Energy digitalisation: the GB stack

NESO, the National Energy System Operator, launched on 1 October 2024 with broad strategic oversight of both the electricity and gas systems, and stands operationally independent of Government and industry. That whole-system remit is the reason NESO now appears in three different roles in this stack: as a licensee with its own data duties, as the body coordinating shared data infrastructure for the sector, and as the author of a sector-wide digitalisation plan.

Ofgem sits above the licensees as the regulator. It issues two guidance documents that carry licence weight rather than advisory weight: the Data Best Practice Guidance, which governs how licensees handle energy system data, and the Digitalisation Strategy and Action Plan Guidance, which governs what they must publish about their own digitalisation. Both carry a publication date of 01 April 2026 and both bind companies whose licences are subject to the RIIO-GD3, RIIO-T3 and RIIO-ED2 price controls. Data Best Practice names its audience directly: gas distribution network companies, gas and electricity transmission network companies, electricity distribution network companies, and the electricity system operator.

Above Ofgem, the Department for Energy Security and Net Zero co-owns policy. The Energy Digitalisation Framework is the joint DESNZ and Ofgem statement of what a digitalised energy system should look like and how it should be governed over the long term. Alongside it, NESO published a Sector Digitalisation Plan in 2025, developed in partnership with Energy Systems Catapult and supported by Digital Catapult, Connected Places Catapult and the Royal Academy of Engineering. NESO states that the plan was developed in close collaboration with Ofgem and DESNZ and identified and mapped the digitalisation requirements essential to reach clean power by 2030.

At the market end sits Elexon, which Ofgem appointed to act as senior responsible owner and implementation manager for market-wide half hourly settlement. That appointment matters practically: a question about settlement data goes to the code body running the programme, not to the regulator that commissioned it. Getting the addressee right is most of the work in this sector.

Data Best Practice sets eleven principles. Ten of them describe how to make data usable: identify the roles of stakeholders, use common terms, describe data accurately using industry standard metadata, provide supporting information, make assets discoverable, learn from data users, prioritise quality against user needs, keep assets interoperable, protect them, and store them so access is sustained. The eleventh changes the default position of the whole sector.

Presumed openreverses the burden of proof. A data user does not have to justify a request. The data custodian has to produce evidence that an asset should be withheld or its availability reduced. The evidence has to come from a defined list, and this is where most practitioners go wrong: Open Data Triage is not an open-ended assessment. The guidance limits the sensitivities to five. They are sensitivities that relate to people's rights to personal privacy, security needs, obligations from legislation or regulation, commercial requirements that if not protected will have a negative impact on products and services for end-consumers, and anything that would have a negative impact on the Public Interest.

Finding a sensitivity does not end the process, and this is the second common error. Where a sensitivity is identified, triage also determines how the custodian can mitigate the risk associated with it while still making the asset, its metadata and its scripts as open to stakeholders as possible. The guidance names two levers: processing the data, and providing different levels of access to different types of stakeholder. A yes on one of the five tests is an instruction to redesign the release, not permission to close the file.

Take a worked example. A distribution licensee holds half hourly loading data for low-voltage feeders, joined to the count of connected customers per feeder. Test one bites in the tail of the distribution, because a feeder serving three properties makes the consumption of a household identifiable. Test two is arguable, because feeder-level loading maps the network. Tests three, four and five do not obviously apply. The triage output is therefore not withdrawal. It is a minimum-count threshold below which feeders are aggregated, a published open data release above the threshold, and a controlled route for researchers who need the tail. Two levers, one dataset, one decision recorded.

The status of presumed open is now itself in question. Ofgem published a consultation on 29 May 2026 titled Securing open data in energy, which asks for views on three models for triaging data before publication: a centralised model, a hybrid model and an educational model. Its stated reason is that hostile state actors and terrorists have targeted energy infrastructure, and that the increased use of AI has changed how open data might be used. That consultation closed on 15 July 2026 and the page records it as awaiting decision, so the triage arrangements described above are the current ones and the model that replaces them has not been settled.

A DSAPis a combination of two separate artefacts. The Digitalisation Strategy is the licensee's strategic approach to digitalising its products and services. The Digitalisation Action Plan is the plan to do it. Ofgem's guidance describes their purposes as distinct rather than overlapping: the strategy shares the licensee's understanding of stakeholder needs and what is required to meet them, with the goal of creating consumer and public interest benefits.

The schedule is asymmetric by design, because the two artefacts change at different rates. For RIIO-3 licensees, the guidance requires the Digitalisation Strategy update to be published on or before 31 March 2028 and at least every two years after that date, and the Digitalisation Action Plan update on or before 30 June 2026 and at least every six months after that date, meaning each subsequent 31 December and 30 June. For RIIO-ED2 licensees the same shape applies on earlier anchors: the strategy on or before 1 April 2023 and at least every two years, and the action plan on or before 30 June 2023 and at least every six months.

Assessing a published DSAP is therefore a two-part job. The first part is the calendar. Find the publication date on the current action plan and check it against the anchor and the six-month cadence for that licensee's price control. A plan that is more than six months old is a compliance question before it is a quality question.

The second part is the seven principles the guidance sets. A DSAP should prioritise benefits to the stakeholders who pay for the products and services as well as benefits in the public interest; ensure products and services work towards a defined vision; take advantage of opportunities to deliver benefits early and iterate; enable stakeholders to understand the products and services, the status of their delivery and how to access them; ensure visibility about the nature and status of actions in the action plan; ensure shared understanding of how success and performance are measured; and coordinate with the wider ecosystem of products and services.

Principle five is the one that separates a plan from a brochure. The guidance requires visibility about the nature and status of the actions, so an action list with no status column fails the test on its face. Principle one is the one that separates a plan from an IT roadmap: for each product, service or action, the licensee must be clear about which stakeholder need it meets and what benefits it will deliver to end-consumers or the public interest, and must include a summary of stakeholder feedback and how it is responding to it.

The Data Sharing Infrastructure is described by NESO as a socio-technical solution that makes it easier for the energy sector to share data and models in a scalable, secure and resilient way by bringing together common processes, governance and technology. The phrase socio-technical is carrying weight. Most of the DSI is agreement about identity, permission and meaning; the software is the part that follows.

Two design decisions define it. The first is ownership: each participating organisation retains full ownership, responsibility and control over the data it shares, including how and under what conditions it is made available. The second is topology: all transactions are peer to peer, with no data passing through the Data Sharing Mechanism, which NESO describes as the control plane or broker at the centre of the DSI ecosystem and which holds a central metadata catalogue for data discovery. Together they sidestep the question that has stalled most sector data platforms, which is not technical but political, and is simply who gets to hold everyone else's data.

That topology also changes what an analyst can do. If data never lands in one place, cross-organisation analysis has to run where the data already sits, which is the pattern behind federated analysis. The trade is real: no central copy to leak, but far harder joins, and a much greater dependence on the parties agreeing what a field means before anyone queries it.

NESO is accountable for developing and operating the DSI and holds the role of interim DSI coordinator, providing governance, oversight and coordination on behalf of the sector. The published delivery path runs through discovery, alpha, private and public beta, and live, with a minimum viable product phase focused on the regulated networks and open to other organisations able to deploy at pace. Public beta and full live releases are planned for 2028 to 2030. That window is worth holding on to when a supplier promises DSI-based delivery inside the current price control period.

Ofgem describes the electricity settlement process as placing incentives on suppliers to buy energy to meet their customers' demand in each half hour of the day. That half hour is the settlement period, and it is the unit every commercial consequence in the GB electricity market is eventually expressed in. Consumers without half hourly capable meters have been settled using estimates of consumption for each half hour, which means the market has been trading against a model of demand rather than a measurement of it.

Market-wide half hourly settlement replaces the estimate with the meter reading. Stated that way it sounds like a system change. It is not. It is a migration of every metering point in the market onto new arrangements, running while the market continues to settle, which is why the programme milestones are expressed in what has moved rather than in what has shipped.

The published milestone ladder makes the distinction visible. The MHHS Programme records milestone 10, central systems ready to migrate meter point administration numbers, as approved on 24 September 2025, and milestone 13, the load shaping system switched on, on the same date. Milestones 11 and 12, both approved on 21 October 2025, are described as the commencement of an 18-month migration, first for unmetered supplies and advanced metered points and then for smart and non-smart metered points. Milestone 14, all suppliers must be able to access meter point administration numbers under the new target operating model, is dated 28 October 2026. Milestone 15, full transition complete, is dated 7 May 2027. Milestone 16, cutover to the new settlement timetable, is dated 2 July 2027.

Read those as a data engineer would. There is a readiness gate before any record moves. There is a long dual-running period in which two populations of metering points are settled under two sets of rules at once, and reconciliation between them is the actual risk. There is a completion milestone for the population, and only then, months later, a cutover milestone for the timetable the whole market runs on. The sequencing is the standard shape of a large migration, and the 56 days between milestone 15 and milestone 16 are a stabilisation period rather than slack.

A digital twin in this sector is not a visualisation exercise. What separates a twin from a model is the live connection to the physical thing it represents and the feedback it enables into that thing. In the GB context that connection is exactly what the DSI is being built to carry, which is why NESO houses the DSI inside its virtual energy system work rather than treating it as a standalone data platform.

The commercial pull comes from flexibility. The Clean Flexibility Roadmap, published jointly and updated on 13 July 2026, defines clean flexibility as the ability to shift in time or location the demand or supply of electricity, over hours, days or seasons, while reducing emissions. It sets an increase to 51 to 66 GW of clean flexibility by 2030, from 24 GW in 2023. Shifting demand only pays if the shift is measured in the half hour it happened in, which is the direct line from settlement reform to a flexibility market.

The roadmap's data commitments are the ones to track. It states that by the end of 2026 DESNZ will amend electricity suppliers' licence conditions to require them to make tariff data available to domestic consumers in a standardised format, that government will consult by early 2026 on approaches to enable open data communication between electric vehicles, chargepoints, energy suppliers and aggregators, and that government will explore whether enhanced data sharing through a smart data scheme could create a trusted environment for new products. It also states that DESNZ will introduce new consumer protections and cyber security measures for load controllers and flexibility service providers by the end of 2027, through a new licensing scheme administered by Ofgem. The early 2026 consultation date has already passed, which makes it the first of the roadmap commitments an analyst can test against what has actually been published rather than against what has been promised.

Running alongside that is the Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025. GOV.UK factsheets updated on 30 June 2026 set out its intended effect on this sector: data centres would be classed as essential services and data infrastructure as a network and information systems sector, medium and large managed service providers would be brought into scope, large load controllers would be brought into scope to reduce the risk of grid disruption, and regulators would be able to designate critical suppliers to essential services. On reporting, the factsheets describe an initial notification within 24 hours and a fuller report within 72 hours. On penalties they say the maximum financial penalty will be amended to enable potentially higher penalties where appropriate and proportionate, and they state no figure. The factsheets describe phased commencement, with future-proofing and post-implementation review provisions from day one, the statement of strategic priorities and information sharing at month two, and most substantive measures brought in through secondary legislation.

The two instruments pull against each other on the same data. One pushes energy data out by default. The other prepares to pull load-controlling organisations into a security regime with a 24-hour reporting clock. Ofgem's 2026 triage consultation is the place where the two meet, which is why its outcome will matter more to a practitioner than any of the strategy documents above it.