The Telecommunications (Security) Act 2021 turned telecoms security in the UK from a light-touch expectation into enforceable legal duties, backed by detailed regulations, a tiered Code of Practice and Ofcom penalties of up to 10% of turnover. It amends the Communications Act 2003, gives the government power to restrict high-risk vendors such as Huawei, and makes Ofcom responsible for monitoring and enforcing compliance. This guide explains who is covered, what the Electronic Communications (Security Measures) Regulations 2022 require, how the Telecommunications Security Code of Practice tiers and deadlines work after the July 2026 revision, and how the regime applies to the service accounts, automation pipelines and AI agents that now run telecoms networks. It is written for security leads, network engineers, compliance teams and executives at UK public telecoms providers and their suppliers. Status was checked on legislation.gov.uk, Ofcom and government sources in October 2026.
Key takeaways
- Three layers, one duty. The Act sets the duty (Communications Act 2003 section 105A onwards), the 2022 Regulations set specific legal requirements, and the Code of Practice explains how to meet them, with dates by provider tier.
- Tiering decides your timetable. Tier 1 providers have relevant turnover of £1 billion or more, Tier 2 from £50 million to under £1 billion; smaller providers keep the legal duties but have longer, less prescriptive expectations.
- The Code was revised in 2026. Version 1.1, issued 14 July 2026, added new measures (privileged access workstations, API security, service accounts, automation pipeline validation) with deadlines running to December 2029.
- Ofcom can fine and inspect. Penalties reach 10% of relevant turnover, or £100,000 per day for continuing breaches, and Ofcom monitors large providers through formal information notices.
- Machine identities sit at the centre. Many measures concern privileged access, management plane credentials, third-party administrators and network automation, which are non-human identity problems in practice.
Scope: who and what is covered
The duties apply to providers of public electronic communications networks and public electronic communications services: fixed and mobile operators, wholesale network providers, internet service providers and public voice providers. Private networks are outside the main duty. Suppliers, including managed service providers and equipment vendors, are not directly bound, but providers must impose security obligations on them through the supply chain regulation, so the regime reaches them by contract.
Section 105A(2) of the Communications Act 2003 defines a security compromise broadly. It covers anything that compromises availability, performance or functionality; unauthorised access to, interference with or exploitation of the network or service, or anything enabling that; loss of confidentiality of signals or stored data; unintended or unauthorised alteration of signals or data; and a "connected security compromise" that affects another network or service. Lawful conduct under warrants or the Investigatory Powers Act 2016 is excluded.
| Tier (Code of Practice) | Relevant turnover | What applies |
|---|---|---|
| Tier 1 | £1 billion or more | Full Regulations, Code measures on the earliest timetable, Ofcom information notices and monitoring |
| Tier 2 | £50 million to under £1 billion | Full Regulations, Code measures broadly a year behind Tier 1 for the first groups |
| Tier 3 | Under £50 million | Legal duties and Regulations apply; the Code's detailed timetable is not aimed at them, so they apply measures proportionately |
| Micro-entities | As defined in the Regulations | Regulation 16 exempts micro-entities from the specific Regulations; the general section 105A duty still applies |
Key obligations
The Act inserts duties into the Communications Act 2003. Section 105A requires providers to take measures that are "appropriate and proportionate" to identify the risks of security compromises, reduce those risks and prepare for their occurrence. Further sections require providers to act on compromises, inform users of significant risks, and report compromises to Ofcom.
The Electronic Communications (Security Measures) Regulations 2022
SI 2022/933 came into force on 1 October 2022. Its regulations name the areas providers must address:
| Regulation | Area | Practical meaning |
|---|---|---|
| 3 | Network architecture | Design, construct and maintain the network so that security risk is reduced |
| 4 | Protection of data and network functions | Protect stored data, signals and functions that carry or control traffic |
| 5 | Protection of certain tools enabling monitoring or analysis | Restrict where and by whom monitoring and analysis tools can be accessed; a schedule lists countries relevant to regulations 5(3) and 8(6) |
| 6 | Monitoring and analysis | Log and analyse activity to detect anomalous behaviour and compromise |
| 7 | Supply chain | Identify and reduce risks from third-party suppliers and contract for security; Ofcom issued a clarification on regulation 7(4)(a)(ii) in October 2025 |
| 8 | Prevention of unauthorised access or interference | Control privileged access, credentials and administrative interfaces |
| 9 | Preparing for remediation and recovery | Backups, recovery plans and the ability to rebuild |
| 10 | Governance | Governance arrangements and accountability for security at senior level |
| 11 | Reviews | Regular review of risks and measures |
| 12 | Patches and updates | Timely security patching of equipment and software |
| 13 | Competency | Staff with the skills and training to perform security roles |
| 14 | Testing | Test security, including testing that simulates realistic attacks |
| 15 | Assistance | Share information with and assist other providers where relevant |
The Telecommunications Security Code of Practice
The Code, issued under the codes of practice power the Act added, translates the Regulations into numbered technical measures (identifiers such as M11.36) and sets expected implementation dates per tier. It is guidance rather than law, but Ofcom takes it into account when deciding whether a provider has met its legal duties, so departing from it requires a documented, equally effective alternative.
Designated vendor directions
Sections 15 to 17 of the Act let the Secretary of State issue designation notices naming a high-risk vendor and designated vendor directions restricting how providers use that vendor's goods and services. The Huawei direction came into force on 14 October 2022 and was sent to 35 operators. It bans Huawei managed services (other than specialist maintenance of installed equipment), requires remote access from the UK only with real-time monitoring, requires Huawei staff on site to be accompanied and monitored, and sets dated limits shown in the timeline below.
Timeline and current status
The Act received Royal Assent and came into force in November 2021. Legislation.gov.uk lists no outstanding effects for the Act or the 2022 Regulations as of October 2026. The Code's original timetable was:
| Date | Milestone | Status note (October 2026) |
|---|---|---|
| November 2021 | Telecommunications (Security) Act 2021 in force | In force |
| 1 October 2022 | Security Measures Regulations 2022 in force | In force, no outstanding amendments listed |
| 14 October 2022 | Huawei designated vendor direction in force | In force; Ofcom monitors compliance under a Monitoring Direction |
| 31 March 2024 | Tier 1: most straightforward Code measures | Passed |
| 31 March 2025 | Tier 1: lower-complexity measures; Tier 2: first measures | Passed |
| 31 December 2025 | Huawei: high data rate intra-core and inter-operator transmission removed | Passed |
| 31 March 2027 | Tier 1: more complex, resource-intensive measures | Still shown in commentary on the revised Code; confirm against Code v1.1 |
| 31 December 2027 | Huawei: removed from all parts of 5G networks | Upcoming |
| 31 March 2028 | Tier 1: most complex original measures; first new 2026 measures (M22 series) | Upcoming |
| 31 December 2028 | New M23 series (SIM and eSIM certificate checks, automated vulnerability scanning, automation pipeline validation) | Upcoming |
| 31 December 2029 | New M24 series (API security, service accounts, threat modelling, trusted boot, customer premises equipment monitoring) | Upcoming |
Earlier Huawei milestones were: sites significant to national security by 28 January 2023; risk evaluation of equipment and patches from 14 April 2023; 35% caps on 5G access network sites, traffic and equipment classes by 31 July 2023; a 35% cap on full fibre premises passed by 31 October 2023; and removal from core network functions by 31 December 2023.
The 2026 revision: the Department for Science, Innovation and Technology consulted in autumn 2025, published its response on 1 June 2026 and issued Code version 1.1 on 14 July 2026. According to commentary by Bratby Law, the final Code dropped a proposed monthly equipment restart, softened a proposed intrusion detection requirement for outgoing signalling to guidance, replaced separate third-party supplier definitions with a single "third-party administrator" term and new cloud guidance, and kept the existing timeframes for privileged access workstation measures M11.36 to M11.42. Ofcom separately consulted on updating its section 105Y general statement of policy (12 May to 4 August 2026); responses were published on 1 October 2026 and a final statement was pending at the time of writing. Check the current Code and Ofcom pages before relying on any date.
Enforcement and penalties
- Ofcom's role: Ofcom has a general duty to seek to ensure compliance, publishes a general statement of policy under section 105Y, and can assess compliance, require information, carry out or commission tests, and require providers to explain themselves.
- Information notices: Ofcom monitors 38 large and medium providers (7 Tier 1, 31 Tier 2) through formal information notices, according to commentary on its 2025 security report.
- Incident reporting: providers must report security compromises with a significant effect on the network or service to Ofcom as soon as reasonably practicable, and Ofcom also expects reports of unauthorised access that could enable a later significant compromise ("pre-positioning"). Reports go to [email protected].
- Penalties: up to 10% of relevant turnover for contraventions of the security duties, and up to £100,000 per day for continuing contraventions.
- Vendor directions: the Secretary of State enforces designated vendor directions, can issue urgent enforcement directions, and can use inspection notices (sections 18 to 21 of the Act).
- Civil liability: section 7 of the Act provides for civil proceedings by people affected by certain contraventions.
Ofcom's 2025 report found substantial gaps, according to Bratby Law's summary: about half of Tier 1 providers were not properly applying supply chain measures, and about half were likely to miss identity and access management implementation dates. The published Ofcom fines cited in the same commentary (Vonage, Gigaclear) were under the General Conditions rather than the 2021 Act, so the security penalty regime has not yet produced a widely reported fine.
What it means for AI agents and non-human identities
Telecoms networks are run by machines talking to machines: orchestration platforms, network management systems, SDN controllers, provisioning APIs and, increasingly, AI agents that triage alarms or push configuration. The Regulations' access and monitoring requirements apply to every one of them. The Code does not mention AI agents by name, but its measures land squarely on the identities they use.
| Regulation or Code area | Non-human identity in scope | What to do |
|---|---|---|
| Reg 8 unauthorised access; PAW measures M11.36 to M11.42 | Management plane service accounts, SSH keys, SNMP communities, TACACS+ and RADIUS shared secrets | Inventory, vault, rotate and bind to privileged access workstations or brokered sessions; no shared or default credentials |
| M24 series: service accounts and API security | OSS/BSS API clients, northbound and southbound APIs, OAuth clients | Per-client credentials, scoped tokens, mutual TLS, documented owners |
| M23 series: automation pipeline validation | CI/CD and network automation identities, agent tool credentials | Validate changes before deployment, sign artefacts, restrict pipeline credentials to the targets they change |
| Reg 7 supply chain; third-party administrators | Vendor and MSP remote access accounts | Contract for security, broker and record access, time-bound credentials, UK-only access where a direction requires it |
| Reg 6 monitoring and analysis | Every automated actor | Log machine and agent actions with the identity used, alert on use outside expected paths |
The Salt Typhoon telecom intrusions show why: according to Cisco Talos, the group mostly logged in with legitimate credentials, then harvested SNMP community strings, local account hashes and TACACS+ and RADIUS shared keys from device configurations to move between devices and keep access for years. Those are machine secrets, exactly what regulation 8 and the privileged access measures target. An AI agent that can push configuration is a privileged administrator and should be governed as one: its own identity, least privilege, human approval for high-impact changes and full logging. See the Telecoms Identity Security Guide and the Privileged Access Management Guide.
Compliance steps
- Confirm your tier and scope. Calculate relevant turnover, list the public networks and services you provide, and record whether any micro-entity exemption applies. Get legal confirmation of the position.
- Build a gap analysis against the current Code. Map every Code measure (including the 2026 additions) to an owner, current state, evidence and target date. Treat the Regulations as the legal floor and the Code as Ofcom's expected method.
- Fix the management plane first. Separate management networks, enforce multi-factor authentication for administrators, move privileged sessions onto privileged access workstations or brokered access, and remove default or shared credentials on network elements.
- Inventory machine credentials. Find SNMP strings, SSH keys, API keys, service accounts and automation tokens across network elements, OSS/BSS and pipelines. Assign owners, vault them and set rotation.
- Rework supplier contracts. Add security clauses, right to audit, incident notification and access controls for third-party administrators, and identify any high-risk vendor equipment against designated vendor directions.
- Stand up monitoring and reporting. Centralise logs from network elements and management systems, define thresholds for Ofcom reporting (including pre-positioning), and rehearse the reporting path.
- Test. Run regular security testing, including threat-led testing that simulates realistic attackers, and test recovery from backups of configuration and critical systems.
- Govern and evidence. Brief the board, name accountable individuals, keep a measure-by-measure evidence pack, and prepare for Ofcom information notices. Where you depart from a Code measure, document why the alternative is at least as effective.
Small versus large providers: Tier 1 operators need dedicated programmes and evidence for Ofcom notices. A Tier 3 provider should still cover the same areas, prioritising administrative access, patching, supplier access and backups, with proportionate documentation. Rollback for technical changes such as access brokering should be planned: pilot on a subset of network elements, keep break-glass accounts sealed and monitored, then expand.
Measuring progress
- Percentage of Code measures implemented by due date, per tier milestone.
- Percentage of administrative sessions to network elements through privileged access workstations or a broker.
- Number of shared, default or unrotated machine credentials on network elements (target zero).
- Percentage of third-party administrator accounts that are time-bound and session-recorded.
- Median days to deploy critical security patches to network equipment.
- Time from detection to Ofcom notification for reportable compromises.
Framework mapping
| TSA area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK risk addressed |
|---|---|---|---|
| Supply chain (reg 7) | SR-3, SR-5, SR-6 | GV.SC-05, GV.SC-07 | T1195 Supply Chain Compromise, T1199 Trusted Relationship |
| Unauthorised access (reg 8) | AC-6, AC-17, IA-2, IA-5 | PR.AA-05 | T1078.001 Default Accounts, T1133 External Remote Services |
| Monitoring (reg 6) | AU-6 | DE.CM-01 | Detection of valid account misuse |
| Patches (reg 12) | SI-2, RA-5 | PR.PS-02 | T1190 Exploit Public-Facing Application |
| Reporting to Ofcom | IR-6 | RS.CO-02 | Not applicable |
Common failure patterns
- Treating the Code as optional. It is guidance, but Ofcom measures compliance against it; undocumented deviations are hard to defend.
- Human privileged access fixed, machine access ignored. Administrators get MFA while SNMP communities, TACACS+ keys and automation tokens stay static and shared, the path Salt Typhoon used.
- Supplier access by trust. Vendor engineers and MSPs keep standing remote access without brokering or recording, despite the supply chain regulation.
- Dates tracked from old documents. Teams plan against the 2022 Code timetable without picking up the July 2026 revision.
- Pre-contract testing skipped. Ofcom's 2025 findings, as summarised by Bratby Law, show many providers consider meaningful security testing before contract award impractical, leaving risk to be found in production.
Practitioner checklist
- Confirm tier, scope and any micro-entity exemption, with legal sign-off.
- Obtain Code of Practice version 1.1 and map every measure to an owner and date.
- Separate and harden the management plane; enforce MFA for all administrators.
- Route privileged sessions through privileged access workstations or a session broker.
- Inventory, vault and rotate every machine credential on network elements and automation pipelines.
- Give each AI agent or automation tool its own identity, scoped access and logged actions.
- Add security, audit and access clauses to supplier and MSP contracts; review designated vendor direction exposure.
- Define Ofcom reporting criteria, including pre-positioning, and rehearse the process.
- Run threat-led testing and recovery tests at least annually.
- Keep an evidence pack ready for Ofcom information notices.
Standards and references
- legislation.gov.uk: Telecommunications (Security) Act 2021
- legislation.gov.uk: The Electronic Communications (Security Measures) Regulations 2022
- legislation.gov.uk: Communications Act 2003, section 105A
- UK Government: Huawei Designated Vendor Direction
- Ofcom: Guidance for communications providers and operators of essential services
- Ofcom: Proposals to update our General Statement of Policy under section 105Y
- Bratby Law: Telecommunications Security Code of Practice, the government response and the revised timeline
- Osborne Clarke: Telecoms network and service providers to implement new security measures
This guide summarises the Telecommunications (Security) Act 2021, the 2022 Regulations and the Code of Practice and is not legal advice. Related NHI Mgmt Group resources: Telecoms Identity Security Guide · Telecom Network Security Guide · 5G Security Guide · UK Cyber Security and Resilience Bill Guide · NCSC Cyber Assessment Framework (CAF) Guide