Setting up CLS management: the aEMT role, the processes and the make-or-buy call
This article covers what CLS management means in daily operation, what the active external market participant role demands, which process chain it pulls across the whole utility, and how the choice between your own certification and a service provider tends to go.
CLS management is the operating function that provides, runs and evidences the encrypted control channel on the smart meter gateway; CLS stands for Controllable Local System. It sits with the default metering point operator, the matching market role is called active external market participant, and that role requires certification to ISO/IEC 27001 or German IT-Grundschutz plus access to the smart meter PKI. The framework comes from ruling BK6-22-300 of the German regulator, dated 27 November 2023 and in force since 1 January 2024, which also guarantees at least 4.2 kilowatts to the customer during an intervention. By 31 December 2026 German metering law requires functioning control with the central core processes. The real decision is not a product but make-or-buy: your own certification and your own operation, or a provider whose certification you use.
What has to be running by the end of 2026
By 31 December 2026 German metering law requires functioning control with the central core processes. Not a pilot. An operation that accepts a switching order, executes it and proves it happened.
The regulatory frame has been in place for a while. Ruling BK6-22-300 from the German regulator is dated 27 November 2023 and has applied since 1 January 2024 to every controllable consumption device commissioned after that date. It also sets the floor: even mid-intervention the customer keeps at least 4.2 kilowatts of usable power. Preventive control, the blanket dimming that ignores actual grid state, is a transitional arrangement and runs only until 31 December 2028. For type 1 installations the rules bite by 1 January 2029 at the latest.
The end-of-2026 deadline is not about hardware. It is about the processes behind it, and those do not arrive in the box with the control unit.
What CLS management actually is
Technically the channel is a TLS connection across the gateway's HAN interface. The parts involved are the smart metering system, the control box, a communication adapter and gateway administration. What devices on that channel have to meet is set out in BSI TR-03109-5, the guideline that also certifies the control box itself .
Operations is the part people underestimate. Certificates expire and have to be renewed. The channel has to be ordered and cleared again when a customer switches supplier. The control box needs administration like any other field device. And every switching action needs evidence, because a reduced grid fee hangs on it.
That is the break with classic metering. Reading becomes switching. Whoever switches is reaching into a customer's equipment, and that wants documenting.
aEMT and pEMT: the role decides
The market roles are cleanly separated, and the dividing line is the switching action.
| Aspect | Passive external market participant | Active external market participant |
|---|---|---|
| May | receive metering data | receive metering data and switch via the CLS channel |
| Certification | no evidence of its own required | ISO/IEC 27001 or IT-Grundschutz |
| PKI | no access needed | smart meter PKI access is mandatory |
| Typical actors | supplier, balancing group manager | metering point operator, grid operator, aggregator |
| Use cases | billing, tariffing, reporting | grid-oriented control, dynamic tariffs, direct marketing |
The second row is the one that matters. No certification means no access to the smart meter PKI, no PKI means no certificates, no certificates means no channel. The chain breaks right at the front, and it breaks on an audit report rather than on any piece of equipment.
The role attaches to the company, not to the individual installation. Once you hold it you can use it across several business models, from control under section 14a to remote control in direct marketing. For the business case that is the decisive point.
The process chain it creates inside the utility
The switching command is the visible part. The effort sits before and after it, and the chain runs across three areas that used to have little to do with each other.
Four stations, three areas
-
The grid operator triggers
It establishes grid state and hands over the order. Whether it uses a low-voltage SCADA coupled to CLS management or simpler logic is a question of its own maturity, not of the role.
-
Metering operations keeps the chain ready
Gateway administration, control box, certificates.
-
IT owns PKI and interfaces
Plus the link into the billing system, because the reduced grid fee has to land on the right customer. This interface gets underestimated regularly, since it only surfaces when the first annual bill comes round.
-
Evidence flows back
Who was curtailed, when, for how long, with what result. Without that return path the control is not auditable, and auditable is exactly what it has to be.
Grid state data under TAF 10 comes along as a separate use case. Build the chain anyway and you get it almost for free, and the grid side often values it more than the switching itself.
Run it yourself or buy it
The decision is not made on technology. It is made on certification and on staff.
Running it yourself means your own certification to ISO/IEC 27001 or IT-Grundschutz, your own staff for PKI and operations, your own audit cycles. That is not a project, it is a standing commitment. It pays where the role carries several business models and where the certification already exists in house.
Buying saves exactly that evidence. Providers run the aEMT system and gateway administration as managed operations and quote around four months to a working process chain, assuming everyone involved delivers on time. Stadtwerke Neustadt an der Weinstrasse is introducing such a base module for roughly 34,000 metering points, using the gateway administration it already has with the same provider.
And there is a middle path that rarely gets named: buy the managed operation, keep the control logic and the customer interface in house. It costs more coordination and it keeps open the question of whose customer this is later on.
The question is not whether the utility could run an aEMT system. It is whether the role only discharges a duty or is meant to carry tariffs and flexibility later. Everything else follows from that answer.
Where it gets awkward
The deadline is fixed and the precondition is wobbling. That is the situation the decision gets made in.
The installation rate is not carrying yet. In the fourth quarter of 2025, 23.3 percent of mandatory cases had a smart metering system installed: 27.1 percent among operators with more than 500,000 metering locations, 19.7 percent among mid-sized ones between 100,000 and 500,000. Practitioners consider the statutory quotas for 2026 out of reach in many utilities. The regulator's supervisory proceedings against laggard metering operators are already running.
A service contract shifts the work, not the responsibility. The legal duty stays with the default metering point operator. Outsource and you still need somebody in house who can steer the provider on the substance.
There is also a lock-in that looks harmless at signing. Buy the role and you usually tie yourself to the same provider's gateway administration. A later switch then touches both systems at once, which is a good deal more than changing a supplier.
What utilities should do now
Four months is enough for an implementation. Only if the decision is made, though, and in many utilities it is not.
Five steps to the decision
-
Settle what the role is for
Does it only discharge the duty, or should it carry dynamic tariffs and flexibility later? That single answer decides make-or-buy, and it belongs at executive level rather than in the specialist team.
-
Check the certification status
Is there ISO/IEC 27001 in house, and does its scope cover metering operations? A certificate held by group IT does not automatically help here.
-
Name the four core processes
Ordering, switching order, evidence, fault. Each gets an owner.
-
Settle the interface with the grid side
Even when grid and metering sit in the same group. Especially then, frankly, because responsibility there tends to be treated as obvious and so nobody writes it down.
-
Start from what exists, not from the target architecture
Eight certified control boxes are on the market. That is enough to walk the whole chain once, and one case walked end to end teaches more than any concept paper.
Decide now and by the turn of the year you have a chain that carries a switching order. Defer it and in December you have a control box and no procedure.
Further Reading
Frequently Asked Questions
CLS management is the operating function that provides and runs the encrypted control channel on the smart meter gateway. CLS stands for Controllable Local System. A switching command reaches the heat pump, the wallbox or the battery in the home through this channel. The function covers certificate handling, ordering and releasing the channel, control box administration, and evidence for every switching action.
The dividing line is the switching action. A passive external market participant may receive metering data and nothing more. An active external market participant may switch through the CLS channel, and for that it needs certification to ISO/IEC 27001 or to German IT-Grundschutz plus access to the smart meter PKI. Without that certification there are no certificates for the channel.
The German regulator's ruling of 27 November 2023 governs grid-oriented control under section 14a of the Energy Industry Act. It has applied since 1 January 2024 to every controllable consumption device commissioned after that date. Even during an intervention at least 4.2 kilowatts of usable power stay available to the customer. Preventive control is permitted only until 31 December 2028.
No. Both routes are permitted. Running the role yourself means your own certification to ISO/IEC 27001 or IT-Grundschutz, your own staff for PKI and operations, and your own audit cycles. Buying it means using the provider's certification and skipping your own evidence. The legal duty stays with the default metering point operator either way.
German metering law requires functioning control with the central core processes by the end of 2026. That means an operation able to accept, execute and evidence a switching order, not a pilot project. The installation quota runs in parallel: 90 percent of the metering points that have fallen due since 25 February 2025.