Summary
- DESNZ published standard load-control licence conditions on 2 November.
- The proposals address cybersecurity, operational resilience, and consumer safeguards.
- The licensing regulations are planned for 2027 and are not yet in force.
The UK government has published cybersecurity, operational resilience, and consumer protection conditions for businesses that will participate in a forthcoming licensing framework for electricity load control.
The Department for Energy Security and Net Zero released the standard licence conditions on 2 November, following consultation and earlier policy work on Smart Secure Electricity Systems.
The conditions describe expected requirements for a licensing system associated with regulations planned for 2027. They do not mean that every proposed obligation is already in force, and implementation will depend on the final regulatory arrangements.
Load control allows operators to alter when connected equipment consumes electricity. Flexible services may manage electric vehicle charging, heating systems, battery storage, and other devices responding to network constraints, market prices, or agreements with customers.
These services can help electricity networks match demand with generation as variable renewable sources become more significant. Their operation also depends on software platforms and communications systems that can influence large numbers of connected devices.
The government distinguishes Load Controllers from Flexibility Service Providers, with conditions applicable according to the activities performed. A company may operate the equipment directly, coordinate services commercially, or rely on other specialists to perform parts of a control process.
An instruction can consequently pass between an aggregator, a technology provider, a communications network, and a device before the requested action occurs. That chain introduces several opportunities for software faults, compromised identities, or unauthorised changes.
The cybersecurity provisions address risks arising from those connected arrangements. A malicious instruction might alter equipment operation or interfere with the delivery of contracted flexibility, although the consequences would depend on the scale and type of devices affected.
At the level of an individual customer, an unauthorised command could change charging or heating contrary to agreed preferences. Across a large fleet of connected equipment, errors or malicious activity could produce more substantial changes to electricity demand.
Operators must therefore consider the provenance of commands and the access allowed to individual services. Remote administration and machine identities can be useful for maintenance, but excessive privileges create a route for accidental or deliberate interference.
Equipment may be installed by one supplier and maintained by another throughout its operational life. If firmware updates or security settings are poorly managed, a load-control provider can inherit exposure even where it does not manufacture the underlying device.
The proposed licence conditions also address resilience because not every service disruption begins with a cyberattack. Communications failures, platform outages, and business interruptions can affect the ability of an operator to deliver a predictable service.
A continuity plan may need to specify how equipment should behave if instructions cannot be received, who can restore access, and what happens to a customer agreement when the provider is temporarily unable to operate.
Consumer protection is an integral part of the arrangement. A customer may authorise a business to manage equipment in exchange for a tariff benefit, but that permission depends on clear expectations about how and when control can be exercised.
Financial and organisational requirements also influence reliability. Providers that cannot sustain operations or meet their responsibilities may create problems for customers and electricity market participants even when their technical systems are secure.
The government consulted on the proposed licence conditions from December 2025 to February 2026 and published its response in August. The 2 November document advances that work by setting out the standard terms intended for the forthcoming regime.
Separate policies on consumer-authorised energy data sharing concern how information moves between providers. Load control is related but different because authorised software can alter the physical operation of equipment rather than solely exchange data.
Companies developing flexibility services now have a clearer account of the intended compliance framework, while the regulations and supervisory arrangements remain to be finalised. The final licensing requirements will determine how security, continuity, and consumer responsibilities are enforced.
