Cybersecurity Is Now A Contract Risk: What India's New Power-Sector Regulations Mean For Technology Vendors

For most technology vendors, cybersecurity has been a promise made to a customer, set out in a statement of work and enforced, if at all, through the contract. For vendors supplying India's power sector, that is changing. The Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, notified on 31 July 2026 under the Electricity Act, 2003, impose obligations directly on vendors, alongside a far more demanding set of requirements for the power-sector entities they serve. Most of these provisions come into force on 1 April 2027.

The short answer to what this means for vendors is that cybersecurity is no longer only a matter of what they agree with their customers. Vendors now owe certain duties under the regulations themselves, i.e., to provide recovery procedures, to make validated security patches available for the longer of the contract period or the useful life of the system, and to maintain a process for reporting vulnerabilities, which must be shared with