May brought a wave of policy developments that will shape the next phase of EV charging deployment across Europe and beyond.
The European Commission has opened the long-awaited consultation on the revision of AFIR, while new legislative proposals on permitting, corporate fleet electrification, and building charging requirements signal a continued push to accelerate infrastructure rollout. At the same time, implementation challenges are becoming harder to ignore, from delayed EPBD transposition across Member States to growing questions around grid readiness and charging availability.
Cybersecurity also moved higher up the agenda. Germany’s BSI published its first comprehensive assessment of charging infrastructure security, the EU advanced its revision of the Cybersecurity Act, and the UK proposed new obligations that could bring smart charging and V2G platforms into the scope of critical infrastructure regulation.
Here’s what changed in May and what it means for your operations.
Regulatory developments
AFIR revision: European Commission opens public consultation
The European Commission has opened a public consultation on the review of the Alternative Fuels Infrastructure Regulation (AFIR), running until August 3, 2026, on the Have Your Say portal. The consultation builds on the Commission’s call for evidence from March and will feed into the AFIR review proposal expected later this year.
Three topics under review are particularly important for the EV charging industry: the implementation of ISO 15118 standards, pricing transparency and reasonable pricing requirements, and harmonization of National Access Points to improve EU-wide availability of infrastructure data. AMPECO will contribute through its industry associations to ensure the perspective of charging software providers is represented.
Repeal of the Radio Equipment Directive cybersecurity rules
On April 29, 2026, the European Commission published Delegated Regulation (EU) 2026/339, formally repealing Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive (RaED). The repeal takes effect on December 11, 2027, when the Cyber Resilience Act (CRA) Regulation (EU) 2024/2847 becomes fully applicable.
EVSE placed on the market before that date must still comply with existing cybersecurity requirements, including CE marking, alignment with EN 18031, and secure update obligations. Because EN 18031 already overlaps substantially with the CRA’s essential requirements, much of the compliance work completed today will carry forward. Cloud-based charging platforms generally remain outside the direct scope unless they are essential to the charger’s core function.
EU Grids Package: rapporteur’s draft report reflects key e-mobility asks on permit acceleration
MEP Niels Fuglsang’s draft report on the proposed Directive to accelerate permit-granting procedures reflects several priorities advocated by E-Mobility Europe. The Directive is part of the European Grids Package we covered in December.
These include increasing the exemption threshold for administrative permits, maintaining a six-month permitting deadline for higher-power charging stations, enabling flexible grid connection agreements, supporting grid-enhancing technologies, introducing digital permit portals, and shortening the transposition period to one year.
Through E-Mobility Europe, AMPECO will continue engaging with policymakers as the legislative process advances.
Clean Corporate Vehicles Regulation: Parliament raises the ambition
The European Parliament’s draft report on the Clean Corporate Vehicles Regulation raises the ambition of the Commission’s proposal, targeting a 54% EU-wide ZEV share by 2030 and a 70% combined zero- and low-emission vehicle share. It also introduces incentives for smaller EVs, limits support for low-emission vehicles, and promotes second-hand EV adoption. The heavy-duty gap we flagged in March remains open.
The proposal highlights a broader challenge: fleet electrification targets depend on sufficient charging infrastructure, faster grid connections, and interoperable charging networks. The report will be discussed in June, with a plenary vote expected in November.
The timing is notable. As Politico reported, EU commissioners can’t make the roughly 450 km Brussels-to-Strasbourg trip in their official EVs without a charging stop in Luxembourg, and some reportedly slow down to extend range, stretching a five-hour journey toward seven. The episode underscores why AFIR deployment, grid connection acceleration, and interoperable networks are not separate policy tracks. They are preconditions for the corporate fleet transition this Regulation seeks to mandate.
EPBD recast: charging in buildings
The recast Energy Performance of Buildings Directive (Directive 2024/1275) significantly strengthens EV charging requirements under Article 14. Thresholds are lowered to more than 5 parking spaces for non-residential buildings and more than 3 for residential buildings (down from more than 10). Charging ratios increase to 1 charging point per 5 spaces generally and 1 per 2 spaces for offices. Smart charging becomes mandatory for all new installations. A Right to Plug is formally enshrined, meaning tenants and co-owners can only be refused on serious and legitimate grounds.
Existing non-residential buildings with more than 20 parking spaces must comply by January 1, 2027. The Commission published implementation guidance in December 2025, while the national transposition deadline passed on May 29, 2026.
Transposition, however, is running significantly behind schedule. During a recent E-Mobility Europe working group session, DG ENER confirmed the Commission continues to support Member States through guidance and direct engagement with national authorities, with a formal EPBD review scheduled for December 31, 2028. Despite this, around 20 of the EU’s 27 Member States have yet to publish draft implementing legislation. France, whose usage-based transposition we covered in March, is one of the exceptions.
For CPOs and site hosts planning private and semi-public charging deployments, this creates a period of uncertainty. The EU-level requirements are clear, but the national frameworks governing permitting, technical standards, and enforcement remain largely undefined.
The recast also intersects directly with AFIR Delegated Act 2025/656, which requires ISO 15118-20 support for all newly installed or renovated public and private Mode 3 charging points from January 1, 2027. In practice, this means charging infrastructure deployed to meet EPBD obligations will also need to comply with ISO 15118-20 requirements. The overlap raises questions around costs, product availability, and supply-chain readiness, particularly for smaller residential installations.
Through E-Mobility Europe, AMPECO continues to engage with the Commission and industry stakeholders on the proportionality of the 2027 rollout and will monitor developments around implementation and enforcement.
Revised Cybersecurity Act (CSA 2)
The Commission’s proposal to revise the Cybersecurity Act (CSA 2) brings connected mobility systems within EU cybersecurity governance. The CSA strengthens ENISA’s coordination role and introduces a Trusted ICT Supply Chain Framework (Articles 98 to 103), enabling EU-level risk assessments of ICT supply-chain dependencies across sectors. The e-mobility ecosystem, as a user of ICT products, services, and processes, falls within the broader scope of these provisions.
For the charging sector, CSA 2 adds to an already extensive regulatory landscape that includes the CRA, NIS2, the EU Network Code on Cybersecurity, and GPSR requirements, on top of the NIS2 simplification package from January. Future certification requirements should align with existing frameworks to avoid unnecessary duplication and compliance burden.
Germany: BSI report on IT security of public charging infrastructure
The Federal Office for Information Security (BSI) published its first comprehensive report on the IT security of public charging infrastructure, covering the 2025 investigation period. The report maps the full system landscape, 12 actors and 29 communication protocols, and reviews CVEs from the US National Vulnerability Database (NVD), Pwn2Own Automotive, and academic literature. The findings are directly relevant to CPOs, CPMS providers, and hardware manufacturers.
Charging stations are the weakest link. 81 of 122 CVEs affect EVSE, and Pwn2Own uncovered 54 new vulnerabilities across 10 charger models, roughly half of which enable root-level code execution. Standards have improved, but deployment has not followed. OCPP 2.1 and ISO 15118-20 mandate TLS 1.3 and mutual authentication, yet only 12% of charging points support TLS, 91% of certified products remain on OCPP 1.6 (where TLS is optional), and AutoCharge (MAC-address-based) is classified as fundamentally insecure.
The most significant finding is the inverse relationship between investigation density and damage potential. Backend systems (roaming hubs, eMSPs, grid interfaces) have virtually no public vulnerability research, yet attacks there scale across thousands of charging points. The BSI’s worst-case scenario, regional grid destabilization through compromised backends manipulating load simultaneously, sits in this under-researched zone. V2G amplifies the risk. Hubject, as the sole European PKI provider for Plug & Charge, represents a single point of failure. Post-quantum readiness remains unresolved.
The BSI identifies more than 17 applicable regulatory instruments (AFIR, CRA, NIS2, GDPR, RED, among others) but notes most technical requirements remain non-binding, with no unified mandatory security standard at the component or system level. The implicit direction is clear: mandatory Security-by-Design, OCPP 1.6 phase-out, TLS 1.3 across all paths, and consolidated PKI governance. This reinforces the trajectory visible in the UK’s Cyber Security and Resilience Bill and the EU’s RaED transition. The cybersecurity perimeter around charging infrastructure is tightening across jurisdictions.
UK King’s Speech: Energy Independence Bill and Cyber Security and Resilience Bill
The UK Government’s legislative program includes two measures directly relevant to e-mobility.
The Energy Independence Bill removes charges on electricity exported to the grid, supporting vehicle-to-grid (V2G) business models. Proposed planning reforms aim to accelerate grid connections for strategic infrastructure, including EV charging hubs.
The Cyber Security and Resilience Bill extends the UK’s NIS Regulations to “large load controllers” at a threshold of 300 MW of potential electrical control across managed energy smart appliances (EVs, charge points, heating, battery storage, virtual power plants). For CPMS providers, this is the line in the bill that matters: a platform orchestrating smart charging or V2G could be independently designated as an Operator of Essential Services (OES) in its own right, not just the CPOs it serves. The provision that brings software into scope (sub-paragraphs 5D to 5E) is the key one. Where a platform can adjust or process load control signals and is authorized to do so, it is itself treated as a load controller, putting a CPMS in scope at 300 MW or more.
At AMPECO, we are actively assessing this against our platform architecture. Designation triggers risk management, incident reporting (24-hour initial and 72-hour full report to Ofgem), and supply chain obligations, with penalties reaching £17 million or 4% of global turnover. Even platforms below 300 MW may count as critical suppliers to CPOs that exceed the threshold. Royal Assent is expected in 2026. Full enforcement of the large load controller provisions is unlikely before 2027 to 2028.
Funding and incentive updates
Germany: €1 billion for heavy-duty EV charging
Germany’s Federal Ministry of Transport (BMV) has launched a €1 billion, four-year program to deploy charging infrastructure for battery-electric heavy-duty vehicles, delivering a key measure of the Master Plan for Charging Infrastructure 2030. The program complements a separate €1.6 billion EU-approved scheme supporting fast-charging stations at motorway rest stops.
The initiative aims to install up to 725 CCS and 685 MCS charging points, with MCS enabling megawatt-level charging for long-haul transport, building on the IEC 63379 standard published in February. Eligible costs include grid connections, battery storage, and charging load management systems, with funding of €500 per installed kW. An SME depot call opens on June 5, 2026, while a competitive public infrastructure call runs from May 26 to July 7, 2026.
Charging load management is explicitly eligible for funding, placing AMPECO’s platform within scope for clients applying under either program.
CALeVIP: $55 million+ in new fast charging incentives for California
CALeVIP has announced two new funding windows under the Fast Charge California Project (FCCP), totaling more than $55 million. Window 2 runs from October 7, 2026, to January 14, 2027, and covers up to 100% of eligible DC fast charger installation costs, capped at $100,000 per port. Window 3 runs from February 24 to May 27, 2027, and offers a flat $55,000 rebate per port for chargers with a minimum output of 150 kW.
Both windows support ready-to-build, publicly accessible fast charging projects, with priority given to disadvantaged and low-income communities and tribal lands. Key changes include removing charging hubs, hotels, and business districts as eligible site types, requiring mandatory charger certification, and requiring that applicants be both the incentive recipient and the equipment owner. Window 3 further simplifies the program by requiring only a single CCS connector per site and removing the higher-power rebate tier.
AMPECO is listed as a CALeVIP-ready CMS, enabling clients to qualify for funding support under both windows.
Australia: $20 million DRIVEN Charger Grants now open
Australia’s Department of Climate Change, Energy, the Environment and Water (DCCEEW) has opened registrations of interest for the DRIVEN Charger Grant Stream, a $20 million program supporting the installation of public DC fast chargers at automotive dealerships, service centers, and EV repair facilities.
Eligible site hosts can register interest free of charge and without commitment, while grant applications remain open until August 28, 2026. Applicants do not need to own or operate the site, provided the charger is installed at an approved location.
AMPECO leadership and advocacy
AMPECO joins the EVCAN Qualified Product List
AMPECO has been listed on the Electric Vehicle Charging Accessibility Network (EVCAN) Qualified Product List (QPL) for Charging Station Management Systems. The QPL is used by utilities, state energy offices, and program administrators across North America to identify CSMS platforms that meet a defined bar for reliability, cybersecurity, grid services readiness, and open-standards interoperability (OCPP, OCPI).
Qualification is not self-attestation. AMPECO’s platform was independently assessed against EVCAN’s technical specification across all four areas. For CPOs bidding into utility-funded managed charging, make-ready, or fleet electrification programs, the listing means the software side of the bid is pre-validated against the criteria procurement teams are now inserting into RFPs, shortening the path from response to award.
Contributing to the AFIR review impact assessment
AMPECO contributed to a major new study commissioned by the European Commission’s DG MOVE that supports the official Impact Assessment for the upcoming review of AFIR (Regulation (EU) 2023/1804). The study follows AMPECO’s formal submission to the call for evidence earlier this spring.
As part of the study, we provided industry feedback on potential problem areas and policy measures across two main pillars:
- Shortcomings related to user aspects. We provided input on ensuring fair competition, transparent pricing, and data availability. We also highlighted the importance of conformance with interoperability standards that enable a seamless charging experience across networks and markets.
- Administrative burden for charging operators and the wider charging ecosystem. Our feedback focused on the challenges created by fragmented national reporting obligations and the need for greater harmonization to reduce complexity and improve operational efficiency.
The outcome of this study will help inform the European Commission’s review of AFIR later this year.
Data exchange for demand-side flexibility
On May 20, the European Commission released a joint report, “Expert group recommendations on making smart charging and demand response easier.” AMPECO contributed through its membership in ChargeUp Europe.
Engagement with the California Air Resources Board
In May, the AMPECO team, alongside a wider group of CharIN experts, met with the California Air Resources Board (CARB) to discuss the conformance testing required to ensure effective interoperability in real-world charging scenarios. This builds on ongoing industry engagement with California regulators aimed at improving interoperability and charging reliability.
CARB and the California Energy Commission (CEC) act as the dual engines driving California’s zero-emission vehicle (ZEV) transition. While CARB serves as the state’s regulatory and environmental authority, the CEC is responsible for energy planning, infrastructure funding, and deployment programs, including the reliability standards that became enforceable in April.
Looking ahead
May’s developments reinforce a reality familiar to many CPOs: regulatory ambition is accelerating, but implementation remains uneven.
The AFIR review, new corporate fleet requirements, and the EPBD recast all point to continued growth in charging demand and infrastructure obligations. At the same time, delayed national implementation, grid connection challenges, and uncertainty around standards such as ISO 15118-20 continue to complicate deployment planning across Europe.
Cybersecurity is also becoming a core business consideration. Recent developments in the EU, Germany, and the UK signal tighter oversight of charging infrastructure, software platforms, and smart charging operations, with growing expectations around security, resilience, and compliance.
Need help with AFIR consultation input, EPBD and ISO 15118-20 planning, or cybersecurity compliance across the EU and UK?
Schedule a consultation with AMPECO’s regulatory intelligence team →
