Who, what, when, where, why: On Oct. 27, 2026, the U.S. Department of Energy (DOE) posted a revised interim specification and an updated lab verification protocol for its voluntary Grid‑Interactive Rooftop Unit (RTU) pilot to the public docket, following a 60‑day comment period that closed July 27, 2026. The revision narrows telemetry and control requirements, adds pass/fail thresholds for the lab scenarios, and clarifies cybersecurity and open‑protocol expectations for RTUs and packaged systems from 3 to 25 tons. DOE says the changes are intended to speed utility qualification, enable broader aggregator participation and protect occupant comfort while making retrofit paths clearer for building owners and contractors.

Why this matters now

Standardized telemetry, controls and verification are the gating factors for commercial HVAC to participate at scale in capacity markets and demand response (DR) programs. Since May 2026, two dynamics have intensified the need for a usable protocol: more frequent summer capacity events, and explicit utility procurement language requesting device‑level telemetry and authenticated communications. The Oct. 27 revision is the first specification to pair a pragmatic, retrofit‑friendly telemetry set with lab test cases that utilities and independent verification labs can rely on when awarding payments or capacity credits.

What changed in the Oct. 27 revision

  • Tightened minimum telemetry: DOE retained the prioritized point set from the May 28 draft (instantaneous power, compressor/fan runtime, supply/return temps, compressor stage/inverter frequency, outdoor air temp, standardized fault codes and thermal storage SOC) and added sampling‑rate guidance: 1‑s granularity for power during events, 10‑s for temperature points and 1‑min for runtime counters for reporting purposes.
  • Defined verification thresholds: The revision sets measurable pass/fail thresholds for the 12 lab test cases (two‑hour shed, rapid ramp, multi‑event sequencing). For example, the two‑hour curtailment requires measurable load reduction within 10 minutes and at least 75% persistence of reduction for the event window while median occupant temperature drift must remain ≤1.5°F.
  • Protocol and gateway clarity: DOE now requires at least one open‑protocol implementation (BACnet/SC or BACnet/IP with secure transport, SEP 2.0/IEEE 2030.5, or an OpenADR 2.0b gateway) and formally endorses JSON‑over‑HTTPS cloud wrappers for aggregator integrations to reduce bespoke cloud‑to‑cloud development.
  • Hardened cybersecurity baseline: The update codifies alignment with NIST SP 800‑213 and DOE device security best practices, and explicitly requires certificate lifecycle management (provisioning, rotation and revocation), secure boot and authenticated OTA updates as part of the verification path.
  • Commissioning and reporting templates: DOE added standardized commissioning checklists and a CSV‑formatted reporting template for event logs, fault history and thermal comfort metrics to make utility enrollment audits faster.

Recent field data and lab results

DOE’s field demonstrations, which began enrolling buildings in April 2026, expanded through October. DOE reports enrollment climbed from 120 buildings (June 1) to roughly 480 buildings across six climate zones as of Oct. 15, 2026, including commercial offices, K‑12 schools and retail sites. Aggregated field results published in the public docket show event reductions averaging 12–16% of conditioned load during dispatched events, with median occupant temperature drift between 0.8°F and 1.4°F when controls followed rollback and hysteresis rules.

Independent laboratories named in the docket — including Lawrence Berkeley National Laboratory (LBNL) and Pacific Northwest National Laboratory (PNNL) — completed initial runs of DOE’s lab scenarios in September and October. Interim lab summaries indicate that certified devices meeting the revised telemetry and cybersecurity requirements consistently achieved DOE’s verification thresholds for rapid ramp and two‑hour shed events in controlled conditions. Labs also flagged variability in results for older controller hardware lacking secure OTA paths, underscoring retrofit limitations.

Market reaction and participation

Original equipment manufacturers (OEMs), controls vendors and utilities moved quickly after the revision. Major control platform vendors announced firmware updates and gateway products in October 2026 that map vendor points to DOE’s naming convention and support BACnet/SC and OpenADR 2.0b. Investor‑owned utilities including Pacific Gas & Electric (PG&E), Consolidated Edison (Con Edison) and National Grid (U.S. Northeast) have publicly said they will reference DOE’s verification protocol when updating DR enrollment rules for 2027 solicitations; some utility pilot tariffs already incorporate per‑kW payments conditioned on DOE verification.

Trade associations — notably ASHRAE and the Air‑Conditioning, Heating and Refrigeration Institute (AHRI) — submitted consolidated comments during the summer docket and have begun publishing interoperability test harnesses to streamline vendor validation. State energy offices in California, New York and Massachusetts continue to align incentive language with the DOE protocol, improving the economics of retrofit gateways and secure commissioning.

Implications and actionable steps for contractors, OEMs and owners

The Oct. 27 revision crystallizes readiness tasks for market participation. Contractors and OEMs that act now will be in position for 2027 utility programs:

  • OEMs: Prioritize firmware capable of certificate management, secure boot and OTA updates. Provide a BACnet/SC or SEP 2.0 endpoint or certified OpenADR gateway profile to simplify utility qualification.
  • Controls contractors: Offer gateway provisioning as a service — map points to DOE naming, implement certificate lifecycle plans in service contracts and include scripted rollback procedures and thermal‑comfort logging in commissioning packages.
  • Building owners/operators: Inventory RTU controllers now; identify units that can accept firmware updates or a protocol gateway. Apply for state incentives aligned with DOE verification and negotiate aggregator or utility enrollment terms that reference DOE’s reporting template.

Reactions from stakeholders

DOE described the Oct. 27 revision as a pragmatic balance between interoperability and cybersecurity. Industry groups welcomed standardization but warned that smaller contractors will need support to manage certificate processes. Independent labs recommended clear guidelines for field verification audits to avoid repeated onsite testing. Utilities said the standardized reporting templates will cut enrollment time in half for many program types.

What’s next — timelines and watch points

DOE advised stakeholders it expects to finalize the verification protocol in Q1 2027 after a short post‑revision review and additional lab data submissions. Utilities plan to reference the revised protocol in 2027 capacity and DR solicitations; several have already earmarked pilot budgets for DOE‑verified equipment in upcoming procurements. Contractors should watch state program updates (California CPUC filings, New York PSC guidance, Massachusetts DOER solicitations) and OEM firmware roadmaps through early 2027.

Practical checklist — November 2026 update

  1. Download DOE’s Oct. 27, 2026 revised interim specification and the CSV reporting template from the DOE docket; map your most common OEM controllers to DOE point names and sampling rates.
  2. Prioritize gateways or controller firmware that support BACnet/SC and OpenADR 2.0b; validate cloud‑to‑cloud JSON wrappers where aggregators are involved.
  3. Implement certificate lifecycle services: provisioning, automated rotation and revocation workflows as part of preventive maintenance offerings.
  4. Update commissioning checklists to include DOE lab test equivalents (two‑hour shed, rapid ramp, multi‑event sequencing) and log thermal comfort metrics during field events using DOE’s CSV template.
  5. Engage with local utilities and aggregators now to confirm payment structures (per‑event, capacity payment, or performance‑based) and to enroll eligible assets before 2027 solicitations.

Frequently asked questions

Do building owners need to replace RTUs to comply?

No. DOE’s revised protocol preserves retrofit pathways: many RTUs can comply via firmware updates or an approved gateway. Full replacement is typically only required when control hardware lacks secure update capability or necessary sensors.

How strict are the cybersecurity requirements in practice?

DOE’s revision requires certificate‑based authentication, encrypted telemetry and an OTA firmware path. Practically, that means contractors must offer secure commissioning, certificate provisioning and scheduled rotations as part of standard service agreements.

Will utilities pay more for DOE‑verified RTUs?

Yes — several utilities have signaled preferential compensation in 2027 solicitations for DOE‑verified devices. Payment structures vary by program: expect per‑event fees, capacity payments or performance‑based incentives tied to verified load reduction and proper telemetry reporting.

When will this become the industry norm?

DOE intends to keep verification voluntary, but rapid uptake by utilities and state incentive programs could make the protocol the practical standard in 2027. Watch final DOE action in Q1 2027 and utility procurement rules through mid‑2027.

For HVAC professionals, the Oct. 27 revision turns an interoperability discussion into near‑term technical work: mapping points, securing controllers, and integrating gateways are now tasks that directly unlock program revenues. The next three to six months will determine whether DOE‑verified RTUs move from pilot assets to standard grid resources.