Regulatory implementation for German grid operators: §14a, MsbG, NIS2 and MaKo translated into requirements
Between a ruling of the Federal Network Agency and a working process lie requirements nobody writes, because regulatory affairs, business and IT speak three languages. innobu translates: §14a and control, MsbG and rollout quotas, NIS2 and the IT security catalogue, MaKo releases and AgNeS.
Regulatory implementation for grid operators means: a law, a ruling or an application guide is translated into concrete requirements for processes, systems and organisation, with deadline, owner and evidence. innobu covers the obligations that hit German distribution system operators and metering point operators at the same time in 2026 and 2027: §14a EnWG, MsbG and rollout quotas, NIS2 and §5c EnWG, the KRITIS umbrella act, MaKo releases, MiSpeL and AgNeS.
Who this service is for
You know the rulings, but the translation into programmes and systems stalls because everyone waits for someone else.
Rollout quotas, gateway certification, §14a control and the new metering contracts run in parallel, and the regulator is watching.
NIS2 applies without a transition period, §5c EnWG requires attack detection, and nobody has written down the requirements for control systems and back ends.
You sell into German utilities and need the obligations of your customers translated into what your product has to support.
What you get
1. Regulatory map with deadlines
All obligations of your company on one map: law, ruling, date, affected role, status. The basis is our deadline calendar, adapted to your divisions.
2. Requirements teams can work off
§14a, MsbG, NIS2 or a MaKo notice become requirements with acceptance criteria, assigned to process, system and owner.
3. Programme and architecture requirements
Which programmes an obligation triggers, which systems change, where dependencies to rollout, portals or IS-U lie.
4. Evidence for the regulator
What the Federal Network Agency, the BSI or the auditor want to see is documented at the end: quotas, registrations, attack detection, contracts.
5. Support until acceptance
We stay in the programmes until the requirements are implemented and accepted, not until the document is finished.
How it works
Four stages, a tangible result after each.
-
Obligation inventory
We match your divisions and roles against laws, rulings and deadlines and get the map of open obligations.
-
Translation into requirements
Per obligation we write requirements with acceptance criteria and assign them to processes, systems and owners.
-
Placement in the portfolio
Requirements become work packages in existing or new programmes, sequenced by deadline and dependency.
-
Implementation and evidence
We support the implementation, check acceptance and compile the evidence the regulator expects.
Backed by
Reference: municipal utility in northern Germany. Since 2025 innobu has led the grid division of a municipal utility in northern Germany as external portfolio and programme lead: grid portfolio 2025 to 2030, the §14a control programme with five sub-projects, the smart meter rollout across electricity, district heating and water, the customer and grid connection portal up to fibre, plus programme office, roadmap and decision paths. Mandate details on request, anonymised for confidentiality.
Related topic fields and tools
Next step
Which obligation presses hardest: §14a, the rollout quota, NIS2 or the MaKo release in October? In a first conversation we put your deadlines on the table and name what to do first.
Frequently asked questions
Grid operators must connect controllable consumption devices such as heat pumps and wallboxes, be able to dim them to 4.2 kW in a congestion and grant reduced grid charges in return. Until end of 2028 the transition period with preventive control applies, from 2029 grid-oriented control based on grid state data. This requires a control box, gateway connection, grid state estimation and adapted billing.
Under MsbG, default metering point operators had to equip 20 percent of mandatory cases by end of 2025, 50 percent by end of 2028 and 95 percent by end of 2030. The Federal Network Agency has been running supervisory proceedings against laggards since March 2026.
Usually yes. The German implementation act has applied since 6 December 2025 without a transition period to energy suppliers and grid operators, with registration, risk management, reporting within 24 and 72 hours and personal liability of management. For grid operators the IT security catalogue under §5c EnWG with attack detection comes on top.
With notice no. 56, 26 EDIFACT formats and AS4 adjustments become binding on 1 October 2026. Grid operators, suppliers and metering operators are affected and have to prepare test schedules, clarification processes and fallback scenarios.
innobu writes the requirements, places them in the portfolio, steers the implementation by internal teams and vendors and checks acceptance. For working prototypes and automation innobu works on the code itself; implementation in core systems stays with your vendors.
The basis is the deadline calendar on innobu.com with date and source per entry. It is maintained with every new article; changed deadlines such as the dropped KRITIS registration deadline are corrected with a date.