Ofcom network resilience guidance: the new mobile power backup expectations
In short: Ofcom’s network resilience guidance, revised on 16 June 2026, now sets out what Ofcom expects of mobile operators on power backup at radio access network sites. It does not set a fixed number of hours of battery. The duty flows from section 105A of the Communications Act 2003 and Regulation 3 of the Security Measures Regulations 2022.
Mobile network operators now have a written Ofcom expectation on power backup at their mast sites. On 16 June 2026 Ofcom published a revised version of its Network and Service Resilience Guidance, filling in a section on power backup for mobile radio access networks that the 2024 version had left largely blank. The guidance does not set a fixed number of hours of battery. It expects operators to manage the risk of power loss in proportion to the risk, as part of the statutory security duty rather than alongside it.
How the network resilience guidance fits the security duty
The duty comes from section 105A of the Communications Act 2003. It requires every provider of a public electronic communications network or service to take appropriate and proportionate measures to identify, reduce and prepare for security compromises, and a security compromise expressly includes anything that compromises the availability of the network or service.
A power cut that takes a mast offline compromises availability, so managing it is part of the duty and not an optional extra. The detailed measures sit in the Electronic Communications (Security Measures) Regulations 2022 (SI 2022/933), in force since 1 October 2022. Regulation 3 requires providers to design, construct and maintain their networks in a way that reduces the risk of security compromises. The framework was inserted into the Communications Act by the Telecommunications (Security) Act 2021. Ofcom’s network resilience guidance, first published in September 2024, describes how it expects providers to meet that duty in practice. Its companion, the security Code of Practice, covers the cyber side of the same duty.
What the network resilience guidance update changes for mobile
The update tells mobile operators what Ofcom expects on power backup, without setting a fixed number of hours. Ofcom expects operators to take strong, proportionate measures to manage and reduce the risks of power outages, and to support continued service during outages and surges that might reasonably be expected to occur. The 2024 guidance had left this question open, pending further study.
The revised text ties the expectation back to Regulation 3 and points operators to three parts of the guidance. An ongoing programme of risk assessment is the starting point, with plans and investment matched to the risks identified, including for communities that are particularly exposed to a mobile power failure. Aggregation sites, where a large number of customers’ last-mile connections converge, should have the resilience of their equipment and its key dependencies built into the site design. And, where possible, operators should eliminate the loss of key dependencies such as mains power and network timing or synchronisation for a meaningful period, because people rely on the access network to reach the emergency services.
Fixed networks are treated differently. For new active fixed access cabinets, Ofcom already treats three to four hours of power backup as good practice, and expects more in areas that suffer longer outages more often. For mobile it has stopped short of a number and keeps the approach principles-based rather than prescriptive. This reads as a nudge towards greater action, not a mandate.
What this means for operators
The expectation gives operators a yardstick to be measured against and a cost to weigh. Ofcom’s earlier analysis of mobile power resilience put the cost of one hour of backup at every mobile site at between £0.9bn and £1.8bn across the industry, which is why it has framed the expectation around proportionate, risk-based investment rather than a universal requirement. The duty is to identify and reduce risk in proportion to each site, not to fit the same battery everywhere.
It is not only the four mobile network operators that have to act. Neutral-host and tower companies that own and increasingly manage site infrastructure are part of the resilience picture, and mobile virtual network operators inherit the resilience of the host network they depend on. Proportionality works in both directions. A single rural mast that provides the only coverage in a valley is a different case from a dense urban cell with overlapping neighbours, just as a cabinet serving a few hundred premises differs from one serving a town. Ofcom assesses compliance against the section 105A duty and the 2022 Regulations, and the network resilience guidance is the yardstick it will use. The scope of a regulatory compliance and enforcement instruction is set out on the investigations and enforcement support page.
| Issue | Fixed access network | Mobile radio access network |
|---|---|---|
| Ofcom power-backup benchmark | Three to four hours treated as good practice for new active cabinets | No fixed duration; proportionate, risk-based measures expected |
| Legal hook | Section 105A CA 2003 and Regulation 3 SI 2022/933 | Section 105A CA 2003 and Regulation 3 SI 2022/933 |
| Ofcom’s stance | Specific duration benchmark, with more in higher-risk areas | Expectation written into guidance on 16 June 2026, not a number |
| Cost signal | Battery swap, retrofit and waste costs raised in consultation | One hour at all sites estimated at £0.9bn to £1.8bn |
Viewpoint
The number of hours is not the point. Ofcom has now written its expectation into the guidance it measures against, and that makes a mobile operator’s documented risk assessment the test. The binding constraint is rarely the headline battery specification. It is whether the risk assessment required by Regulation 3 is documented, current and matched to investment. The measures in the guidance are how an operator evidences the section 105A duty; they do not replace the duty, which is to identify and reduce the risk proportionately, site by site. An operator that does the engineering but cannot show the assessment behind it has not met the duty.
Frequently asked questions
Does the resilience guidance require mobile operators to install battery backup?
No. The 16 June 2026 revision sets an expectation, not a fixed rule. Ofcom expects mobile operators to take strong, proportionate measures to manage the risk of power outages and to support continued service, judged against their own documented risk assessment. It has not set a minimum number of hours of backup for mobile sites.
What is the legal basis for the resilience expectations?
The duty is in section 105A of the Communications Act 2003, which covers anything that compromises the availability of a network or service. Regulation 3 of the Electronic Communications (Security Measures) Regulations 2022 requires providers to design, construct and maintain networks to reduce that risk. The resilience guidance describes how Ofcom expects providers to comply.
How much power backup does Ofcom expect for fixed broadband cabinets?
For new active fixed access cabinets, Ofcom treats three to four hours of power backup as good practice. In areas that suffer longer power outages more frequently, it expects providers to consider a longer duration. The benchmark applies to new installations rather than the entire existing estate.
For advice on how the resilience guidance and the security duty in section 105A apply to your network, contact Rob Bratby at Bratby Law. We advise operators, neutral-host providers and investors on the UK telecoms regulation framework.
