Tag: grid cybersecurity

  • Quantum-GUARD’s One-Year Deadlines Put Grid Encryption on AI’s Power Risk List

    Quantum-GUARD’s One-Year Deadlines Put Grid Encryption on AI’s Power Risk List

    TL;DR · 30-second read

    The Short Version

    Two senators, one from each party, have proposed a law to prepare the power grid for quantum computers. These are a new kind of machine that could one day crack the digital locks protecting the grid’s control systems.

    The bill gives the Energy Department one year to study the danger and set up a test lab where power companies can try stronger locks.

    Why it matters: the huge computer warehouses that run artificial intelligence depend on the grid. If the grid’s security slips, their electricity is at risk too.

    Legis1 reported that Sens. Chris Coons (D-DE) and Mike Rounds (R-SD) introduced the Quantum Grid Utility Assurance and Resilient Defense Act, or Quantum-GUARD Act, on August 14, 2026. The bill targets a future threat: quantum computers powerful enough to break the encryption that protects the electric grid’s IT and control systems.

    The bill would require the Federal Energy Regulatory Commission (FERC) to weigh quantum risks when it reviews grid reliability standards. It would give the Department of Energy one year to stand up a post-quantum cryptography testing sandbox with utilities, grid operators and vendors, and one year to report to Congress on quantum risks to the bulk-power system. IonQ, American Binary, the Quantum Industry Coalition, the Quantum Economic Development Consortium and the Cyber Threat Alliance endorsed it.

    Executive Summary

    The Quantum-GUARD Act is the first bill aimed specifically at moving the electric grid onto post-quantum cryptography. These are encryption methods designed to withstand attacks from quantum computers. The bill does not order utilities to replace anything. It directs regulators to study the problem, build a joint testing environment and factor quantum risk into the rules that govern grid reliability. Sen. Rounds described it as codifying parts of President Trump’s June executive order on advanced cryptographic attacks, which set a federal policy of moving government systems to NIST-approved post-quantum standards and helping critical infrastructure owners do the same.

    For the data center industry, the significance lies in the dependency, not the quantum computers themselves. AI campuses are among the largest new customers of the grid, and their uptime rests on utility control systems they neither own nor secure. Encryption upgrades to those systems are slow to plan and deploy. A bill that starts one-year federal clocks on assessment and testing marks the point at which grid cryptography becomes something power-hungry operators should track alongside capacity, interconnection and price.

    Why Grid Encryption Belongs on the AI Power Risk List

    A data center’s power is only as dependable as the systems that run the grid behind it. Those systems include substation controls, generator dispatch and the communications between control rooms and field equipment, which engineers call operational technology, or OT. Much of that traffic is protected by public-key cryptography, the same family of math that quantum computers are expected to threaten. The Quantum-GUARD Act names this directly: it would require FERC to consider post-quantum cryptography in both IT and OT systems, and it tasks the Energy Department with identifying obstacles to moving ‘high-value systems’ to new standards.

    The one-year deadlines explain why operators should track this now rather than later. Under the bill, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response would have twelve months to launch a testing sandbox and twelve months to deliver findings to the Senate Energy and Natural Resources and House Energy and Commerce committees. Those are the first steps of a migration, not the end of one. Grid control equipment often stays in service far longer than office IT, so any cryptographic change moves through procurement, testing and field replacement over years. For a company planning an AI campus that depends on a particular utility for a decade or more, how that utility handles the transition is a real long-term risk, even though the bill never mentions data centers.

    In practice, this is a due-diligence item rather than an alarm. Large-load customers already question utilities about capacity, redundancy and restoration times. The bill’s framework makes it reasonable to add a question about cryptographic readiness, and to expect that the answer will be shaped by whatever the DOE study and sandbox produce.

    What the Bill Does, and What It Leaves Open

    The bill’s verbs matter. FERC would have to ‘consider’ quantum risk when reviewing proposed reliability standards. That makes quantum risk a factor in rulemaking but sets no deadline for migration. DOE would ‘study’ and ‘establish’ a sandbox, with no requirement that utilities adopt what it finds. This is a framework bill. It builds the evidence base that later mandates, if any, would rest on.

    That restraint has advantages. Utilities run a very wide mix of legacy and modern equipment, and a mandate issued before anyone has tested post-quantum algorithms on real grid hardware could cause more reliability problems than it solves. The sandbox exists to test that, bringing utilities, vendors, federal agencies and state and local organizations into one environment to find where new cryptography breaks old equipment. The cost is time. By design, the bill’s first concrete output is a report, and the harder questions of who pays, on what schedule and under what enforcement come after it.

    Why Now: The Standards Exist, the Threat Does Not Yet

    The timing follows the standards. NIST finalized its first three post-quantum cryptography standards in August 2024 and has encouraged organizations to begin transitioning, which means there is now a defined target to migrate toward. Before that, a grid-specific migration bill would have had nothing concrete to point at.

    The threat, by contrast, is still prospective. The bill is framed around protecting the grid ‘before sufficiently powerful quantum computers can undermine existing encryption,’ and it does not say when that might happen. That is the right way to frame it. The argument for starting early rests on how slowly large infrastructure changes its cryptography, not on any fixed date for when quantum machines will arrive. Readers should treat claims of an imminent quantum break, from any side, with the same caution the bill’s own wording shows.

    A Quantum Industry Coalition Behind a Grid Bill

    The endorsements come mainly from the quantum and cybersecurity sectors: IonQ, a quantum technology company; American Binary; the Quantum Industry Coalition; the Quantum Economic Development Consortium; and the Cyber Threat Alliance. Support from companies that build quantum and security technology is expected and does not weaken the bill’s reasoning, which rests on NIST’s published standards and an existing executive order. It does mean that the people who would carry out the migration, meaning utilities, grid operators and state regulators whose ratepayers ultimately fund utility upgrades, will shape how practical the plan turns out to be, and their public positions on the bill are worth watching.

    Background

    The US electric grid runs under mandatory reliability standards, including cybersecurity rules. These are largely developed by the North American Electric Reliability Corporation and approved by FERC. The Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) leads the department’s work on energy-sector security. Grid cybersecurity has historically focused on present-day threats such as intrusions and ransomware. Quantum computing adds a longer-horizon concern: that a sufficiently powerful machine could defeat the public-key encryption that protects much of the grid’s communications.

    NIST’s finalization of its first three post-quantum cryptography standards in August 2024 gave organizations a concrete target for migration. Federal policy has since moved toward requiring that transition for government systems and supporting it for critical infrastructure. Meanwhile, rapid data center construction, driven largely by AI, has made grid reliability a central concern for the digital infrastructure industry.

    Sources

    Source: Bipartisan Bill Targets Cyber Threats to Electric Grid, Legis1’s report on the Quantum-GUARD Act introduced by Sens. Coons and Rounds.

  • A 2% Premium Shows the Inverter Switch for AI-Era Power Hinges on Time, Not Price

    A 2% Premium Shows the Inverter Switch for AI-Era Power Hinges on Time, Not Price

    TL;DR · 30-second read

    The Short Version

    Every solar panel and battery farm needs a box called an inverter, which turns its power into the kind your sockets use. Many are connected to the internet, so a hacker could in theory take control of them.

    China has the factories to make about four in every five of the world’s inverters. Europe plans to stop funding big solar and battery farms that use inverters from countries it considers risky, including China.

    The International Energy Agency found switching adds only about 2% to a large solar farm’s cost. The harder part is time, as factories retool while artificial intelligence data centers need ever more power.

    In a commentary published July 29, 2026, the International Energy Agency (IEA) reported that China accounted for around 80% of global manufacturing capacity for the inverters used in solar and battery installations in 2025, and assessed the cost of moving away from suppliers that governments now classify as security risks. The analysis follows a European Commission decision to restrict EU funding, including through the European Investment Bank and European Investment Fund, for solar, wind and storage projects that use inverters from “high-risk” countries: China, Russia, Iran and North Korea.

    The IEA estimates that buying a utility-scale inverter from a manufacturer headquartered in the EU or another non-high-risk country costs about USD 13/kW more, roughly 75% above Chinese pricing, but adds just under 2% to total project cost. Europe’s inverter factories, at around 95 GW a year, already exceed its roughly 90 GW of annual shipments, though the IEA warns the models built locally may not match the models in demand.

    Executive Summary

    Inverters are the control layer of modern renewable power: the electronics that convert direct current from solar panels, batteries and many wind turbines into grid-ready alternating current, and that manage power flow, monitoring and grid safety. Because most are networked and remotely controllable, governments increasingly treat them as a cybersecurity exposure, with risks ranging from compromised passwords to back doors planted during manufacturing or malicious software updates.

    The policy response is spreading. Beyond the new EU funding restrictions, the US National Defense Authorization Act passed in December 2025 bars its funds from buying inverters from designated Foreign Countries of Concern, including China; Lithuania restricts remote control of inverters and now applies those rules to existing installations; and India requires inverters in a subsidised rooftop scheme to send data only to servers in India.

    The IEA’s central finding is that the price of de-risking is modest at the project level. That matters for anyone financing or buying power from new solar and storage, including the large electricity buyers behind AI data center growth: the binding constraint looks less like cost and more like whether the right inverter models can be produced in time.

    The Premium Is Real, but It Shrinks at Project Scale

    On a per-unit basis, the gap between Chinese and non-Chinese inverters is large. The IEA puts the average global inverter shipment price at around USD 28/kW, with high-power three-phase units near USD 25/kW and microinverters near USD 180/kW. For the systems typically used in utility-scale projects, shipments in key EU markets carried a premium of about USD 13/kW (EUR 12/kW) over Chinese prices, roughly 75% higher. The IEA attributes China’s lower prices to economies of scale, higher automation and intense price competition.

    Measured against the whole project, though, that premium is small. Utility-scale solar in the EU cost around USD 760/kW in 2024, so a USD 13/kW inverter premium works out to just under 2%. Small residential and commercial systems are more exposed: at around USD 1,000/kW installed, the IEA estimates a 3-4% premium for string inverters and about 20% for hybrid inverters and microinverters. In other words, the cost burden of the security push falls most heavily on rooftop segments the EU rules are not expected to cover, and least heavily on the utility-scale projects they are.

    Why the Constraint for AI-Era Power Is Timing, Not Price

    The headline aggregate looks comfortable: Europe could make around 95 GW of inverters a year in 2025, against total shipments of about 90 GW. Inverters are the one step of Europe’s solar supply chain where capacity exceeds demand, compared with just 33 GW of module capacity, 10 GW of cells and 1.5 GW of wafers against roughly 70 GW of module demand. Even adding around 17 GW of stationary battery deployment, which needs bidirectional power conversion, the IEA judges domestic capacity to be in excess of demand.

    The catch is fit. The IEA expects a likely mismatch between the models Europe produces and the models its market wants, noting that string and microinverters are often imported from China, and that retooling production lines to close those gaps is possible but would take some time. It says the mismatch could lead to project delays and cost increases. For utility-scale solar and storage developers, that is the operational risk: a sub-2% cost line is easy to absorb in a financial model, but a procurement delay on a power-conversion package can push back energisation dates.

    That sequencing matters to the buyers of that power. Data center operators expanding capacity for AI workloads are among the largest contracted buyers of new utility-scale solar and battery output, and utility-scale projects are expected to make up around half of global capacity additions over the coming decade in the IEA’s exploratory scenario projections. Where those projects rely on EU financing, the practical question for a data center’s power team is not whether compliant inverters cost more, but whether suppliers can deliver the specific models on schedule. The IEA points to partial relief: redistributing European output between exports and domestic demand, and higher imports from non-high-risk producers, notably in Southeast Asia.

    Security Rules Are Landing Where Controls Are Already Strongest

    The IEA describes how an attacker who gains access to an inverter could control and alter the equipment connected to it, with consequences ranging from localised disruption to lengthy blackouts. The threat can come through weak online connections and passwords, through back doors built in at the factory, or through malicious software updates from the manufacturer.

    The anticipated scope of the EU rules raises a fair question about fit between risk and remedy. Based on currently available information, the restrictions are widely expected to apply directly only to EU-funded utility-scale projects, which the IEA notes are professionally operated under stringent cybersecurity protocols. Most smaller rooftop installations in homes and businesses are not expected to be covered. Existing EU instruments, including the NIS2 directive, the Cyber Resilience Act and the Network Code on Cybersecurity, already address equipment security; how the new funding rule adds to them will depend on details the Commission has yet to publish.

    A Trade Dispute Layered on an Engineering Problem

    China is the only major inverter supplier among the four countries the EU designates as high-risk, and on May 8, 2026, China’s Ministry of Commerce criticised the restrictions, warning they could damage trade relations, supply chain security and Europe’s energy transition. Other markets face sharper exposure than Europe: Korean inverter manufacturers have raised concerns about the country’s more than 90% dependence on Chinese suppliers.

    The policy tools differ. The US approach restricts federally funded procurement, the EU’s restricts funding eligibility, Lithuania’s governs remote control and requires retrofits of some existing installations, and India’s targets where data is stored. For developers and equipment buyers operating across several markets, the likely outcome is not one standard but a patchwork of compliance regimes, each with its own implications for vendor selection and project timelines.

    Background

    Solar power has become one of the largest sources of new electricity worldwide: the IEA counts almost 3 TW of installed solar capacity supplying nearly 9% of global electricity, none of which could function without inverters. Battery storage and many modern wind turbines depend on the same power-conversion electronics, and inverters increasingly coordinate with connected loads such as electric car chargers, heat pumps and air conditioners.

    Chinese manufacturers have come to dominate inverter production through scale, automation and price competition, offering what the IEA describes as typically the lowest-cost option in most major markets with high performance and reliability. Europe is the second-largest producer, with about 8% of global capacity, and inverters are the one stage of its solar supply chain where domestic manufacturing exceeds demand.

    Sources

    Source: Inverter supply chains and cybersecurity – Analysis (International Energy Agency), an IEA commentary on inverter supply concentration, new EU sourcing restrictions and the cost of switching suppliers.

  • A $250M Utility Cyber Bill Shows Where AI’s Power Security Is Thinnest

    A $250M Utility Cyber Bill Shows Where AI’s Power Security Is Thinnest

    TL;DR · 30-second read

    The Short Version

    The US House of Representatives passed a bill to help small, local electric companies defend against hackers. These include rural power cooperatives, which are owned by the customers they serve, and city-owned utilities.

    The bill allows up to $250 million over five years. That averages about $50 million a year, spread across the whole country. It is permission to spend, not money in the bank yet.

    Why care? The huge computer warehouses behind artificial intelligence run on the same power grid as everyone else, and these small utilities say they have the fewest people guarding it.

    On June 29, 2026, the U.S. House of Representatives passed the Rural and Municipal Utility Cybersecurity Act, a bipartisan bill from Rep. Mariannette Miller-Meeks (IA-01) and Rep. Jennifer McClellan (VA-04), according to a press release from Miller-Meeks’ office. The bill reauthorizes the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program and authorizes $250 million over five years to help rural electric cooperatives and municipal utilities deploy cybersecurity technology, share threat information and respond to incidents.

    The bill passed alongside three other grid-security measures from the House Energy & Commerce Committee, has the backing of the National Rural Electric Cooperative Association and the American Public Power Association, and now moves to the Senate.

    Executive Summary

    The House has voted to extend a federal program that gives grants and technical help to the smallest operators on the U.S. electric grid: rural electric cooperatives, which are member-owned, and municipal utilities, which are owned by cities and towns. The authorization is $250 million over five years, an average of $50 million a year if spread evenly.

    The premise, stated plainly in the release, is that these utilities face the same sophisticated threats as large investor-owned utilities while operating with limited cybersecurity staff and budgets. That makes them the segment of the grid where defensive capacity is thinnest by the sponsors’ own account.

    For the data center and AI infrastructure industry, the bill matters less for its dollar figure than for what it signals: Congress is treating the security of the entire power delivery chain, not only its largest nodes, as a national concern at a time when electricity reliability has become a gating factor for computing buildout. Whether the money actually flows depends on the Senate and, later, on appropriators.

    A $250 Million Ceiling, Not a $250 Million Check

    The most important word in the release is “authorizes.” In federal budgeting, an authorization sets the maximum Congress permits a program to spend; the actual dollars are decided separately each year through appropriations bills. An authorization of $250 million over five years therefore establishes a ceiling of roughly $50 million a year on average, not a guaranteed stream of grants. Programs are routinely funded below their authorized levels, and some are not funded at all in a given year.

    The bill also has not become law. It passed the House and now needs Senate action, which Miller-Meeks urged be swift, followed by the President’s signature. Until then, utilities planning security upgrades cannot budget around the reauthorized program, and the practical effect on any given cooperative or municipal system remains prospective.

    Measured against the problem the release describes, the scale is modest. A national pool averaging $50 million a year is meant to support grants, technical assistance and information sharing across every eligible rural and municipal utility in the country. That is a meaningful subsidy for a small utility that has no dedicated security team, but it is not sized to remake the security posture of an entire segment of the grid on its own.

    Why the Least-Resourced Utilities Matter to AI’s Power Supply

    The release never mentions data centers or artificial intelligence, so the connection has to be drawn carefully. What the release does establish is a resource gap: rural cooperatives and municipal utilities “often operate with limited cybersecurity personnel and resources despite serving millions of Americans and supporting critical infrastructure,” and they face “the same sophisticated cyber threats with far fewer resources.” By the sponsors’ own framing, these are the parts of the grid where cyber defense is thinnest.

    That matters to AI infrastructure because computing capacity is ultimately limited by reliable electricity. Data center developers searching for available power increasingly look beyond the largest utility territories, and wherever a facility connects, its uptime depends on the security of the utility delivering its electricity. A campus’s own firewalls do nothing if the operational systems of the utility serving it are compromised. The mechanism is straightforward: the security of a data center’s power supply is bounded by the security of the utility that supplies it, and the bill targets the class of utility that its sponsors say is least equipped.

    The link should not be overstated. A breach at a small distribution utility typically affects its own service territory rather than cascading across the national grid, and how much data center load sits on cooperative or municipal systems is not quantified in the release. The relevance to any specific operator therefore depends on where its facilities are sited. For operators served by these utilities, however, the program’s success is a direct input to their own reliability risk.

    One Bill in a Four-Part Grid-Security Package

    Energy & Commerce Chairman Brett Guthrie described the measure as one of “four bills” addressing security planning, Department of Energy leadership for confronting threats, tools for utilities, and collaboration between grid operators and the federal government. Read together, the package treats grid cybersecurity as a portfolio of planning, leadership, funding and information-sharing problems rather than a single funding gap.

    That framing aligns with how large power consumers already think about risk. A grant for a small utility’s security software is most valuable when paired with timely threat intelligence and a clear federal point of contact during an incident. The release does not detail the other three bills, so how they fit together in practice remains to be seen as they move through the Senate.

    The support of the National Rural Electric Cooperative Association and the American Public Power Association is notable but expected, since their members are the intended recipients. Their backing indicates that eligible utilities see demand for the program; it is not independent evidence of how effective the grants have been to date.

    What Power Buyers and Developers Should Watch

    For companies siting data centers or other large loads, the practical takeaway is to treat a utility’s cybersecurity posture as part of site diligence, alongside capacity, interconnection timelines and rates. Questions about whether a prospective utility has participated in federal cyber programs, what monitoring it runs on its operational systems and how it shares threat information are reasonable to raise early.

    For investors and policy watchers, the next markers are Senate action and, if the bill becomes law, the appropriations figure attached to it. Those two steps, not the House vote, will determine whether the $250 million authorization turns into money in the hands of utilities.

    Background

    The Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program is administered by the U.S. Department of Energy and was established under the 2021 bipartisan infrastructure law to help smaller utilities improve their cyber defenses. The June 2026 House bill would reauthorize it for another five years.

    Rural electric cooperatives and municipal utilities make up a large share of U.S. utilities by count, though each is typically much smaller than an investor-owned utility. Their limited scale often means they have few or no dedicated cybersecurity staff, a gap federal programs like this one aim to close as grid threats and electricity demand both grow.

    Sources

    Source: House Passes Miller-Meeks Bill to Strengthen Cybersecurity for Rural and Municipal Utilities, press release from the office of Rep. Mariannette Miller-Meeks announcing House passage of the Rural and Municipal Utility Cybersecurity Act.