EU expert group urges curbs on high-risk solar suppliers

The European Commission's cybersecurity working group has recommended restricting components and software from high-risk suppliers across all segments of the EU's solar market, from residential plug-in systems to utility-scale plants. The report does not name specific countries or companies but explicitly cites the EU's "heavy dependence on PV equipment of Chinese origin" as an urgent risk driver. The experts identified three high-risk attack vectors: compromised manufacturer cloud platforms, nation-state backdoors embedded at the point of manufacture, and attacks on utility-scale plants through local networks. They assessed that a backdoor attack has not yet occurred in practice but must be treated as a serious threat given its potential to disable large amounts of generation capacity.

Where this fits

This is a sovereignty story dressed as cybersecurity policy. Solar's headline cost advantage collapses once the full system dependency is priced in. The EU's solar build-out, now sitting at 406 GW, has made Europe dependent on Chinese-manufactured inverters, controllers and software for real-time grid management. That dependency creates a coercion vector: a hostile state with manufacturing control can inject vulnerabilities at scale, and no certification regime closes that gap entirely. The report exposes what Energy Realism has long argued: a renewables-only grid outsources not only hardware but operational sovereignty to a strategic rival.

What it means

Australia is following Europe's path. The grid transition depends on Chinese-sourced inverters, batteries and processed minerals with no domestic substitute. Cybersecurity certification helps, but does not eliminate the leverage a manufacturing monopoly grants. The firming alternative, firm, long-lived, domestically buildable nuclear generation, remains banned by law, leaving Australia structurally dependent on the supply chain security decisions of a competitor.