The government has published the final licence conditions for firms that remotely switch EV chargers, heat pumps and home batteries on and off. Load controllers will face annual Cyber Assessment Framework assessments, independent assurance reviews and a 72-hour deadline to report serious incidents to Ofgem.
What happened
On 2 November 2026 the Department for Energy Security and Net Zero (DESNZ) published the standard conditions of the new Load Control Licence. This is the regulatory core of the Smart Secure Electricity Systems (SSES) programme. The licence covers organisations that remotely manage electricity demand from domestic energy smart appliances such as EV charge points, heat pumps and battery storage. It will be issued and enforced by the Gas and Electricity Markets Authority, which acts through Ofgem.
DESNZ says the underpinning legislation, the Electricity Act 1989 (Load Control Licence) Regulations 2027, goes before Parliament later this year. The draft conditions went out to consultation in December 2025 and the government response followed on 7 August 2026. That response set the timetable. If Parliament approves, firms can apply from March 2027, and holding a licence becomes mandatory in March 2028.
The licence covers two types of holder: Load Controllers, which send the signals that change how appliances draw power, and Flexibility Service Providers, which sell those services to households. The cyber rules in Condition 9 apply to load controllers.
The detail
Condition 9, “Cyber assurance framework for load controllers”, is more prescriptive than most sector licences I have read. It starts with a general duty to take “appropriate and proportionate” measures to manage risks to the systems the licensed activities rely on.
The assurance cycle then runs every year, or more often if Ofgem directs:
- A CAF assessment against whichever Cyber Assessment Framework profile the regulator or the Secretary of State specifies.
- A documented risk assessment and, where needed, an improvement plan with remedial actions.
- An independent third-party assurance review, submitted together with a validated CAF assessment. The licence says the review should line up with the wider approach to assurance under the NIS regime.
On top of this cycle, Ofgem can direct a licensee to appoint an approved assessor to carry out a targeted review. The licensee may have to pay for the review, give the assessor access to its premises and documents, and take part in tests or exercises.
Incident reporting follows the NIS model. Licensees must tell both Ofgem and the Secretary of State about any incident with an actual or likely significant effect on their licensed work. Factors in judging whether an impact is significant include the number of consumers affected, how long the incident lasts and the geographical area it covers. The first notice is due without undue delay, and within 72 hours of the firm becoming aware. Fuller analysis must follow.
The National Cyber Security Centre is named as the Technical Authority, and licensees must have regard to its guidance. A licensee must tell the Secretary of State within three months once the aggregate load it controls reaches 300MW. Operators of essential services under the NIS Regulations 2018, and firms told they will be designated as one, are exempt from Condition 9, since they report under that regime. A separate June 2026 consultation on a Tier 1 CAF profile for large load controllers explained that relevant load controllers are due to be brought into NIS through the Cyber Security and Resilience Bill.
Condition 10 adds a “load control check”. Load controllers must have controls that reduce the chance of unintended or harmful effects on appliances and the grid. The data driving those decisions must also be checked for irregularities.
Why it matters for UK organisations
The risk behind this is easy to state. A single platform that can switch on or off thousands of chargers or heat pumps at the same moment can move demand on the grid. If an attacker took control of it, the problem would no longer be a data breach at an energy app. It would threaten system stability. That is likely why government has chosen licence-based regulation with real audit powers over a voluntary code.
The regime reaches beyond energy suppliers. EV charge point operators, heat pump and battery manufacturers with cloud control platforms, home energy management start-ups and aggregators may all need a licence, depending on how the exemptions settle. The government response also proposes an exemption where load control benefits the consumer and is not sold to system operators or wholesale traders. The site covered the Department for Transport’s separate proposals for public chargepoint security on 30 October. This licence is a different, energy-system regime run by DESNZ and Ofgem.
For smaller firms used to Cyber Essentials or ISO 27001, the outcome-based CAF is a step change, and evidencing it properly takes time.
Expert view
This is overdue. When we test smart energy platforms, the weak points are rarely exotic: cloud administration consoles, API authentication, command signing and the support tooling staff use to reach customer devices. Independent checking against CAF outcomes will surface problems a self-certified questionnaire would miss.
A few points still worry me. Annual independent review creates a new assurance market almost overnight, and Ofgem must be clear about who is competent to do it. The 72-hour clock is workable, but it depends on firms being able to detect an incident in the first place. In my experience, younger platforms often lack the logging and monitoring to tell a misbehaving integration from an intrusion. The data integrity duty in Condition 10 is also easy to overlook, even though corrupted tariff or forecast data feeding a control platform could cause mass switching without anyone “hacking” anything.
Boards should also treat Ofgem’s power to send in an assessor who can enter premises and run exercises as a real enforcement lever.
What to do now
- Confirm whether you are in scope. Map your services against the definitions of Load Controller and Flexibility Service Provider and the proposed exemptions.
- Run a CAF gap analysis now. Use the published CAF and the draft Tier 1 CAF profile from the June 2026 consultation, and don’t wait for the final profile.
- Harden the control plane. Enforce MFA on all administrative and support access, apply least privilege to command-issuing accounts, and keep remote management services patched. These map directly to the Cyber Essentials controls for access control, secure configuration and security update management.
- Build detection and a 72-hour reporting workflow. Define what “significant impact” means for your customer numbers and footprint, assign who notifies Ofgem and DESNZ, and rehearse it.
- Validate control data. Add integrity and anomaly checks on the tariff, forecast and grid signals that drive automated switching.
- Budget for independent assurance. Start finding and scoping an assessor with CAF experience before demand peaks.
Bottom line
The Load Control Licence brings CAF assessments, independent audits and NIS-style 72-hour incident reporting to the companies that sit between households and the grid. Applications open in March 2027. Firms that treat this as paperwork will find the first assurance review uncomfortable, so start the gap analysis this quarter.
Sources
- GOV.UK (DESNZ): Load Control Licence: standard licence conditions
- GOV.UK (DESNZ): Standard conditions of Load Control Licence
- GOV.UK (DESNZ): SSES Programme: draft load control licence regulations and conditions, consultation and government response
- GOV.UK (DESNZ): Large Load Controllers: Tier 1 Cyber Assessment Framework and associated guidance
