Review of Europe’s privacy, data, cybersecurity, AI and battery laws sets out what smart-energy tools must do to protect consumers
Smart energy technology only works if people trust it. That is the central message of a legal review carried out within REEFLEX, an EU-funded project that helps households, buildings and businesses support the electricity grid by adjusting when they use power. The review checks the project’s technology against Europe’s rules on personal data, cybersecurity, artificial intelligence, batteries and green claims, and identifies where extra safeguards are needed before the tools reach the market.
Why data is at the heart of the energy transition
Europe’s growing reliance on wind and solar power means the grid increasingly needs electricity users to be flexible: charging an electric car overnight, pausing a heat pump for a few minutes or using a home battery at the evening peak. Organising this across thousands of homes requires data: which appliances are running, how full a battery is, when a building uses most energy.
REEFLEX, funded under Horizon Europe, is developing a platform to do exactly this, together with AI forecasting tools, blockchain-based trading between neighbours and storage built from second-life electric-car batteries. The project is being tested at sites in several countries, including Spain, Greece, Bulgaria and Switzerland, with replication planned in Turkey and Denmark.
The team reviewed these technologies against more than a dozen EU laws, from the General Data Protection Regulation (GDPR) to the Batteries Regulation, rating each potential conflict for likelihood and severity.
What your electricity meter can reveal
The most sensitive issue is privacy. REEFLEX uses a technique called non-intrusive load monitoring, which analyses a household’s overall electricity use to work out which individual appliances are switched on. This avoids installing extra equipment, but it can also reveal intimate details of daily life, such as when people wake up, go to sleep or leave home. Under the GDPR, this counts as detailed profiling and requires clear, specific and freely given consent that people can easily withdraw.
The review recommends clear consent management, role-based access rights and strong anonymisation, with checks that anonymised data cannot be traced back to individuals.
Blockchain, used to record trades between neighbours, raises a different puzzle: it is designed to be permanent, while the GDPR gives people the “right to be forgotten”. The solution proposed is to keep all personal information off the blockchain and store only encrypted digital fingerprints on it, so that personal data can still be deleted when required.
Your devices, your data
The EU Data Act strengthens people’s rights over data generated by their connected devices. Owners of smart appliances must be able to access their device data easily and pass it on to a service provider of their choice, such as an independent aggregator. The Data Act also requires smart contracts used for data sharing to include a way to stop or terminate them. This legal “off switch” sits uneasily with blockchain’s unchangeable nature and may require design changes.
Under the Data Governance Act, companies that act as neutral data go-betweens may not use the data they handle for their own purposes. The review suggests that REEFLEX may need to separate its data-brokering role from its analytics services. It also points to an opportunity: the Act’s “data altruism” rules could allow residents of social housing or public buildings to share data voluntarily for climate goals. Data flowing to partners outside the EU, such as in Turkey, needs extra safeguards.
Keeping humans in charge of AI
Under the AI Act, AI systems used as safety components in managing electricity supply can be classed as “high-risk”. These must meet strict requirements: a quality-management system, detailed technical documentation, high-quality and unbiased training data, registration in an EU database and effective human oversight. The review recommends that REEFLEX’s AI tools be supervised by people, explain their decisions and put consumers’ interests first. Meeting these obligations could be demanding for smaller partners.
Protecting the grid from cyber attacks
Connecting thousands of devices to the grid creates new entry points for hackers. Under the NIS2 Directive, grid operators, aggregators and market operators taking part in the project can count as essential or important entities. They have duties to manage cyber risks, secure their supply chains and report serious incidents to national authorities, with an early warning due within 24 hours. Good technical design alone does not satisfy these duties. On the product side, the Cyber Resilience Act will require smart appliances, gateways and battery controllers to carry a CE mark confirming their cybersecurity, backed by a “software bill of materials” listing their key software components.
Second-life batteries and honest green claims
Two issues received the review’s highest risk ratings. The first concerns batteries. REEFLEX is developing a storage unit that reuses up to 90 per cent of the components of old electric-car battery packs. Under the EU Batteries Regulation, whoever repurposes a battery takes on the responsibilities of a manufacturer. These include safety checks, CE marking, labelling, a carbon-footprint declaration where required, a digital battery passport and producer responsibility for collection and recycling. These steps could push market entry to around two years after the project ends.
The second concerns labels. The EU’s Smart Readiness Indicator is an optional scheme for rating how “smart” a building is. REEFLEX extends the idea to rate individual devices by their flexibility, but such device scores have no official status. The review recommends presenting them as a voluntary classification rather than an official rating, to avoid misleading consumers.
More broadly, the project’s alignment with the EU Taxonomy for sustainable finance should be independently verified if investors are to rely on it. Its environmental assessment tool, VERIFY, should produce figures in formats compatible with EU sustainability reporting standards. Carbon-price estimates drawn from the EU Emissions Trading System should be treated as indicative.
Funded by the European Union. Views and opinions expressed are those of the author(s) only and do not necessarily reflect those of the European Union or the granting authority. Neither the European Union nor the granting authority can be held responsible for them.
Contact Information
For more information about REEFLEX, please contact us at: contact@reeflexhe.eu
Follow us on