Cyber Rules Reach the DIN Rail Energy Meter With a Radio Inside

A DIN rail energy meter with a 4G or Wi-Fi radio is now a regulated connected product in Europe. Reporting duties under the Cyber Resilience Act began on 11 September 2026.

What Started on 11 September

Regulation (EU) 2024/2847, the Cyber Resilience Act, entered into force in December 2024 and applies in stages. The reporting obligations that took effect on 11 September 2026 are the first operational duty for manufacturers.

A manufacturer that learns of an actively exploited vulnerability must send an early warning to the relevant authority and to the national computer security incident response team within 24 hours. A fuller notification follows within 72 hours, and a final report within 14 days.

The European Commission published practical implementation guidance on 27 July 2026 to help manufacturers prepare. Full application of the regulation follows on 11 December 2027.

Why Metering Is in Scope

The Act covers products with digital elements, and a meter with an internet connection qualifies. That includes the growing family of submetering devices installed in tenant panels, plant rooms and rooftop solar combiners.

Wireless meters already meet a second layer of rules. The Radio Equipment Directive has required cybersecurity provisions for radio equipment since 1 August 2025 through the harmonised standard EN 18031, covering network protection, personal data protection and fraud prevention.

Billing meters sit under a third rule set. Where a meter is used for trade settlement, it must carry MID certification and meet accuracy class requirements. A non-compliant radio does not excuse an inaccurate meter, and the reverse is also true.

What a Manufacturer Must Actually Do

Compliance is an engineering process, not a document. Four workstreams carry most of the weight.

• Keep a software bill of materials, so that a vulnerability in a library can be traced to shipped units.

• Define how firmware updates are delivered, signed and rolled back.

• Log security events and hold them long enough to investigate an incident.

• Publish a support period, stating how long updates will be provided.

The support period is the point that changes commercial behaviour. A meter has a service life measured in a decade or more, and a manufacturer that promises five years of updates is selling a different product from one that promises ten.

The Buyer's View

For a utility engineer or a contractor, the practical question is what to request in a tender.

Ask for the support period in writing. Ask how firmware is signed and whether unsigned images can be loaded by mistake. Ask what happens to a device that is offline for months and then reconnects. Ask for the component inventory in a form that can be checked later.

Those questions separate suppliers quickly. They also protect the buyer. If a network operator installs thousands of connected meters and later has to recall them for a firmware fault, the cost is not the meter.

Design Choices That Reduce Risk

Most of the burden can be designed out at the product stage.

A meter that uses a narrow, purpose-built update channel is easier to defend than one that exposes a general-purpose operating system. Hardware that supports secure boot, so it only runs signed firmware, removes an entire class of attack. Isolating the metrology function from the communications module means a compromise of the radio does not touch the billing data.

Two-way data gateways deserve the same treatment. A power data gateway terminal that aggregates meters over LoRa and forwards over 4G is a concentrator, and concentration increases the consequence of any single failure. Removing unnecessary services, closing unused ports and enforcing authenticated configuration changes are basic measures that are often skipped on embedded hardware.

What This Means for a Project

A specification written today should treat cybersecurity as part of the metering package rather than as an information technology add-on.

That means naming the standards the meter complies with, requiring the manufacturer to declare its support period, and asking for the update mechanism to be demonstrated rather than described. Sites installing many meters should also ask how the fleet is monitored, because a single unpatched device is easier to find when there is an inventory.

The installation phase is a good time to fix the basics. Devices that ship with default credentials should have them changed and recorded, and the DIN electric meter installation record is a natural place to keep that evidence.

Choosing Hardware With the Rules in Mind

Where a project still has a choice of hardware, connectivity is the variable to think about first. A wireless module makes a meter more useful and more regulated at the same time, so the trade-off should be deliberate rather than a default.

Compact rail mounting also has a compliance benefit, because a device that fits inside a closed panel is less exposed than one installed in the open. A 4G three phase DIN rail smart energy meter is the shape most panel builders ask for, and the same housing family covers the single-phase duty.

Buyers comparing cabinet layouts can work from this note on DIN rail versus surface mount meters, which sets out the space and wiring differences.

Jiangsu Saving Electronics manufactures DIN rail meters for 4G and Wi-Fi networks alongside LoRa and IC card models, together with data gateways and a metering cloud platform, and supplies utilities, distributors and contractors on OEM and private label terms.