Load controllers explained
Under the Cyber Security and Resilience Bill (CSRB), a load controller is an organisation that sends signals to change how electricity flows into or out of energy smart appliances such as EV chargers and heat pumps. It is regulated once its potential control reaches 300 megawatts. The Bill does not regulate household switching devices as such.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
First: which "load controller" do you mean?
The term is used in two different ways. Electrical and building equipment suppliers often use it for a physical device that switches circuits or manages a load. That is not what the Cyber Security and Resilience Bill (CSRB) is talking about.
The Bill's "load controller" is a person or organisation that provides the service of load control. A household device does not become regulated under the Bill merely because it controls power use.
What load control means
The Bill takes the meaning of "load control" and "load control signal" from Part 9 of the Energy Act 2023. In plain terms, a load controller sends signals that adjust how much electricity flows into or out of energy smart appliances. Think of a business that shifts EV charging or heat pump use away from peak times, or that dispatches home batteries as a virtual power plant.
Why this matters: a compromised platform controlling many devices at once could cause a sudden swing in electricity demand. That is a grid risk, not merely an IT risk.
The 300 megawatt threshold
A load controller becomes an operator of essential services if its potential electrical control over relevant energy smart appliances it manages is 300 megawatts or more.
Potential electrical control adds together:
- the maximum flow of electricity into those appliances, taken together, and
- the maximum flow out of them, taken together,
which can be achieved in response to the controller's signals. Each appliance's maximum is taken from the capacity stated by its manufacturer.
Which appliances count
Only "relevant" energy smart appliances count towards the threshold:
- Electric vehicles
- Charge points for electric vehicles
- Electrical heating appliances: hydronic, hot water and hybrid heat pumps, direct electric hot water cylinders, electric storage heaters and heat batteries
- Battery energy storage systems
- Virtual power plants
A device must also be managed by the controller, meaning the controller controls its flow of electricity through load control signals.
Intermediaries
Many platforms work through partners, so the Bill deals with them directly.
| Arrangement | Who counts as managing the appliance |
|---|---|
| Intermediary simply passes on signals, acting for a load controller | The load controller only |
| Intermediary can adjust or process signals, and is authorised to do so | Both the load controller and the intermediary, which is also treated as a load controller |
So a company below 300 megawatts on its own account should still look at how signals reach devices, and which partners have discretion over them.
Working out your number
- List each relevant appliance you manage, directly or through a partner.
- Record each device's manufacturer-stated maximum flow in and out.
- Add the totals for flows in and flows out, then combine them.
- Check whether the devices can all actually be affected by your signals.
- Review the figure often, because a growing fleet can cross the threshold.
Don't use average usage or what you dispatch on a normal day. The test looks at what could be achieved in response to your signals. A two-way battery may also count in both directions.
What regulated load controllers would have to do
Load control sits in the electricity subsector, so its competent authorities are the Secretary of State for Energy Security and Net Zero and the Gas and Electricity Markets Authority, acting jointly. Regulated controllers would have operator of essential services duties, including security duties and 24-hour and 72-hour incident notification. For detail, see large load controllers.
How this differs from the load control licence
There is a separate energy regime. The Energy Act 2023 created a route to license load control of energy smart appliances, through the Department for Energy Security and Net Zero and Ofgem's Smart Secure Electricity Systems programme.
The two are separate tests:
- The licence is an energy regulation question, and draft regulations and proposed exemptions were being consulted on during 2025 and 2026.
- The Bill's duties apply at 300 megawatts of potential electrical control.
Being licensed does not mean you are an operator of essential services, and vice versa. We could not confirm the final status of the licensing regulations, so check the latest Ofgem and Department for Energy Security and Net Zero publications.
Questions for a growing platform
- What is our potential electrical control today, and in 12 months?
- Could a single credential or update reach most of our fleet?
- Which partners can adjust signals?
- Who would decide whether an incident must be reported?
- Are we tracking both the licence regime and the Bill?
Sources
Frequently asked questions
The Bill sets it at 300 megawatts of potential electrical control over relevant energy smart appliances managed by the controller.
In everyday electrical use it can be. Under the Bill, it means a person that provides the service of load control, not a device.
An intermediary that can adjust or process load control signals, and is authorised to do so, is also treated as a load controller. One that merely acts under the controller’s direction is generally not, unless those conditions are met.
No. The licence is a separate energy regime under the Energy Act 2023. Holding a licence and being regulated under the Bill are separate questions.