The Electric Vehicles (Smart Charge Points) Regulations 2021

Regulation 12

SCHEDULE 1 Security

General principles

1.  A relevant charge point must be designed, manufactured and configured to provide appropriate protection—

(a) against the risk of harm to, or disruption of, the electricity system;

(b) against the risk of harm to, or disruption of, the relevant charge point;

(c) for the personal data of the owner and any other end-user of the relevant charge point.

Passwords

2.  A relevant charge point must be configured so that where passwords are used on it—

(a) the password is unique to that relevant charge point and not derived from, or based on, publicly-available information, or is set by the owner; and

(b) the password cannot be reset to a default password applying to both that relevant charge point and other charge points.

Software

3.—(1) A relevant charge point must incorporate software which is able to be securely updated.

(2) In sub-paragraph (1), securely updated means updated using adequate cryptographic measures to protect against a cyber-attack.

(3) A relevant charge point must be configured so that—

(a) it checks, when it is first set up by the owner, and periodically thereafter, whether there are security updates available for it;

(b) it verifies the authenticity and integrity of each prospective software update by reference to both the data’s origin and its contents and only applies the update if the authenticity and integrity of the software have been validated;

(c) by default, it provides notifications to the owner about prospective software updates;

(d) the owner can implement software updates without undue difficulty.

(4) A relevant charge point must be configured so that—

(a) it verifies, via secure boot mechanisms, that its software has not been altered other than in accordance with a software update which has been validated in accordance with sub-paragraph (3)(b) above;

(b) if an unauthorised change to the software is detected, it notifies the owner and does not connect to a communications network other than for the purposes of this notification.

Sensitive security parameters

4.—(1) A relevant charge point must be configured so that—

(a) where security credentials are stored on the relevant charge point, these are protected using robust security measures;

(b) its software does not use hard-coded security credentials.

(2) In this paragraph—

(a) “hard-coded” means data forming part of the relevant charge point’s source code and which is unalterable except by means of modification of the source code;

(b) “security credentials” means ways of verifying that the relevant charge point is being used or accessed by a person properly authorised to do so.

Secure communication

5.  A relevant charge point must be configured so that communications sent from it are encrypted.

Data inputs

6.—(1) A relevant charge point must be configured so that—

(a) data inputs are verified so that the type and format of the data is consistent with that expected for the function to which the data relates;

(b) if such data cannot be verified, it is discarded or ignored by the relevant charge point in a safe manner.

(2) The data inputs referred to in sub-paragraph (1) include data that is inputted via a user interface, an application programming interface or a communications network.

Ease of use

7.—(1) A relevant charge point must be configured so as to minimise the inputs required from the owner in connection with the set-up and operation of the charge point.

(2) A relevant charge point must be configured so that any personal data can be deleted from it by the owner without undue difficulty.

Protection against attack

8.—(1) A relevant charge point must be designed and manufactured to provide an adequate level of protection against physical damage to the charge point.

(2) In particular, a relevant charge point must incorporate a tamper-protection boundary to protect the internal components of the charge point.

(3) A relevant charge point must be designed and manufactured to provide an adequate level of protection—

(a) for its user interfaces; and

(b) against use or attempted use of the relevant charge point other than through the user interfaces.

9.  A relevant charge point must be configured so that—

(a) if there is an attempt (whether or not successful) to breach the tamper-protection boundary, it notifies the owner;

(b) its software runs with only the minimum level of access privileges required for it to deliver its functionality;

(c) any logical or network interfaces that are not required for the normal operation of the relevant charge point, or otherwise to comply with the requirements in these Regulations, are disabled;

(d) software services are not available to the owner unless necessary for the relevant charge point to operate;

(e) any hardware interfaces that are used for the purposes of testing or development, but not otherwise during the operation of the relevant charge point, are not exposed.

Security log

10.—(1) A relevant charge point must incorporate a security log.

(2) In this paragraph, “security log” means an electronic record on the relevant charge point of events relevant to the security of the relevant charge point including attempts (whether or not successful) to—

(a) breach the tamper-protection boundary;

(b) tamper with the relevant charge point; or

(c) gain unauthorised access to the relevant charge point.

(3) Entries in the security log must record, by reference to Coordinated Universal Time, the time and date on which the event occurred.

Provision of information

11.—(1) When a relevant charge point is sold, information complying with the requirements in sub-paragraphs (2) to (4) must be supplied with it.

(2) The information must specify how the owner can report concerns or problems identified regarding the security of the relevant charge point, including regarding its vulnerability to a cyber-attack. In particular, the information must provide contact details to which such concerns or problems can be reported.

(3) The information must specify the period, if any, for which software updates will be provided by or on behalf of the relevant charge point manufacturer.

(4) The information must—

(a) provide guidance on how to set up the relevant charge point with adequate security protection;

(b) include instructions on how to delete personal data from the relevant charge point.

Regulation 15

SCHEDULE 2 Enforcement

PART 1 Investigatory powers

Information notice

1.—(1) The enforcement authority may serve a notice (an “information notice”) on a person requesting such information or documents as the enforcement authority considers necessary to enable it to monitor that person’s, or another person’s, compliance with these Regulations.

(2) An information notice must—

(a) be in writing,

(b) set out the information or documents required,

(c) specify the date by which the information or documents must be provided,

(d) specify the person, and the address, to which the information or documents must be provided.

(3) A person served with an information notice must comply with its requirements by the date referred to in paragraph (2)(c).

Enforcement of information notice

2.—(1) If a person fails to comply with a notice served under paragraph 1, the enforcement authority may make an application under this paragraph to the court.

(2) If it appears to the court that the person has failed to comply with the notice, it may make an order under this paragraph.

(3) An order under this paragraph is an order requiring the person to do anything that the court thinks it is reasonable for the person to do, for any of the purposes for which the notice was given, to ensure that the notice is complied with.

(4) An order under this paragraph may require the person to meet the costs or expenses of the application.

(5) If the person is a company, partnership or unincorporated association, the court in acting under sub-paragraph (4) may require an official who is responsible for the failure to meet the costs or expenses.

(6) In this paragraph—

(a) “official” means—

(i) in the case of a company, a director, manager, secretary or other similar officer;

(ii) in the case of a limited liability partnership, a member;

(iii) in the case of a partnership other than a limited liability partnership, a partner; and

(iv) in the case of an unincorporated association, a person who is concerned in the management or control of its affairs;

(b) “the court” means—

(i) in relation to England and Wales, the High Court or the county court;

(ii) in relation to Scotland, the Court of Session or the sheriff.

Power of entry without warrant

3.—(1) The enforcement authority may enter premises (other than premises used wholly or mainly as a private dwelling) or land, at reasonable hours for the purposes of ascertaining whether there has been a breach of these Regulations.

(2) Before the enforcement authority exercises the power of entry in sub-paragraph (1) the enforcement authority must serve on the occupier of the premises or land a notice (an “inspection notice”).

(3) An inspection notice must—

(a) be in writing;

(b) be served on the occupier of the premises or land at least two working days before the proposed date of entry;

(c) specify the proposed date of entry;

(d) set out the reason for which entry is required;

(e) summarise the enforcement authority’s powers of seizure and detention of any relevant products or records or other information under paragraph 5; and

(f) explain that compensation may be payable for damage caused in seizing and removing any relevant products or records or other information and must give the address to which an application for compensation should be directed.

(4) The requirement in sub-paragraph (2) does not apply where—

(a) the enforcement authority reasonably suspects a breach of these Regulations; and

(b) reasonably considers that to give notice in accordance with sub-paragraph (2) would defeat the purpose of the entry.

(5) If the enforcement authority enters premises in the circumstances referred to in sub-paragraph (4) and finds one or more occupiers on the premises, the enforcement authority must provide to the occupier, or (if there is more than one) to at least one of them, a document that—

(a) is in writing;

(b) meets the requirements of sub-paragraphs (3)(d) to (3)(f); and

(c) where applicable, indicates the nature of the alleged breach of these Regulations.

(6) The enforcement authority must produce suitable identification to the occupier of the premises or land, or (if there is more than one) to at least one of them, when requested to do so by them.

(7) The enforcement authority, when entering any premises by virtue of this paragraph, may be accompanied by such persons and take such equipment as appear to the enforcement authority to be necessary.

Power of entry with warrant

4.—(1) If a justice is satisfied by any written information on oath—

(a) that there are reasonable grounds for believing—

(i) that any relevant products or records or other information, which the enforcement authority has power under paragraph 5 to inspect, copy, seize or require to be produced, is or are on any premises and that the inspection, copying, seizure or production of that item is likely to disclose evidence of a breach of regulation 4; or

(ii) that there has been, or is about to be, a breach of regulation 4; and

(b) either—

(i) that admission to the premises has been or is likely to be refused and that notice of intention to apply for a warrant under this paragraph has been given to the occupier; or

(ii) that an application for admission or the giving of such a notice as is referred to in paragraph 4(b)(i) would defeat the object of the entry, or that the premises are unoccupied, or that the occupier is temporarily absent and it might defeat the object of the entry to await the occupier’s return,

the justice may by warrant under the justice’s hand, which continues in force for a period of one month, authorise the enforcement authority to enter the premises, if need be by force.

(2) On entering any premises by authority of a warrant under sub-paragraph (1), the enforcement authority must give to the occupier or (if there is more than one) to at least one of them, or, if the occupier is temporarily absent, leave in a prominent place on the premises, or an appropriate part of the premises, a notice in writing—

(a) summarising the enforcement authority’s powers of seizure and detention of any relevant products or records or other information under paragraph 5;

(b) explaining that compensation may be payable for damage caused in entering premises and seizing and removing any relevant products or records or other information and giving the address to which an application for compensation should be directed.

(3) The enforcement authority, when entering any premises by virtue of this paragraph, may be accompanied by such persons and take such equipment as appear to the enforcement authority to be necessary.

(4) The enforcement authority, when leaving any premises which the enforcement authority entered by virtue of a warrant, must, if the premises are unoccupied or the occupier is temporarily absent, leave them in as secure a state as that in which they were found.

(5) In this paragraph, “justice” means—

(a) in England and Wales, a justice of the peace; and

(b) in Scotland, a sheriff or summary sheriff.

Powers of inspection etc

5.—(1) The enforcement authority exercising the power of entry under paragraph 3 or paragraph 4 may—

(a) inspect the premises and land;

(b) require any occupier of the premises or land to produce relevant products or records or any other information, in whatever form it is held, together with an explanation of such records or information within such period as the enforcement authority considers reasonable;

(c) inspect any relevant products or records or any other information, in whatever form it is held;

(d) if the enforcement authority has reasonable grounds for believing that there has been a breach of these Regulations, seize and detain relevant products or records or any other information, in whatever form it is held, for the purposes of ascertaining whether there has been such a breach;

(e) take photographs, copies or measurements;

(f) require any person on the premises to provide such other assistance as the enforcement authority reasonably considers necessary.

(2) The enforcement authority must—

(a) provide the occupier, or (if there is more than one) to at least one of them, of the premises or land with a written record of any items which are seized and removed; and

(b) retain seized items for no longer than absolutely necessary.

(3) Any object or document which is inspected or seized should, so far as possible, be retained in its original condition.

6.  The enforcement authority may, for the purposes of ascertaining compliance with these Regulations—

(a) make a purchase of a charge point;

(b) enter into an agreement to secure the provision of a charge point;

(c) require a person to provide access to embedded software in a charge point insofar as the enforcement authority considers that such access is necessary for the purpose of assessing such compliance.

Compensation for seizure and detention

7.—(1) Where the enforcement authority exercises any power under paragraph 5(1)(d) to seize and detain any relevant products or records or other information, the enforcement authority is liable to pay compensation to any person having an interest in the item seized and detained in respect of any loss or damage caused by the exercise of the power if—

(a) there has been no breach of any provision of these Regulations; and

(b) the exercise of the power is not attributable to any neglect or default by that person.

(2) Any disputed question as to the right to, or the amount of, any compensation payable under this paragraph must be determined by arbitration—

(a) in England and Wales, in accordance with the Arbitration Act 1996(1);

(b) in Scotland, in accordance with the Arbitration (Scotland) Act 2010(2).

Obstruction of the enforcement authority and false statements

8.—(1) A person must not—

(a) intentionally obstruct the enforcement authority when it is acting in pursuance of any provision of these Regulations;

(b) intentionally fail to comply with any requirement properly made by the enforcement authority under any provision of these Regulations; or

(c) without reasonable cause, fail to give the enforcement authority any other assistance or information which the enforcement authority may reasonably require of that person for the purposes of the exercise of the enforcement authority’s functions under any provision of these Regulations.

(2) A person must not, in giving any information which is required of that person by virtue of paragraph (1)(c)—

(a) make any statement which the person knows is false in a material particular; or

(b) recklessly make a statement which is false in a material particular.

PART 2 Civil sanctions

Compliance notice

9.—(1) Where the enforcement authority considers that a person has breached regulation 4, the enforcement authority may serve a compliance notice on the person considered to be in breach requiring the person to take such steps as the enforcement authority considers appropriate in relation to the breach.

(2) Without limiting the generality of sub-paragraph (1) above, the requirements that may be imposed in a compliance notice include those referred to in sub-paragraphs (3) and (4).

(3) Where the enforcement authority considers that a person has sold one or more relevant charge points which do not comply with the requirements of these Regulations, a compliance notice may include a requirement to take such steps as the enforcement authority may specify to secure that such relevant charge points are recalled from end-users.

(4) Where the enforcement authority considers that a person is offering or advertising for sale one or more relevant charge points which do not comply with the requirements of these Regulations, a compliance notice may include a requirement to secure that such relevant charge points are withdrawn from the market.

Civil penalties

10.—(1) Where a person does not comply with a compliance notice served under paragraph 9, the enforcement authority may require that person to pay a civil penalty.

(2) Where the enforcement authority considers that there has been a breach of—

(a) regulation 4; or

(b) paragraph 8 of this Schedule 2,

the enforcement authority may require the person in breach to pay a civil penalty.

(3) The enforcement authority may not require a person to pay a civil penalty pursuant to sub-paragraph (1) or (2) if the authority is satisfied on the balance of probabilities that there was a reasonable excuse for the non-compliance or the breach.

(4) The enforcement authority may require a person to pay a civil penalty pursuant to paragraph (2)(a) without first serving a compliance notice under paragraph 9 if it considers it appropriate to do so.

11.—(1) The maximum amount of a civil penalty is—

(a) £10,000 for each relevant charge point in respect of which there has been a breach of regulation 4;

(b) £250,000 for a breach of paragraph 8 of this Schedule 2.

(2) Before requiring a person to pay a civil penalty pursuant to paragraph 10, the enforcement authority may require the person to provide such information as is reasonable in connection with determining the appropriate amount of the civil penalty within such period as is reasonable.

(3) The civil penalty is payable into the Consolidated Fund.

Notice of intent

12.—(1) Subject to sub-paragraph (3), where the enforcement authority proposes to impose a civil sanction on a person, it must serve on that person a notice of what is proposed (a “notice of intent”).

(2) The notice of intent must include—

(a) the grounds for the proposed civil sanction;

(b) the requirements of the notice and, in the case of a civil penalty, the amount to be paid; and

(c) information as to the right to make representations and objections within 28 days beginning with the day on which the notice of intent was received.

(3) The requirement to serve a notice of intent does not apply where—

(a) the proposed civil sanction is a compliance notice; and

(b) the enforcement authority reasonably considers that, in consequence of one or both of the matters referred to in sub-paragraph (4), it is appropriate to serve a final notice pursuant to paragraph 14(5) without first serving a notice of intent.

(4) The matters referred to in paragraph (3) are–

(a) a risk of harm to, or disruption of, the electricity system;

(b) a risk to public health or safety.

13.  A person on whom a notice of intent is served may within 28 days beginning with the day on which the notice was received make written representations and objections to the enforcement authority in relation to the proposed imposition of a civil sanction.

Final notice

14.—(1) The provisions of sub-paragraphs (2) to (4) apply where a notice of intent has been served pursuant to paragraph 12.

(2) After the end of the period for making representations and objections, the enforcement authority must decide whether to impose the requirements in the notice of intent, with or without modifications.

(3) Where the enforcement authority decides to impose a requirement, it must serve a notice on the person (the “final notice”).

(4) The final notice must—

(a) be in writing;

(b) be dated;

(c) include information as to whether the requirements in the notice of intent are being imposed with or without modifications;

(d) if the requirements in the notice of intent are being imposed with modifications, include the grounds for this;

(e) comply with paragraph 15 or 16.

(5) Where, pursuant to paragraph 12(3), the enforcement authority decides to impose a civil sanction on a person without serving a notice of intent on that person, it must serve a final notice which—

(a) is in writing;

(b) is dated;

(c) complies with paragraph 15 or 16.

15.  A final notice relating to a compliance notice must include information as to—

(a) the grounds for imposing the notice;

(b) the steps required to be taken in relation to the breach;

(c) the date by which the steps must be taken, which must be not less than 28 days from the date of the final notice;

(d) rights of appeal; and

(e) the consequences of failing to comply with the notice.

16.  A final notice relating to a civil penalty must include information as to—

(a) the grounds for imposing the penalty;

(b) the amount to be paid;

(c) how payment may be made;

(d) the period within which payment must be made which must be not less than 28 days from the date of the final notice;

(e) rights of appeal; and

(f) the consequences of failing to comply with the notice.

Appeals

17.—(1) The person receiving the final notice may appeal against it.

(2) The grounds for appeal are—

(a) that the decision was based on an error of fact;

(b) that the decision was wrong in law;

(c) in the case of a civil penalty, that the amount of the civil penalty is unreasonable;

(d) in the case of a non-monetary requirement, that the nature of the requirement is unreasonable;

(e) that the decision was unreasonable for any other reason;

(f) that the decision was wrong for any other reason.

18.—(1) Any appeal under paragraph 17 must be made to the First-tier Tribunal.

(2) An appeal must be brought within 28 days of the date on which the final notice is received.

(3) Any compliance notices are suspended pending the appeal.

(4) The Tribunal may, in relation to the imposition of a compliance notice—

(a) withdraw the compliance notice;

(b) confirm the compliance notice;

(c) vary the compliance notice;

(d) take such steps as the enforcement authority could take in relation to the act or omission giving rise to the compliance notice;

(e) remit the decision whether to confirm the compliance notice, or any matter relating to that decision, to the enforcement authority.

(5) The Tribunal may, in relation to the imposition of a civil penalty—

(a) allow the appeal and cancel the civil penalty;

(b) allow the appeal and reduce the civil penalty; or

(c) dismiss the appeal.

(6) An appeal—

(a) is to be a re-hearing of the enforcement authority’s decision to impose a civil sanction; and

(b) may be determined having regard to matters of which the enforcement authority was unaware.

(7) Paragraph (6)(a) has effect despite any provision of rules of court.

Enforcement of penalty decision

19.—(1) This paragraph applies where a sum is payable to the enforcement authority as a civil penalty pursuant to these Regulations.

(2) In England and Wales, the civil penalty is recoverable as if it were payable under an order of the county court in England and Wales.

(3) In Scotland, the civil penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant of execution issued by the sheriff court of any sheriffdom in Scotland.

(4) Where action is taken under this paragraph for the recovery of a sum payable as a civil penalty pursuant to these Regulations, the civil penalty is, in relation to England and Wales, to be treated for the purposes of section 98 of the Courts Act 2003(3) (register of judgments and orders etc.) as if it were a judgement entered in the county court.

PART 3 Enforcement undertakings

Enforcement undertakings

20.  The enforcement authority may accept a written undertaking (an “enforcement undertaking”) given by a person to the enforcement authority to take such action as may be specified in the undertaking within such period as may be specified where the enforcement authority has reasonable grounds to suspect that the person has breached regulation 4.

Contents of an enforcement undertaking

21.—(1) An enforcement undertaking must specify—

(a) action to be taken by the person to secure that the breach does not continue or recur;

(b) action to secure that the position is, so far as possible, restored to what it would have been if the breach had not been committed; or

(c) action (including the payment of a sum of money) to be taken by the person to benefit any person affected by the breach.

(2) An enforcement undertaking must specify the period within which the action must be completed.

(3) An enforcement undertaking must include—

(a) a statement that the undertaking is made in accordance with this Schedule 2;

(b) the terms of the undertaking;

(c) information as to how and when a person is considered to have discharged the undertaking.

(4) The enforcement undertaking may be varied, or the period within which the action must be completed may be extended, if both parties agree in writing.

Acceptance of an enforcement undertaking

22.  If the enforcement authority has accepted an enforcement undertaking then, unless the person from whom the undertaking is accepted has failed to comply with the undertaking or any part of it, the enforcement authority may not impose on that person a civil sanction in respect of the act or omission to which the undertaking relates.

Discharge of an enforcement undertaking

23.—(1) If the enforcement authority is satisfied that an enforcement undertaking has been complied with it must issue a certificate to that effect.

(2) The enforcement authority may require the person who has given the undertaking to provide sufficient information to determine that the undertaking has been complied with.

(3) The person who gave the undertaking may at any time apply for such a certificate.

(4) The enforcement authority must decide whether to issue such a certificate, and give written notice of the decision to the applicant, within 14 days of such an application.

Appeals

24.—(1) A person to whom a notice is given pursuant to paragraph 23(4) may appeal against a decision not to issue a certificate on the grounds that the decision—

(a) was based on an error of fact;

(b) was wrong in law;

(c) was unfair or unreasonable;

(d) was wrong for any other reason.

(2) An appeal under sub-paragraph (1) must be made to the First-tier Tribunal.

(3) An appeal must be brought within two months of the date on which written notice of the decision is received.

(4) The Tribunal may, in relation to the decision referred to in sub-paragraph (1)—

(a) confirm the decision;

(b) vary the decision; or

(c) remit the decision, or any matter relating to it, to the enforcement authority.

Inaccurate, incomplete or misleading information

25.—(1) A person who has given inaccurate, misleading or incomplete information in relation to an enforcement undertaking is regarded as not having complied with it.

(2) The enforcement authority may by notice in writing revoke a certificate issued under paragraph 23 if it was issued on the basis of inaccurate, incomplete or misleading information.

Non-compliance with an enforcement undertaking

26.—(1) If a person does not comply with an enforcement undertaking the enforcement authority may in the case of a breach of regulation 4 impose a civil sanction.

(2) If a person has complied partly but not fully with an enforcement undertaking, that partial compliance must be taken into account in connection with the imposition of a civil sanction on the person.

PART 4 Publication of enforcement action

27.—(1) The enforcement authority must from time to time publish—

(a) the cases in which civil sanctions have been imposed; and

(b) cases in which an enforcement undertaking has been entered into.

(2) In sub-paragraph (1)(a) the reference to cases in which civil sanctions have been imposed does not include cases where the sanction has been imposed but overturned on appeal.

(3) This paragraph does not apply in cases where the enforcement authority considers that publication would be inappropriate.

(1)

1996 c. 23.

(2)

2010 asp 1.

(3)

2003 c. 39; section 98 has been amended by sections 48(1) and 106(2) of, and paragraph 55(1), (2), (3)(a) and (b) of Schedule 8 and paragraph 15 of Schedule 16 to, the Tribunals, Courts and Enforcement Act 2007 (c. 15) and section 17(5) of, and paragraph 40(a) and (c) of Part 2 of Schedule 9 to, the Crime and Courts Act 2013 (c. 22). Further amendments made by the Tribunals, Courts and Enforcement Act 2007 have yet to be brought into force.