EU-funded energy projects drop “high-risk” inverters: what suppliers need to know
Since May 2026, EU money no longer goes to solar, wind and storage projects that rely on inverters from “high-risk” suppliers. The 1 November deadline stands, and a wider market restriction is being prepared through the Cybersecurity Act. Here is the timeline, the scope and what inverter and PCS makers can do now.
- 01Guidance announced on 4 May 2026 covers all EU funding instruments, direct and indirect, including EIB and EBRD loans.
- 02The concern is remote access: manufacturers could, in principle, reach into inverters and destabilise the grid.
- 03From 1 November 2026 advanced projects may need extra cybersecurity measures or must exclude high-risk suppliers; from April 2027 all new contracts include the restriction.
- 04The Commission estimates the switch raises project costs by less than 2 %; inverters are about 5 % of a utility-scale PV plant’s cost.
- 05A revised Cybersecurity Act, proposed on 20 January 2026, could add a high-risk vendor list that reaches the whole EU market — it is still being negotiated.
What Brussels decided
On 4 May 2026 the European Commission announced that EU funding will no longer support clean-energy projects relying on inverters from “high-risk” suppliers. It is not a new law: the Commission applies existing project checks and security conditions allowed by the EU Financial Regulation. The measure is framed as economic security, not industrial policy.
| Date | Step |
|---|---|
| December 2025 | Commission security doctrine names solar inverters a high-risk dependency |
| 20 January 2026 | Revised Cybersecurity Act proposed, with a possible high-risk vendor list |
| 4 May 2026 | Funding guidance announced |
| 1 July 2026 | Commission services review ongoing activities |
| 15 July 2026 | Assessment of whether alternative suppliers can meet demand |
| 1 November 2026 | Advanced projects: extra cybersecurity measures or exclusion of high-risk suppliers |
| April 2027 | All new contracts and agreements include the restriction |
In September the Commission confirmed it would not move the 1 November date, despite concerns from investors — including the EIB — about volumes and costs.
Who is affected
- Projects: solar, wind and storage financed with EU money — grants as well as loans from the European Investment Bank and the EBRD — that are, or will be, connected to the EU grid.
- Suppliers: press reports cite suppliers from China, Russia, Iran and North Korea as high-risk; Japan and South Korea are treated as trusted partners.
- Not covered by this guidance: privately financed projects. They may still be reached later through the Cybersecurity Act or national rules — Lithuania already restricts high-risk energy technology.
The numbers behind the debate: Chinese manufacturers hold an estimated 80 % of the global inverter market, inverters are about 5 % of a large PV plant’s cost, and the Commission puts the extra cost of switching at under 2 % of total project cost.
What inverter and PCS makers can do now
Whatever the origin of a product, European buyers will ask harder questions about cybersecurity. Evidence that answers them:
- Radio-connected products: compliance with the RED cybersecurity requirements via EN 18031-1/-2/-3, mandatory since 1 August 2025.
- Cyber Resilience Act: vulnerability and incident reporting from 11 September 2026; full requirements from 11 December 2027.
- Industrial security: IEC 62443-4-1 (secure development) and IEC 62443-4-2 (component requirements) are increasingly asked for by utilities.
- Design choices that address the remote-access concern: local control without a mandatory vendor cloud, operator-controlled remote access, signed firmware updates and a software bill of materials.
What to watch
The Cybersecurity Act negotiations between Parliament and Council; case-by-case decisions on advanced projects after 1 November; further national measures; and whether the restriction is extended from inverters to other grid-connected equipment.
TSINGHU tests PV inverters and storage converters against EN 18031 and the grid codes of the target market, so a single test campaign produces the safety, EMC, grid and cybersecurity evidence European buyers now ask for.
FAQ
Does the EU restriction ban Chinese inverters from the whole EU market?
Not yet. The May 2026 guidance only affects projects financed with EU money, including EIB and EBRD loans. A market-wide restriction could follow through the revised Cybersecurity Act, which is still being negotiated.
What happens to projects already under way?
From 1 November 2026, projects at an advanced stage are assessed under the previous framework but may need additional cybersecurity measures or must exclude high-risk suppliers. From April 2027, all new contracts include the restriction.
Which certificates help show an inverter is secure?
For radio-connected products, EN 18031 under the Radio Equipment Directive; from December 2027, the Cyber Resilience Act; and, increasingly requested by utilities, IEC 62443-4-1 and IEC 62443-4-2.
Sources
- Euronews (4 May 2026): EU moves to ban high-risk inverters from EU-funded energy projects
- Euronews (23 Sep 2026): Commission keeps the 1 November deadline
- pv magazine (20 Jan 2026): revised Cybersecurity Act and a possible high-risk vendor list
- South China Morning Post: Brussels bans Chinese inverters from EU-funded power projects
CertificationEU CE & TÜV Marks 
