Customers who pay via direct debit often receive bills based on estimated meter readings.
When an actual reading is taken, the company "back-bills" the customer for any shortfall between payments and the energy used.
Citizens Advice says that the bills hit thousands of pounds in some cases.
Its research last year showed that as many as 2.1 million consumers a year receive some sort of catch up bill, at an average of Â£206.
In 2007, energy suppliers signed a voluntary commitment promising not to back-bill domestic customers for energy used more than 12 months previously, if the supplier was at fault.
The expansion of the market has led to concerns that some are not keeping to this agreement, and regulator Ofgem wants to write it into the rules by the winter.
"We expect suppliers to put their customers first, which is why we are proposing a new enforceable rule to provide this protection," said Rachel Fletcher, senior partner at Ofgem.
Gillian Guy, chief executive of Citizens Advice, said: "Shock gas and electricity bills can throw people's finances into disarray.
"We helped one person who received a bill for over Â£3,000 after their energy company stopped taking their direct debit payment but didn't tell the customer. The firm refused to apply the 12 month back-bill limit, leaving the customer to pay the full bill.
"We've long been calling on the regulator to introduce a mandatory time limit for back bills instead of relying on voluntary action, which suppliers have refused to apply in some cases."
The regulator is planning to reduce the back bill time limit when more accurate smart meters become the norm in homes. Citizens Advice is calling for this deadline to be reduced to three months.
Energy firms will be banned from charging catch-up bills for gas and electricity used more than 12 months earlier, under the regulator's plans.