In application
REMIT: Revised rules on wholesale market integrity in force
Inside information platforms, notification of algorithmic trading and wider powers for ACER.
Energy & Utilities
Meter, asset and network data your teams can use.
We work with energy suppliers, renewable developers, utilities and network businesses. We integrate systems on a shared data model, build platforms for meter and flexibility data, give field crews the know-how they need and design IT/OT security for NIS2 and the EU network code on cybersecurity.
For energy suppliers, renewable developers and utilities in Ireland that work to EU market rules and wait on Ireland’s NIS2 legislation.
13 June 2024
EU network code on cybersecurity in force
Sector rules for companies whose activities affect electricity flows between countries.
SourceDelegated Regulation (EU) 2024/1366 (opens external site)
17 July 2026
Critical entities designated
Each Member State names its critical entities in energy and other sectors; they then assess their risks and put resilience measures in place.
2 December 2027
High-risk AI rules reach critical infrastructure
AI that serves as a safety component in supplying electricity, gas or heat is high-risk; the date follows the 2026 amendment.
What is shifting for the energy sector
New connections arrive faster than new capacity
Wind, solar, batteries, heat pumps and charge points all want network capacity sooner than new lines and substations can be built. The 2024 reform of the EU electricity market brings national assessments of flexibility needs, flexible connection agreements and an obligation on system operators to publish how much capacity is free for new connections.
Flexibility is something you can sell
Network operators are expected to buy flexibility from aggregators, storage and demand response before building more network. For suppliers and developers that only works with dependable meter data, good forecasts and clean data exchange between all parties.
SourceDirective (EU) 2019/944
Cyber law now reaches operational technology
NIS2 puts energy among the sectors of high criticality, covering producers, suppliers and network operators alike. In Ireland the directive is not yet law: the National Cyber Security Bill is at General Scheme stage, S.I. No. 360 of 2018 still applies, and the National Cyber Security Centre has published draft guidance. The EU network code on cybersecurity adds rules for electricity flows between countries, and IEC 62443 gives engineers shared terms for zones and conduits.
SourceDirective (EU) 2022/2555
Ageing assets, retiring experts
A lot of energy infrastructure is decades old, and the people who know its oddities are leaving. Good asset decisions need condition data, maintenance records and that experience together, in a form the next crews can search.
Where energy companies get stuck, and what we build
- The challenge
GIS, SCADA, asset management and billing each hold their own picture of the assets.
What we doIntegration on the IEC Common Information Model (IEC 61970 and IEC 61968) and an event backbone, so planning, operations and market processes work from one model instead of overnight file exports.
- The challenge
Renewable and storage projects wait while nobody can see where capacity is free.
What we doA data product that brings together meter data, SCADA readings and the pipeline of connection requests into load and congestion forecasts per area, stating the accuracy and the assumptions behind each figure.
- The challenge
Smart meter data comes in at volumes, and under access rules, that older systems cannot handle.
What we doA meter data platform that checks, stores and serves interval data, with consent management, role-based access and logs for suppliers, aggregators and customers, in line with the GDPR and the national rules on access to metering data.
- The challenge
Each new data flow from OT to IT opens another door to attackers.
What we doIT/OT architectures with zones and conduits along IEC 62443, one-way data paths through a broker where the risk demands it, central identity, and the logs that incident reporting under NIS2 relies on.
- The challenge
Field crews look for drawings, procedures and work history in several places.
What we doA knowledge assistant for crews and operations staff across procedures, asset records, inspection reports and earlier work orders, naming the document and revision. It informs people and never gives an operating instruction.
- The challenge
Phone lines overflow when prices change, during outages and at connection peaks.
What we doService assistance that answers questions on bills, tariffs and outages from the source systems and passes anything with consequences to staff, together with document intelligence that checks applications and installer certificates before an engineer sees them.
Reference landscape for energy IT and OT
The control levels are left untouched. An integration layer built on CIM and events lifts operational data above the zone boundary, where analytics, knowledge and reporting services work with it.
Illustrative example
Operational data passes the zone boundary a single time, via the integration layer, and every service above it reuses it.
Read the diagram as text
Five levels are stacked from top to bottom. Level 4 is the enterprise: ERP, asset management, customer and billing systems. Level 3 is network operations: ADMS or EMS, outage and work management and the meter head-end. Level 2 is supervisory control: SCADA and substation automation based on IEC 61850. Level 1 is control and protection: RTUs, IEDs and relays. Level 0 is the primary equipment: lines, transformers, switchgear, generation and storage.
Between level 4 and the levels underneath runs a zone boundary designed to IEC 62443.
Levels 1 to 4 pass their data to an integration layer built on CIM and events. That layer feeds a platform for network, meter and asset data, which in turn serves analytics on congestion, load and asset condition, a knowledge assistant for crews and operations staff, and regulatory reporting and market data exchange.
Operators keep control
Analytics and assistants only read. Switching, setpoints and protection settings remain with the ADMS or EMS and the operator on shift.
Zones and conduits
The network is segmented along IEC 62443, with documented conduits and, where the risk justifies it, one-way transfer of data out of the control zone.
A single network model
CIM gives GIS, operations, planning and market processes the same language, so a change to the network is captured only once.
Forecasts that show their error
Models for load, congestion and asset condition report how far off they can be. If the data cannot carry a forecast, we tell you.
Key dates for energy companies
Rules on cybersecurity, market design and resilience follow one another closely. Network codes and Irish legislation add dates of their own.
In application
Network code on cybersecurity: Network code in force
Cycles of risk assessment and the identification of high-impact and critical-impact entities come in stages.
In application
Electricity market design: Market reform in force
Assessments of flexibility needs, flexible connection agreements, energy sharing and a choice of contract for customers.
In application
NIS2: EU deadline for national NIS2 laws
Electricity, gas, hydrogen, oil and district heating are covered. Ireland’s National Cyber Security Bill had not been enacted by autumn 2026.
In application
Electricity market design: Deadline to transpose most provisions of the Directive
In application
Demand response: ACER puts forward a network code on demand response
Access to the market for smaller providers of flexibility and tighter coordination between distribution and transmission operators. The Commission still has to adopt it.
In application
Metering data access: Member States report their practice on metering data access
Each country explains how its procedures fit the EU reference model.
In application
European Grids Package: European Grids Package presented by the Commission
Proposals on planning and permitting infrastructure, with guidance on connecting to the grid on time.
In application
CER Directive: Critical entities identified by each Member State
Those entities then assess their risks and take resilience measures.
In application
Hydrogen and gas package: Deadline to transpose most of the gas Directive
Shared rules for the internal markets in renewable gas, natural gas and hydrogen.
Position at 12 October 2026
Upcoming
AI Act: Duties for high-risk AI in application
This covers AI used as a safety component in supplying electricity, gas or heat, following the 2026 amendment.
Rules and standards at a glance
The legal texts that most often shape data, integration and AI work in energy, and what each one changes for your programme.
Use this overview to prepare planning discussions; it is not legal or regulatory advice, and Irish law and the network codes add requirements of their own. Dates checked on 12 October 2026.
- NIS2 for energyScopeEU-wide
Energy is a sector of high criticality. In electricity it takes in suppliers, distribution and transmission system operators, producers, nominated electricity market operators, market participants that aggregate, offer demand response or store energy, and operators of charging points; district heating, oil, gas and hydrogen are covered too. The duties are risk management, incident reporting and supply-chain security. As of autumn 2026 Ireland still applies S.I. No. 360 of 2018 while the National Cyber Security Bill is being drafted, with the National Cyber Security Centre as planned lead authority.
What changes for your programmeOT security, supplier assurance and incident handling need evidence as well as policy. Our platforms and integrations come with access control, logging and incident data from day one.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- Network code on cybersecurityScopeEU-wide
Delegated Regulation (EU) 2024/1366 lays down sector rules for the cybersecurity side of electricity flows across borders. It sets up regular risk assessments at EU, regional and national level, identifies entities of high impact and critical impact, and requires them to apply minimum and advanced controls, their supply chain included.
What changes for your programmeFor an entity of high or critical impact, every product and service it buys feeds into its risk assessment. We document architecture, components and controls so they slot straight into it.
SourceDelegated Regulation (EU) 2024/1366, EUR-Lex (opens external site)
- Electricity market design reformScopeEU-wide
Regulation (EU) 2024/1747 and Directive (EU) 2024/1711 change the rules of the electricity market. Each country assesses its flexibility needs using data from system operators; those operators may offer flexible connection agreements and must publish free connection capacity in fine geographic detail. Customers get rights to share energy and to choose fixed-price or dynamic contracts.
What changes for your programmeFlexibility, connection capacity and tariff choice all run on data. We build the forecasting, publication and settlement flows that sit behind them.
SourceRegulation (EU) 2024/1747, EUR-Lex (opens external site)
- Smart metering and data accessScopeEU-wide
The Electricity Directive lists functional requirements for smart metering and asks for efficient, secure data management with fair access to metering and consumption data. Implementing Regulation (EU) 2023/1162 adds interoperability requirements and procedures for that access, which each Member State sets out in its national practice.
What changes for your programmeA meter data platform needs consent handling, standard interfaces and access logs. We design it around the national procedure for data access.
SourceDirective (EU) 2019/944, EUR-Lex (opens external site)
- REMITScopeEU-wide
This regulation on the integrity and transparency of wholesale energy markets bans market manipulation and insider trading, and obliges market participants to publish inside information and report their transactions to ACER. Since the 2024 amendment, disclosure goes through inside information platforms, algorithmic trading must be notified and ACER can investigate with more power.
What changes for your programmeData on unavailability and capacity held in operational systems may be inside information. We design the data flows so publication and reporting happen on time and can be traced.
SourceRegulation (EU) No 1227/2011, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU-wide
The CER Directive deals with the physical and organisational resilience of critical entities, and energy is one of its sectors. Member States had to identify those entities by 17 July 2026, after which the entities assess their risks and take technical, security and organisational measures.
What changes for your programmeContinuity plans have to cover cyber incidents and physical events alike. Every system we deliver comes with documented dependencies and recovery routes that have been tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and critical infrastructureScopeEU-wide
Annex III treats AI meant as a safety component in managing and operating the supply of water, gas, heat or electricity as high-risk. Following the 2026 amendment, those duties start on 2 December 2027. In Ireland, S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, makes the AI Office of Ireland the central coordinating authority.
What changes for your programmeEach use case is classified at the outset. Assistants and analytics that inform staff are built and documented differently from systems that act on physical assets, and those stay out of scope unless you plan for the high-risk regime.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Example use cases (illustrative)
Illustrative exampleMaintenance know-how at wind and solar sites
Technicians of a renewable developer get the procedure, the turbine or inverter history and the right drawings, with sources. Operating decisions stay with the people in charge of the site.
Commissioning documents for an energy services company
Installation files, single-line diagrams and installer certificates read and checked for gaps; an engineer reviews each exception.
Bill and price questions at an energy supplier
Customers get answers on their bill, tariff and any outage from the source systems; staff step in for complaints and for customers in payment difficulty.
A supplier’s billing system replaced behind APIs
An ageing customer information system is wrapped in documented APIs and replaced process by process, while market messages keep flowing as before.
Inspection reports into asset records
Blade, inspection and thermography reports are read, linked to the right asset and turned into proposed maintenance notifications that an engineer confirms.
Platforms we use in energy and utilities
SAP
Gold PartnerSAP S/4HANA Utilities for meter-to-cash and market roles such as supplier and meter operator, and SAP asset management for plants and networks.
Salesforce
Summit PartnerCustomer service, connection and installation requests and field service for suppliers and energy service companies, linked to billing and the customer information system.
Odoo
Gold PartnerProjects, field service, stock and invoicing for installers, energy service companies and smaller renewable producers.
The partner levels shown are FromNine’s own. Product names belong to their owners as trademarks.
Ireland
EU energy rules, Irish cyber law in progress
Much of the energy rulebook is European: network codes, the market design reform, NIS2 and REMIT apply across the EU, while access to metering data, market messaging, tariffs and cybersecurity law are set nationally. In Ireland that last piece is still moving. The General Scheme of the National Cyber Security Bill was published in August 2024, S.I. No. 360 of 2018 stays in force until the new Act, and the National Cyber Security Centre is the planned lead authority, with draft guidance on risk-management measures already out.
We build integration and data platforms on European standards such as CIM and keep national market processes in separate adapters, so a supplier or developer can follow Irish rules without a second architecture.
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- National Cyber Security BillNational Cyber Security Bill 2024 (General Scheme published August 2024) to transpose NIS2; not enacted (opens external site)
- Irish NIS regulations (S.I. 360/2018)S.I. No. 360 of 2018 (NIS1), in force until the National Cyber Security Bill is enacted (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
Questions we are often asked
Does your software take control of plant or network equipment?
No. As standard, analytics and assistants only read operational data. Switching, setpoints and protection settings remain with the ADMS or EMS and the operators who answer for them, under your own change control.
Do you use the Common Information Model?
We do: IEC 61970 and IEC 61968 for network and asset data, IEC 62325 where market communication comes in, and the ENTSO-E CGMES profiles when network models are exchanged between transmission system operators. Systems with their own formats are mapped to CIM in the integration layer.
How do you protect smart meter data?
Interval data can show how a household lives, so we handle it as personal data under the GDPR, which the Data Protection Commission supervises in Ireland: purpose limitation, access by role, consent where the national rules ask for it, pseudonymisation for analysis and fixed retention periods. Suppliers and aggregators get access through the national procedure for metering data.
Can you predict congestion or equipment failures?
In some cases. That depends on how well the network is measured, how much history exists and how it is operated. We test first, show measured accuracy and uncertainty, and propose rule-based methods where a model would not be dependable.
How do you help an essential entity with NIS2 while the Irish Act is pending?
Our information security management system holds ISO/IEC 27001 certification. Security requirements and incident notification go into the contract, our access to your systems is least-privilege and logged, and our components are documented for your supply-chain risk assessment. That serves your duties under S.I. No. 360 of 2018 now and under the National Cyber Security Bill once it is enacted.
Must we replace our billing or customer information system?
No. We integrate first and modernise step by step: APIs around the current system, then one process at a time where the case holds up, with reconciliation running until the old route is closed.
Talk through your energy programme
Bringing meter data together, getting ready for new data access rules or securing data flows between IT and OT? Start with one site, one process or one data flow.