Smart Secure Electricity Systems (SSES): Load control licence regulations and licence conditions

What this is about

DESNZ is consulting on the detailed regulations and licence conditions for its new Load Control Licence regime, which will make it illegal to control customer electricity loads without Ofgem authorisation from end-2026. This follows the government's April 2025 response to the SSES Programme consultation cycle, which confirmed the policy framework for regulating demand flexibility markets.

The consultation covers draft Statutory Instrument regulations that would create two licence categories: Load Controllers (who directly control customer equipment) and Flexibility Service Providers (who act as intermediaries). Load Controllers face cyber security requirements and must comply with industry codes, while Flexibility Service Providers get consumer protection obligations. Both face general licence conditions covering financial resilience, operational requirements, and compliance costs that will be passed through to flexibility market participants.

Options on the table

The consultation presents a single regulatory framework rather than distinct options, but the draft regulations offer several implementation choices:

Licence scope and definitions

The regulations define load control as "the remote control or management of electricity consumption by domestic or non-domestic customers' electrical equipment or systems." This captures direct control of devices like heat pumps and EV chargers, as well as intermediary services that aggregate and trade flexibility. The scope deliberately excludes customers controlling their own equipment and some industrial demand response arrangements, but covers most commercial flexibility operations.

Load Controllers are defined as entities that "directly control or have the capability to control the electricity load of customers' electrical equipment." Flexibility Service Providers are broader, covering entities that "facilitate, arrange, or provide services relating to load control" without necessarily having direct control capability. This distinction creates a two-tier regulatory structure where technical operators face stricter cyber requirements while commercial intermediaries focus on consumer protection.

Transition arrangements

The regulations provide a 12-month transition period between licence applications opening (planned for end-2026) and enforcement beginning. During this period, existing operations can continue while applying for licences, preventing immediate market disruption. However, the transition only covers existing activities - new entrants during this period would need licences immediately.

The government plans to lay the regulations and open licence applications by end-2026, giving the market roughly 12 months notice before enforcement. This timeline assumes parliamentary approval and Ofgem's readiness to process applications, both of which could shift.

Regulatory requirements by licence type

Load Controllers face the heaviest regulatory burden. They must meet cyber security requirements aligned with the Network and Information Systems Regulations, comply with relevant industry codes (likely including the Grid Code and Distribution Code), and maintain operational resilience standards. These requirements reflect their direct technical role in controlling customer equipment and potential system security implications.

Flexibility Service Providers face lighter but broader requirements focused on consumer protection. They must provide clear contract terms, handle customer data appropriately, and maintain complaints procedures. They also need financial resilience standards to ensure customer payments and services remain secure, but without the technical compliance obligations of Load Controllers.

Both licence types face general conditions covering governance, record-keeping, and cooperation with Ofgem. The regulator can modify licence conditions through its standard processes, giving flexibility to adjust requirements as markets develop.

Financial and operational resilience

All licensees must demonstrate financial resilience, though the consultation doesn't specify exact requirements. This likely means minimum capital requirements, insurance coverage, or parent company guarantees - details that will emerge from Ofgem's licensing process rather than the primary regulations.

Operational resilience requirements cover business continuity planning, risk management, and maintaining essential services. For Load Controllers, this includes ensuring customer equipment remains functional if their services fail. For Flexibility Service Providers, it covers maintaining customer relationships and fulfilling commercial obligations.

Enforcement and penalties

The regulations make unlicensed load control a criminal offence, with penalties to be determined in the final Statutory Instrument. Ofgem gains standard licensing powers including licence modification, suspension, and revocation. The regulator can also impose financial penalties for licence breaches, creating multiple enforcement tools beyond the criminal sanctions for operating without a licence.

The enforcement regime applies to UK-based activities but could cover overseas entities controlling UK customer loads. This extraterritorial scope addresses the global nature of technology platforms and energy services, ensuring regulatory coverage regardless of corporate structure.

Questions being asked

Scope and definitions

The consultation asks whether the load control definition captures the right activities and excludes appropriate exceptions. It seeks views on the boundary between Load Controllers and Flexibility Service Providers, particularly for entities that might fit both categories. Questions also cover whether the customer categories (domestic/non-domestic) align with regulatory intent and market realities.

Licence conditions appropriateness

DESNZ asks whether the proposed licence conditions achieve the policy objectives of protecting consumers, ensuring system security, and enabling market development. Specific questions cover whether cyber security requirements for Load Controllers are proportionate and whether consumer protection measures for Flexibility Service Providers address key risks without excessive burden.

Implementation timeline

Questions focus on whether the end-2026 timeline for regulations and licence applications is achievable and appropriate. The consultation asks if the 12-month transition period provides sufficient time for existing operators to apply for licences while maintaining market continuity.

Regulatory impact

The consultation seeks evidence on compliance costs, market effects, and potential barriers to entry. Questions ask whether the licensing requirements might prevent beneficial innovation or competition, and how costs might flow through to customers. DESNZ also asks about international competitiveness implications and whether the regime might disadvantage UK flexibility markets.

Technical implementation

Questions cover how the licence conditions would work in practice, including interactions with existing regulatory frameworks like the Electricity Act and industry codes. The consultation asks about potential overlaps or gaps with other regulatory regimes and whether enforcement mechanisms are appropriate and proportionate.

How to respond

The consultation closes on [specific date not provided in source text]. Responses should be submitted via the GOV.UK consultation page at https://www.gov.uk/government/consultations/smart-secure-electricity-systems-sses-programme-draft-load-control-licence-regulations-and-conditions.

DESNZ welcomes responses from all stakeholders including flexibility service providers, technology companies, energy suppliers, network operators, consumer groups, and trade associations. Responses can address all consultation questions or focus on specific areas of expertise or interest.

The department particularly seeks evidence on costs, implementation challenges, and market impacts to inform final policy decisions and regulatory design. Respondents should provide quantitative evidence where possible, including data on compliance costs, market participation, and customer impacts.