IN Brief:
- DESNZ published standard load-control licence conditions on 2 November for Great Britain, covering two distinct regulated activities.
- Load controllers face operational and cybersecurity requirements; flexibility service providers face consumer fairness and exit provisions.
- The licensing regulations are still to be laid before Parliament, so the published conditions do not themselves activate a new mandatory licence.
The Department for Energy Security and Net Zero (DESNZ) has published standard licence conditions for electricity load controllers and flexibility service providers operating in Great Britain. The conditions set out prospective requirements covering operational competence, industry-code participation, cybersecurity, and customer treatment. Published on 2 November, they precede the Electricity Act 1989 regulations intended to establish the licensing regime, so the publication itself is not the commencement of a mandatory new licence.
Load control involves adjusting the electrical consumption of connected equipment in response to an authorised instruction, agreed schedule, or system need. Electric vehicle charging, batteries, and some heating loads can change their demand pattern while meeting the service agreed with the customer. The framework distinguishes businesses that execute load-control functions from flexibility service providers that arrange services with customers. A single organisation may carry out more than one activity, but the conditions governing each role are not identical.
The common provisions include a requirement for operational capability, a financial responsibility principle, ongoing fitness and propriety, the provision of information to regulators, and cooperation with the authorities. These requirements concern the organisations operating services, not the electrical specifications of individual vehicles, chargers, or batteries. They are intended to establish whether a licensed business can maintain the activities for which it is responsible and respond appropriately to regulatory scrutiny.
For load controllers, Condition 8 addresses compliance with industry codes, including the Balancing and Settlement Code, the Connection and Use of System Code, and the Distribution Connection and Use of System Agreement. It also refers to the Grid Code and Distribution Code, with specified timing and exemptions. These arrangements connect the operational control of aggregated demand with the existing rules governing electricity-system access, settlement, and technical conduct. The precise code duties depend on the licence terms and the activities undertaken.
Condition 9 deals with cyber assurance for load controllers. It requires appropriate technical and organisational measures for the information and network systems supporting licensed activities, including steps to reduce the impact of security incidents. A controller coordinating many charging points or other devices can produce an aggregate demand change far greater than the rating of any individual appliance. Communications failures or unauthorised instructions therefore create operational as well as information-security risks, which the framework addresses through risk management and assurance duties.
A specific provision requires notification to the Secretary of State when a controller becomes responsible for at least 300MW of aggregate load. Under Condition 9.6, that notification must be made as soon as reasonably practicable and no later than three months after initially reaching the level. The threshold triggers this reporting requirement; it is not a general minimum size for the load-control licence. Separate treatment applies where an organisation is designated as an Operator of Essential Services under the Network and Information Systems Regulations.
Flexibility service providers face customer-facing requirements on fair treatment, suitable service recommendations, prevention of mis-selling, contract information, and exit arrangements. Such terms govern how a business obtains and retains a customer’s agreement to change the operating schedule of equipment. A provider’s commercial offer and the controller’s technical instructions must remain compatible: the customer should know which equipment may be adjusted, the terms of participation, and any applicable charge for leaving the arrangement.
In a managed charging service, for example, charging can be shifted away from a busy network period provided the customer receives the agreed practical outcome, such as a vehicle being ready at a specified time. The customer relationship is therefore part of the operating design rather than an entirely separate sales process. Unclear commitments about available charging, service interruptions, or withdrawal can create disputes even where the control equipment itself responds correctly to instructions.
Where many devices respond to shared instructions, the electrical impact depends on their aggregate behaviour rather than the rating of any one appliance. A collection of individually small loads can produce a material change in system demand if switched at the same moment. Load control therefore requires both software safeguards and an understanding of network limits, balancing arrangements, and the consequences of loss of communication. The published conditions establish obligations for the organisations managing those risks, while technical operation remains subject to the relevant codes and system controls.
The standard conditions follow a consultation opened in December 2025 and closed in February 2026, with the government’s response issued in August. DESNZ says the Electricity Act 1989 (Load Control Licence) Regulations 2027 will be laid before Parliament later in 2026. Until that legislative step and subsequent commencement, the published conditions provide the detailed framework against which prospective licensees can review their systems, contractual arrangements, and compliance responsibilities.
Separate cybersecurity proposals under the Cyber Security and Resilience Bill would affect some larger load-control organisations through another statutory framework. Under the newly published licence conditions, a prospective controller can examine its code obligations, cyber assurance programme, and incident handling, while customer-facing providers can review suitability checks, contracts, and exit terms. The next legislative step is the tabling of the 2027 load-control regulations before Parliament, which DESNZ expects later in 2026.
