hours sit outside the weekday peaks (8am to 11am and 4pm to 10pm), and at first use the owner must be able to accept, remove or change them. Each charge also starts after a random delay of up to 10 minutes. Explain both at handover, or expect calls about "delayed" charging.

What's coming next for chargers, batteries and heat pumps?

The Department for Energy Security and Net Zero (DESNZ) consulted from December 2025 to February 2026 on the first-phase Energy Smart Appliances regulations. As proposed, they replace the 2021 charge point regulations and extend smart and cyber requirements to electric heating up to 45kW and to batteries of at least 1kWh and 1kW. Cyber security is set by reference to the latest version of ETSI EN 303 645, with manufacturers keeping their own technical file rather than getting third-party certification.

The proposal applied most requirements from 31 December 2027. The government has since revised the date for heating appliances in an interim response, and a full response is still to come. Check the latest position on GOV.UK before planning around these dates.

In parallel, DESNZ and Ofgem are setting up load control licensing. Organisations that send signals to turn home chargers, batteries or heat pumps up or down will need a licence, with annual cyber assessments, from about the end of 2027. Installers won't normally need one, but the apps and tariffs you recommend will increasingly come from licensed providers.

How should you handle customer app accounts?

This is where installers create most of the risk themselves, usually by trying to be helpful. An engineer sets up the customer's inverter or charger app using the company's installs email address and a password reused on every job, "so we can help if anything goes wrong". Two years later, one inbox and one password unlock hundreds of homes' energy systems, and several ex-employees know it.

Instead, create every customer account in the customer's name with their own email address, and let them choose the password on their own phone. Where the platform has an installer or service role, request that access from your company's installer account. Note in the handover pack how installer access works, so the customer can remove it if they switch installer.

Example: a 12-person installer fits 300 battery systems a year. With customer accounts in customers' names and support through the installer portal, a leaver means closing one portal login. With every account under installs@, the same leaver means changing hundreds of passwords.

How do you secure installer portals and leavers?

Manufacturer installer portals are where commissioning is done, firmware is pushed and fleets are monitored. Treat them like your bank login.

• One login per person, registered to a company email address. With a shared login you can't prove who changed a setting, and a personal Gmail account can't be taken back when someone leaves.
• Multi-factor authentication wherever the portal offers it, using an authenticator app on a managed company phone.
• A written list of portals: every manufacturer, wholesaler and monitoring portal, who has access and who administers it.
• Leavers within a day: disable the Microsoft 365 account, remove portal access and wipe company data from their devices through Intune.
• A quarterly access review of each portal's user list against your staff list. Subcontractors are the ones most often forgotten.

Since April 2026, Cyber Essentials fails any business that leaves multi-factor authentication (MFA) switched off on a cloud service where it's available. See our guide to multi-factor authentication for how to roll it out.

Where does your responsibility stop?

Inverter, battery and charger firmware belong to the manufacturer. Your side is the people, accounts and devices that reach them. Our guide chapter on cyber security for renewable energy companies covers keeping business networks apart from site equipment.

How Indigo does this. Indigo Unified Communications supports more than 10 renewable energy businesses from Glasgow, including solar and battery installers. We manage company phones and laptops through Microsoft Intune, turn on multi-factor authentication (MFA) across Microsoft 365, and help clients list and tidy up the portals their engineers use, so a leaver's access can be removed the same day. We don't manage inverter, battery or grid control systems, and we keep business IT separate from them. IT support for renewable energy →

What to do next

1. Check every connected product on your price list has a PSTI statement of compliance (or, for chargers, a 2021 regulations statement), and note its security update period against its warranty.
2. Change your commissioning process so customer app accounts are created with the customer's own email address and password.
3. List every installer, wholesaler and monitoring portal your business uses, with who has access, and switch on MFA wherever it's offered.
4. Add portal removal to your leavers checklist, and review access every quarter.
5. Book a renewable energy technology assessment if you'd like us to look at your accounts, devices and portals with you.