Three rule sets, fixed deadlines
Regulation
Subsidy eligibility, grid connection and product security hit the same devices, with dates that are fixed. None of them can be solved in the controller. All three sit one level above it, and that is where HVACloud comes in.
What is coming at you
Three independent rule sets, each with its own authority, its own logic and its own deadline. What they share is that they affect your devices, and that none of them can be solved in the controller.
| Date | What applies | Who it affects |
|---|---|---|
| since 21.07.2026 | The revised German BEG EM requires metering and an interoperable interface under section 14a EnWG | heat pumps in Germany |
| ongoing | Controllable loads need an interface to the grid operator, section 14a EnWG and the Austrian EAG | electric heat generators |
| from 01.07.2027 | That interface must work in EEBUS format under VDE-AR-E 2829-6 | the same devices |
| from 01.12.2027 | The Cyber Resilience Act makes product security a condition of market access | every connected product, the manufacturer cloud included |
| from 01.01.2028 | Only natural refrigerants remain eligible | heat pumps in Germany |
Which of them affect you depends on the heat generator. The grid connection affects electric devices only, a pellet boiler is not one. Product security affects every connected product, regardless of fuel. What applies to which system type is under Which systems.
Why it hurts
No grandfathering, no transition period. Under the BEG EM the requirement decides eligibility, and without the subsidy hardly a heat pump sells in Germany at present. This is not a condition for later, it is the order book.
The deadlines fall before your next device generation. What is being developed today stands in the field in 2027. Whoever solves connectivity per controller family now solves it again in 2027, and then under time pressure.
The number of places is what decides. A manufacturer with four controller families connected over four different routes needs a separate answer per chain to the same questions. Which software versions are in the field? How does a security update reach them? Who reports within 24 hours, and to whom? Four chains means four answers, four schedules and four houses you do not decide over.
The duty stays with you. No platform takes the conformity assessment off your hands. What can be influenced is something else: how often you have to meet it, and whether you have the means to.
What HVACloud covers today
Everything named here is implemented and in the field. None of it is roadmap.
Metered capture. Heat and electricity meters over M-Bus and Modbus, independent of the controller and its manufacturer, with history over years. Connectivity
The interoperable interface, already in EEBUS format. EEBUS under VDE-AR-E 2829-6 is implemented, ahead of the July 2027 deadline. Seventeen protocols are built in, EEBUS is one of them. Grid services
You know what is in the field. A device is provisioned in the factory and is known in your instance from then on. “Which devices are affected” is a query, not a search. Factory and field commissioning
You reach the field. Updates go from the cloud to the devices, with approval levels, mandatory signing per artefact type and a watch period after the apply. Without such a route, a promised support period is a promise without means. This is what it looks like
Devices behind the gateway as well. Whatever hangs off a panel or a GWPro and accepts an update over its interface is served through it. A controller with no way out of its own gets one. Operations and administration
Access is narrow. Only approved hardware connects, against documented criteria, and you decide inside your tenant which. Remote access is granted per device, time limited, logged and audited. Hardware
Operation is certified. sinnograte is certified to ISO 27001, for development and operation, and the platform has a route for reporting vulnerabilities with a promised response time. Trust center
What stays with you
We say this before listing any contribution: the duties lie with the manufacturer of the product. With you.
- the conformity assessment and the declaration,
- the software bill of materials of your own firmware,
- the support period you promise,
- the interpretation of the rules for your device.
We do not interpret the CRA or the subsidy conditions for you, and we do not declare your device conform. That belongs to your approval process. Whoever promises you otherwise has not read the regulations.
The two topics in detail
This page is the overview. What each requirement asks for exactly, with tables, deadlines and what is still open, is here:
22 September 2026