How this links to the Cyber Security and Resilience Bill
Clause 6 makes load control an essential service in the electricity subsector of the NIS Regulations. It defines a load controller by reference to the Energy Act 2023 and sets out when intermediaries also count. Being a load controller is not enough on its own: only a large load controller with 300 MW or more of potential electrical control becomes an Operator of Essential Services.
- cl.6(3)(c), new para 1(8)(ga): “load controller” means a person which provides the service of load control; “load control” and “load control signal” take their meaning from Part 9 of the Energy Act 2023 (s.238).
- cl.6(2), new para 1(5D): an intermediary sending signals on behalf of a load controller is ignored, and the devices count as managed by the load controller.
- cl.6(2), new para 1(5E): an intermediary that can adjust or process the signals, and is authorised to do so, is also treated as a load controller.
- Regulation sits with the electricity competent authorities in NIS Sch 1: the Secretary of State for Energy Security and Net Zero and GEMA (Ofgem) jointly, as confirmed in the DSIT factsheet.
What does load control mean in law?
Section 238 of the Energy Act 2023 describes an energy smart appliance as an appliance capable of adjusting the flow of electricity into or out of itself or another appliance in response to a load control signal. A load control signal is a digital communication sent over an electronic communications network to cause or facilitate that adjustment, and load control is the sending of such signals.
The Bill borrows these definitions rather than inventing new ones, so the NIS regime and Ofgem’s load control licensing regime use the same vocabulary. Whether a business is a load controller depends on what it does, not what it calls itself. Aggregators, virtual power plant operators, EV charge point operators, heat pump platforms and energy suppliers running smart tariffs can all be load controllers if they send signals that change electricity flows.
When is an intermediary a load controller?
Signal chains often involve several parties: an energy supplier, a platform provider and a device manufacturer’s cloud. New para 1(5D) and (5E) decide who is counted.
- Passive intermediary: sends signals under the direction of or on behalf of a load controller but cannot, or is not authorised to, adjust or process them. The devices count as managed by the load controller only.
- Active intermediary: capable of adjusting or processing the signals and authorised to do so. The devices count as managed by both, and the intermediary is itself treated as a load controller.
- Each party must reach the 300 MW threshold on its own count to become an OES.
Which load controllers are regulated?
Only those at or above 300 MW. Below that, a controller of domestic and small non-domestic devices may still need an Ofgem load control licence with cyber conditions, but it is not an OES. The large load controllers guide explains how the two regimes fit together, and the utilities and energy page covers the wider electricity subsector.
Clause 6 is not among the provisions that clause 60 brings into force automatically, so the load control essential service will start on a day appointed by regulations after Royal Assent. Controllers approaching the threshold can use the time to map their signal chains and agree in writing who is the load controller.
Common misconceptions
Myth: Making a smart appliance makes you a load controller.
Reality: A manufacturer is a load controller only if it sends load control signals to change electricity flows, for example for grid balancing. Making the device is not enough.
Myth: Every load controller is an Operator of Essential Services.
Reality: Only load controllers with potential electrical control of 300 MW or more over relevant energy smart appliances meet the new para 1(5A) threshold.
Where it appears in the Bill
- cl.6(3)(c), NIS Sch 2 para 1(8)(ga)Defines load controller and imports load control and load control signal from the Energy Act 2023.
- cl.6(2), NIS Sch 2 para 1(5D)-(5E)Rules on intermediaries, including when an intermediary is also a load controller.
- cl.6(2), NIS Sch 2 para 1(5A)The 300 MW threshold that makes a load controller an OES.
- Energy Act 2023, s.238Source definitions of energy smart appliance, load control and load control signal.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Is an EV charge point operator a load controller?
It is if it sends load control signals that adjust how much electricity charge points or vehicles draw or export, for example to respond to grid conditions or smart tariffs. Being a load controller only brings NIS duties at 300 megawatts or more of potential electrical control. Below that, Ofgem’s separate load control licensing regime may apply instead.
Can a platform provider be a load controller?
Yes. Under new paragraph 1(5E) of Schedule 2, an intermediary that can adjust or process load control signals, and is authorised by the load controller to do so, is treated as a load controller too. A platform that only passes signals through unchanged is not. Each party then needs 300 megawatts on its own count to be regulated.
Who regulates load controllers under the Bill?
Load control sits in the electricity subsector, so the competent authority is the Secretary of State for Energy Security and Net Zero acting jointly with GEMA, which works through Ofgem. Schedule 1 of the NIS Regulations does not name load control separately; the joint arrangement is confirmed in the government’s large load controllers factsheet.