New rules for networks, markets and security
Energy and telecoms companies work under dense regulation that keeps changing with the energy transition, the fibre rollout and new security laws. COBACK reads the EU Official Journal, the German Federal Law Gazette and other official sources, checks new publications against your entities, networks and plants and turns a relevant change into tasks.
Topics and rules
What is changing, who in the company works with it and which legal acts are behind it.
Electricity market and grid operation
The 2024 EU electricity market reform relies on long-term power purchase agreements, two-way contracts for difference as the form of public support for new generation and more flexibility from storage and demand response. In Germany the Bundestag passed an amendment to the Energy Industry Act in November 2025 that transposes parts of the directive and regulates energy sharing for the first time. Since June 2026, distribution system operators must make shared use of electricity possible within their balancing area. Grid operation, retail, trading and regulatory management are affected.
Examples
- Regulation (EU) 2024/1747
- Directive (EU) 2024/1711
- German Energy Industry Act (EnWG)
Wholesale energy trading
REMIT prohibits insider trading and market manipulation in wholesale electricity and gas markets and requires market participants to disclose inside information and report transactions to ACER. The 2024 revision brought LNG supply contracts and storage contracts into scope, and ACER can now investigate cases with cross-border relevance itself. Trading, middle office and trading compliance are affected.
Examples
- Regulation (EU) No 1227/2011 (REMIT)
- Regulation (EU) 2024/1106
Gas, hydrogen and methane
The 2024 gas and hydrogen package creates the first EU framework for hydrogen networks, with network access, unbundling and network development planning. The deadline for transposing its directive ended on 5 August 2026, and in September 2026 the Commission opened infringement proceedings against Germany and other member states. The Methane Regulation requires operators to measure, report and repair leaks and phases in requirements for importers of oil, gas and coal. Gas and hydrogen network operators, storage operators, procurement and trading are affected.
Examples
- Directive (EU) 2024/1788
- Regulation (EU) 2024/1789
- Methane Regulation (EU) 2024/1787
Critical facilities and cybersecurity
Energy as well as IT and telecommunications are sectors of the German KRITIS umbrella act. It has been in force since March 2026 and requires registration, risk assessments, resilience plans and incident reports. Germany's act implementing the NIS2 Directive has also applied since 6 December 2025, and for cross-border electricity flows the network code on cybersecurity adds its own requirements. Information security, corporate security, network operations and management are affected.
Examples
- KRITIS-Dachgesetz (KRITISDachG, Germany)
- Directive (EU) 2022/2555 (NIS2)
- Delegated Regulation (EU) 2024/1366 (network code on cybersecurity)
- Telecommunications (Security) Act 2021 (United Kingdom)
Telecommunications and network rollout
The European Electronic Communications Code and the German Telecommunications Act govern spectrum, network access, customer protection and the security of networks and services, and so concern regulatory affairs, network operations and customer service. The Gigabit Infrastructure Act makes rollout easier through shared use of passive infrastructure, coordinated civil works and simpler permit procedures. In January 2026 the Commission proposed a Digital Networks Act that would replace the Code with a directly applicable regulation.
Examples
- Directive (EU) 2018/1972 (European Electronic Communications Code)
- German Telecommunications Act (TKG)
- Regulation (EU) 2024/1309 (Gigabit Infrastructure Act)
- Commission proposal for a Digital Networks Act (January 2026)
Renewables and emissions trading
The revised Renewable Energy Directive (RED III) sets a binding EU target of at least 42.5 percent renewables by 2030 and speeds up permitting, including through renewables acceleration areas. In Germany the Renewable Energy Sources Act (EEG 2023) governs support, the Fuel Emissions Trading Act puts a carbon price on fuels and the EU emissions trading system covers power plants and energy-intensive installations. Generation, project development, trading and energy procurement are affected.
Examples
- Directive (EU) 2023/2413 (RED III)
- German Renewable Energy Sources Act (EEG 2023)
- Directive 2003/87/EC (EU Emissions Trading System)
- German Fuel Emissions Trading Act (BEHG)
The path of a change
Example: the KRITIS umbrella act
01Law database
The KRITIS umbrella act is promulgated in the German Federal Law Gazette. Operators of critical facilities must register, carry out a risk assessment at least every four years and set out their measures in a resilience plan.
02Relevance
COBACK checks it against the twin: your grid company runs an electricity distribution grid and your fibre company a fibre network. The score is 87 out of 100, with reasoning that names both entities and the sectors concerned.
03Open questions
Whether a facility is critical depends on thresholds, with a standard value of 500,000 people supplied. The number is missing from the twin, so COBACK asks. The head of regulatory affairs answers and marks the act as relevant.
04Task
Tasks follow: network operations checks the facilities against the thresholds by 20 October 2026. Information security prepares registration through the joint BSI and BBK portal within 6 weeks. Corporate security sets up the risk assessment and resilience plan within 3 months.
Working with COBACK
Energy and telecoms in one twin
The digital twin knows your grid, retail, generation and telecoms entities. The reasoning behind a score names which of them a new rule affects.
A score with its reasoning
Every new publication from the EU Official Journal, the Federal Law Gazette and other official sources gets a score from 0 to 100 with the reasoning, the sources and the company facts used.
Questions instead of assumptions
Where a duty depends on a threshold, such as the number of people supplied, and the number is missing from the twin, COBACK asks. A person decides whether a change is relevant.
Tasks for the departments
A relevant change becomes tasks with steps, owners and deadlines, for example for regulatory management, network operations, trading or information security.
Frequently asked questions
We are a municipal utility with grid, retail and fibre companies. Does COBACK fit?
Yes. The digital twin maps your entities, locations and activities, also with data from public registers such as GLEIF. The reasoning behind a score names the entity a change affects.
Does COBACK replace the review by our legal department?
No. COBACK does not give legal advice and does not decide for you. It shows what is new, why it could affect you and which sources and facts the score is based on.
Will COBACK e-mail us when something changes?
No. COBACK does not send e-mails or push notifications. New scores, open questions and tasks are in COBACK itself.
Does COBACK read rules from outside Germany and the EU?
Yes. COBACK also reads publications from other European countries such as the United Kingdom, from the Americas, from Asia and from international bodies. For a telecoms subsidiary in the United Kingdom, for example, that would include new regulations made under the Telecommunications (Security) Act 2021.
