Cyber Resilience Act: what is changing and what to address for connected solar today

Article · PROTECT · Legislation · 22 September 2026

The Cyber Resilience Act establishes common European rules for the cybersecurity of products with digital elements. Reporting obligations apply from 11 September 2026, with the main obligations applying from 11 December 2027. Security for connected solar installations is already an operational concern today.

Regulation is already underway

The CRA entered into force in December 2024. Some rules apply progressively, with reporting obligations applying from September 2026. The main requirements will apply from December 2027.

What is the CRA?

The regulation focuses on hardware and software with digital elements and on how manufacturers manage security and vulnerabilities throughout a product’s lifecycle. For energy technologies, it is therefore worth looking beyond device features to updates, remote access and communication with the manufacturer’s services.

Inverter security does not begin only with new regulation. Connected technology already communicates with the internet, the manufacturer’s cloud and service providers during everyday operation.

What this means for solar operation

Operators need to know where devices communicate, who has remote access, and how changes or unusual communication are handled. Product compliance with regulation does not replace operational protection for a specific installation.

What can be addressed today

Map remote access, restrict unnecessary communication, monitor data flows and add a protective layer between energy technology and surrounding systems.

Guardexy Protect

Shield and Shield Pro create a local protective layer alongside energy technology. Command and Command+ add management of rules and events and, for professional deployments, a shared view of multiple sites.