How this links to the Cyber Security and Resilience Bill
Load control is a new essential service. Aggregators and platforms that can shift hundreds of megawatts of demand from EV chargers, heat pumps and batteries could destabilise the grid if compromised, so clause 6 brings the largest of them into the NIS Regulations as Operators of Essential Services. This is the first time the regime reaches consumer-facing distributed energy rather than generation and networks.
- cl.6(2), new para 1(5A): the threshold is a load controller whose potential electrical control over relevant ESAs it manages is 300 MW or more, in the UK.
- cl.6(2), new para 1(5B)-(5C): capacity counts both flow in and flow out, using the manufacturer’s stated capacity of each device.
- cl.6(2), new para 1(5D)-(5E): active intermediaries count as load controllers and must be assessed separately.
- As an OES, the controller must notify designation under reg 8(2), meet reg 10 security duties and report incidents within 24 and 72 hours from first awareness under reg 11(6).
- Penalties under new reg 18: failing to notify under reg 8(2) is standard band (the greater of £10m and 2% of turnover); security duty and incident notification failures are higher band (the greater of £17m and 4%).
How do you work out if you are a large load controller?
Start with the devices you manage. A device is managed by you if you control the flow of electricity into and out of it by load control signals you send (para 1(5C)(b)). Only relevant energy smart appliances count: electric vehicles, charge points, listed electrical heating appliances, battery storage systems and virtual power plants.
Then calculate potential electrical control: the maximum flow into all those devices taken together, plus the maximum flow out, based on manufacturer-stated capacity. If the total is 300 MW or more, you meet the threshold and are deemed designated as an OES.
What does a large load controller have to do?
The duties are those of any electricity OES, as amended by the Bill. The competent authority is the Secretary of State for Energy Security and Net Zero and GEMA (Ofgem) jointly, which the DSIT factsheet confirms.
- Notify the competent authority that you meet the threshold (reg 8(2)). The factsheet says within 3 months of falling within scope.
- Take appropriate and proportionate technical and organisational measures to manage risks and minimise incident impact (security duties, reg 10).
- Send an initial incident notification within 24 hours and a full notification within 72 hours, both from first awareness, copying the CSIRT (reg 11(6), 11(8)).
- Respond to information notices and inspections, and manage supplier risk, including any critical suppliers once that regime commences.
How does this sit alongside Ofgem load control licensing?
The Energy Act 2023 also created a load control licence for controllers of domestic and small non-domestic devices, with cyber conditions in the licence. The two regimes meet at 300 MW. Below it, cyber requirements come from the licence. At or above it, in any setting, they come from the NIS Regulations, although a domestic-focused controller still needs the licence for its other conditions. The large load controllers guide has the detail.
Separate product rules for smart charge points, under the Electric Vehicles (Smart Charge Points) Regulations 2021, cover the devices themselves rather than the controller.
An aggregator dispatches 40,000 home batteries rated at 5 kW charge and 5 kW discharge. Inflow is 200 MW and outflow is 200 MW, so potential electrical control is 400 MW and the aggregator is a large load controller. Actual dispatch on a typical day is irrelevant. Figures are illustrative.
Where it appears in the Bill
- cl.6(2), NIS Sch 2 para 1(5A)The 300 MW threshold for the essential service of load control.
- cl.6(2), NIS Sch 2 para 1(5B)-(5C)How potential electrical control is measured and which devices count.
- cl.6(2), NIS Sch 2 para 1(5D)-(5E)Treatment of intermediaries.
- New reg 18(10)-(11)Reg 8(2) notification failures in the standard band; security and incident failures in the higher band.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
New paragraph 1(5A) of Schedule 2 to the NIS Regulations makes load control an essential service where a load controller’s potential electrical control over the relevant energy smart appliances it manages is 300 megawatts or more. The figure adds maximum inflow to maximum outflow across all managed devices, using manufacturer-stated capacity rather than typical or dispatched load.
They can be. A virtual power plant is itself listed as a relevant energy smart appliance, and an operator that sends load control signals is a load controller. If its potential electrical control across managed devices reaches 300 megawatts, it becomes an Operator of Essential Services, regulated jointly by the Energy Secretary and Ofgem.
Two bands apply under new regulation 18. Failing to notify that you meet the threshold is in the standard band: the greater of £10 million and 2% of turnover. Failing the security duties or incident notification rules, including their timing and content, is in the higher band: the greater of £17 million and 4% of turnover.
Clause 6 commences on a day set by regulations after Royal Assent, which is expected between late 2026 and spring 2027. The Bill completed Lords Committee Stage on 7 September 2026, Lords Report Stage day one took place on 26 October 2026 and Third Reading is expected on 2 November 2026. DESNZ is also consulting on a Tier 1 Cyber Assessment Framework profile for large load controllers.