In application
Rail passenger rights: Recast rules on rail passenger rights in application
Travel information, through-tickets and compensation for rail passengers in every Member State.
Transport & Infrastructure
Reliable asset, traffic and passenger data for networks that must keep running.
We work with port companies, bus and rail operators, road and infrastructure bodies, airports and logistics firms. We connect asset, operations and passenger systems, build data platforms for maintenance and open data, give field and control room staff the know-how they need and design IT/OT security with NIS2 in mind.
For port companies, transport operators, infrastructure owners and logistics firms in Ireland, working to EU transport rules and preparing for Ireland’s NIS2 Act.
28 June 2025
Passenger transport services must be accessible
Websites, apps, electronic tickets and real-time information of passenger transport services have to meet the accessibility requirements; in Ireland under S.I. No. 636 of 2023.
17 July 2026
Critical entities designated
Each Member State names its critical entities in transport and other sectors; they then assess their risks and put resilience measures in place.
2 December 2027
High-risk AI rules reach road traffic
AI that acts as a safety component in managing and operating road traffic is high-risk; the date follows the 2026 amendment.
What is shifting for transport operators and infrastructure owners
Capacity is the asset in shortest supply
Rail lines, roads, quays and terminals run near their limits, and works, maintenance windows and timetables all claim the same slots. The revised TEN-T Regulation fixes 2030 for the core network and 2040 for the extended core network, so renewal and day-to-day operation need one plan.
Sharing data is now a duty
The revised ITS Directive and its delegated acts oblige road authorities and transport operators to publish defined data via the National Access Point, in DATEX II, NeTEx, SIRI and similar formats. Open data stops being a project and becomes a service with quality targets.
SourceDirective (EU) 2023/2661
Cyber law has reached operational technology
NIS2 counts air, rail, water and road transport as sectors of high criticality, from port managing bodies and railway undertakings to road traffic management. In Ireland the National Cyber Security Bill is still at General Scheme stage and S.I. No. 360 of 2018 applies until it is enacted. IEC 62443 and the railway specification CLC/TS 50701 give engineers a common approach to zones, conduits and security levels.
SourceDirective (EU) 2022/2555
Ageing structures, retiring experts
Bridges, tunnels, signalling and quay walls from decades ago need more inspection and sharper decisions, just as the engineers who know their history leave. Condition data, inspection reports and drawings belong together, in a form the next crews can search.
Where transport organisations get stuck, and what we build
- The challenge
Design models, GIS, maintenance systems and spreadsheets all keep their own copy of the same asset.
What we doWe connect design, construction and maintenance through open standards like IFC 4.3 and railML and an event backbone. The result is one asset register, and each change to the network is entered a single time.
- The challenge
Inspection reports, photos and defect notes pile up faster than engineers can deal with them.
What we doDocument intelligence reads inspection and survey reports, ties each finding to its asset and drafts a maintenance notification for an engineer to approve, with the source page linked.
- The challenge
Passengers want correct information across operators, and EU law now asks for open data as well.
What we doOne platform brings together timetables, live vehicle positions and disruption data, sends NeTEx, SIRI or DATEX II feeds to the National Access Point and watches whether each feed is complete and current.
- The challenge
Each new data flow out of signalling, tunnel, port or traffic control systems gives attackers another way in.
What we doArchitectures that split IT and OT into zones and conduits as IEC 62443 and CLC/TS 50701 describe, send data one way only where the risk requires it, centralise identity and keep the logs you need to report incidents under NIS2.
- The challenge
Field crews and control room staff look for procedures, drawings and work history in several systems.
What we doA knowledge assistant across procedures, asset records, inspection reports and earlier work orders that names the document and revision. It informs people; it never sets a route, grants a movement authority or alters a traffic control setting.
- The challenge
Phone lines overflow during disruption, engineering works and timetable changes.
What we doService assistance that answers questions on disruption, journeys and refunds from the source systems and hands complaints and special cases to staff, in the languages your passengers use.
Reference landscape for transport IT and OT
The control levels stay as they are. Above the zone boundary, an integration layer based on events and open standards makes operational data available to asset, analytics, knowledge and open data services.
Illustrative example
Operational data passes the zone boundary a single time, via the integration layer, and every service above it reuses it.
Read the diagram as text
The diagram stacks five levels. At the top, level 4 holds the business systems: ERP, asset management, ticketing and customer systems. Below it, level 3 covers operations, from traffic management and timetable and capacity planning to port and airport operations. Level 2 is supervision, with interlocking control and SCADA for tunnels and roads. Level 1 is the equipment in the field, such as signals, point machines, axle counters, sensors and message signs. Level 0, at the bottom, is the physical network of track, roads, bridges, tunnels, quays and locks.
Between level 4 and the levels underneath runs a zone boundary designed to IEC 62443 and CLC/TS 50701.
Data from levels 1 to 4 goes into an integration layer based on events and open standards. From there a platform holds asset, traffic and passenger data and serves three uses: analytics on condition, capacity and punctuality; a knowledge assistant for people in the field and in the control room; and open data feeds together with regulatory reporting.
Operations keep control
Analytics and assistants are read-only. The traffic management system, the interlocking and the operator on shift keep route setting, movement authorities and traffic control.
Zones and conduits
Segmentation follows IEC 62443 and CLC/TS 50701. Conduits are documented, and data leaves the control zone one way only where the risk warrants it.
A single asset register
IFC 4.3 and railML give design, construction and maintenance the same language, so a change to the network is captured once and used wherever it is needed.
Open data built in
Feeds for the National Access Point come from the platform that also serves internal reporting, and are checked for completeness and delay before publication.
Key dates for transport and infrastructure
Rules on accessibility, data sharing, cybersecurity and resilience follow one another closely, and rail, freight and maritime law add dates of their own.
In application
TEN-T: Revised TEN-T Regulation in force
Deadlines: the core network by the end of 2030, the extended core by the end of 2040, the comprehensive network by the end of 2050.
In application
NIS2: EU deadline for national NIS2 laws
Air, rail, water and road transport are covered. Ireland’s National Cyber Security Bill had not been enacted by autumn 2026.
In application
European Accessibility Act: Accessibility requirements in application
Websites, apps, e-tickets and real-time travel information of passenger services among them; in Ireland under S.I. No. 636 of 2023.
In application
EMSWe: European Maritime Single Window environment in application
Reporting for port calls through harmonised national single windows.
In application
ITS Directive: First deadlines for road data at the National Access Point
Traffic rules, roadworks and safety-related events on the TEN-T core network, with more of the network and more data types to follow up to 2028.
In application
Rail telematics TSI: Telematics TSI in force
A single TSI for passenger and freight telematics takes over from TAP and TAF, applied in stages up to the 2030 working timetable.
In application
CER Directive: Critical entities identified by each Member State
Those entities then assess their risks and take resilience measures.
Position at 15 October 2026
Upcoming
eFTI: Electronic freight information accepted by authorities
Competent authorities have to accept regulatory freight information supplied through certified eFTI platforms.
Upcoming
AI Act: Duties for high-risk AI in application
This covers AI used as a safety component in managing and operating road traffic, following the 2026 amendment.
Upcoming
Rail capacity regulation: Digital tools for capacity and traffic management
Rules on exchanging traffic management information and on digital capacity tools take effect; the new capacity process starts with the 2031 working timetable.
Rules and standards at a glance
The legal texts that most often shape data, integration and AI work for transport operators and infrastructure owners, and what each one changes for your programme.
Use this overview to prepare planning discussions; it is not legal or regulatory advice, and Irish law and sector legislation add requirements of their own. Dates checked on 15 October 2026.
- NIS2 for transportScopeEU-wide
NIS2 classes transport as highly critical. That takes in, for rail, the companies that manage infrastructure and those that run trains; for air, airlines, airport operators and air traffic control; for shipping, port managing bodies, shipping companies and vessel traffic services; and for roads, the authorities that control traffic and the operators of intelligent transport systems. Each must manage risk, report incidents and secure its supply chain. As of autumn 2026 Ireland applies S.I. No. 360 of 2018 while the National Cyber Security Bill is being drafted, and the National Cyber Security Centre is the planned lead authority.
What changes for your programmeOT security, supplier assurance and incident handling need evidence as well as policy. Our platforms and integrations come with access control, logging and incident data from day one.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- ITS Directive and National Access PointsScopeEU-wide
The ITS Directive (2010/40/EU), revised in 2023 by Directive (EU) 2023/2661, frames intelligent transport systems in the EU. Delegated regulations under it say which road, traffic and travel data each country must publish through its National Access Point, in which standard formats, and by which deadlines as coverage grows.
What changes for your programmeData that was once shared on request must now be available, up to date and machine-readable. We build the pipelines, format conversion and quality monitoring that make that possible.
SourceDirective (EU) 2023/2661, EUR-Lex (opens external site)
- Multimodal travel informationScopeEU-wide
Delegated Regulation (EU) 2017/1926, as changed by Delegated Regulation (EU) 2024/490, says which static and dynamic data authorities and operators of every mode publish via the National Access Point. Timetables and networks go out in NeTEx, live information in SIRI. Disruption and real-time status data are required from 1 December 2025 on the comprehensive TEN-T network, and from 1 December 2028 everywhere else.
What changes for your programmeTimetables, stops, accessibility details and live data need a single consistent source. We link planning and operations systems to NeTEx and SIRI feeds and check the feeds before they go out.
SourceDelegated Regulation (EU) 2017/1926, EUR-Lex (opens external site)
- European Accessibility Act for passenger transportScopeEU-wide
Air, bus, rail and waterborne passenger services have had accessibility duties since 28 June 2025, covering their websites, mobile apps, e-tickets, ticket sales and live travel information. Ireland transposed the Act through S.I. No. 636 of 2023.
What changes for your programmeJourney planners, ticket sales and disruption notices all fall within it. We design and test them to WCAG 2.2 AA and keep your accessibility statement accurate.
SourceDirective (EU) 2019/882, EUR-Lex (opens external site)
- Rail passenger rightsScopeEU-wide
Since 7 June 2023, Regulation (EU) 2021/782 has required railway undertakings and ticket vendors to keep passengers informed before and during a trip, with real-time data where available, and to organise assistance, re-routing and compensation within set deadlines. The companies managing the infrastructure supply live arrival and departure data to operators, vendors and station managers.
What changes for your programmeDisruption notices and compensation claims are processes that run on data. We connect operations, ticketing and customer service so passengers hear the same answer everywhere and claims are settled in time.
SourceRegulation (EU) 2021/782, EUR-Lex (opens external site)
- Rail telematics and capacityScopeEU-wide
The telematics TSI, Implementing Regulation (EU) 2026/253, merges the former passenger (TAP) and freight (TAF) specifications into one, comes in over several stages and opens timetable data at no cost through the National Access Points. From the end of 2027, Regulation (EU) 2026/1184 on rail capacity adds rules on planning capacity digitally and sharing traffic management information.
What changes for your programmeData on timetables, paths and train running moves to shared message formats and tools. We link planning, operations and customer systems to them without touching the systems that run the trains.
SourceImplementing Regulation (EU) 2026/253, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU-wide
Under the CER Directive, transport is one of the sectors whose critical entities must be physically and organisationally resilient. Each Member State was due to name those entities by 17 July 2026; the entities then look at their risks and take technical, security and organisational steps.
What changes for your programmeContinuity plans have to cover cyber incidents and physical events alike. Every system we deliver comes with documented dependencies and recovery routes that have been tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and transportScopeEU-wide
Annex III treats AI meant as a safety component in managing and operating road traffic as high-risk, and following the 2026 amendment those duties start on 2 December 2027. For rail interoperability, marine equipment, vehicles and drones, the requirements arrive through the sector laws in Annex I, Section B, as their delegated and implementing acts are updated. In Ireland the AI Office of Ireland coordinates supervision under the Regulation of Artificial Intelligence Act 2026.
What changes for your programmeEach use case is classified at the outset. Assistants and analytics that inform staff are built and documented differently from systems that act on traffic, and those stay out of scope unless you plan for the high-risk regime.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Example use cases (illustrative)
Illustrative exampleQuay and bridge inspections into the asset register
Inspection reports for a port company’s quay walls, bridges and pavements are read, each finding linked to its asset and offered as a maintenance notification for an engineer to approve.
Procedures and asset history for field crews
Crews get the procedure, the asset history and the right drawings, each with its source. Operating decisions stay with the control room.
Disruption questions for a bus operator
Passengers get live status, alternative routes and their refund options from the source systems; staff deal with complaints and requests for assistance.
Freight and customs paperwork at a logistics firm
Transport documents, permits and certificates are read and checked for gaps before a planner looks at the exceptions.
An ageing planning system replaced behind APIs
An older timetable, possession or maintenance planning system is wrapped in documented APIs and replaced one function at a time while services keep running.
Platforms we use in transport and infrastructure
SAP
Gold PartnerSAP S/4HANA asset management, with linear asset management for track, roads and pipelines, and maintenance planning, purchasing and finance in a single system.
Salesforce
Summit PartnerCustomer service, accounts for passengers and freight customers, and field service, linked to ticketing, operations and asset systems.
Odoo
Gold PartnerProjects, field service, stock and invoicing for contractors, terminal operators and smaller haulage and transport companies.
The partner levels shown are FromNine’s own. Product names belong to their owners as trademarks.
Ireland
EU transport rules, Irish cyber law in progress
Most transport rules are European: TEN-T, the ITS Directive, rail interoperability, passenger rights and NIS2 apply across the EU, while National Access Points, data profiles and cybersecurity law are national. In Ireland NIS2 is not yet transposed: the General Scheme of the National Cyber Security Bill was published in August 2024, S.I. No. 360 of 2018 remains in force, and the National Cyber Security Centre is the planned lead authority. Accessibility of passenger services already follows S.I. No. 636 of 2023.
Our platforms rest on European standards (IFC, railML, NeTEx, SIRI, DATEX II), while each national profile and report lives in its own adapter. An Irish port, operator or logistics firm with links into other Member States therefore keeps a single architecture.
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- National Cyber Security BillNational Cyber Security Bill 2024 (General Scheme published August 2024) to transpose NIS2; not enacted (opens external site)
- Irish NIS regulations (S.I. 360/2018)S.I. No. 360 of 2018 (NIS1), in force until the National Cyber Security Bill is enacted (opens external site)
- European Accessibility ActEuropean Accessibility Act, Directive (EU) 2019/882 (opens external site)
- Irish accessibility regulations (EAA)European Union (Accessibility Requirements of Products and Services) Regulations 2023, enforced by the CCPC, ComReg and Coimisiún na Meán (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
Questions we are often asked
Does your software control trains, buses, traffic or vessels?
No. Our analytics and assistants read operational data and nothing more, unless you decide otherwise. Signalling, route setting, movement authorities and traffic control stay with the systems and people accountable for them, under your change control.
Do you write safety-related signalling or control software?
We do not. Software that must be certified to the CENELEC railway safety standards, or to similar safety regimes, is outside what we develop. We connect to such systems through defined and documented interfaces, mostly read-only, and keep our own components outside their safety case.
What data standards do you use?
For infrastructure and asset data, IFC 4.3 and railML; for public transport timetables and live information, NeTEx and SIRI; for road traffic data, DATEX II. Systems that use their own formats are mapped to these standards in the integration layer.
Could you run our publication to the National Access Point?
We build and operate the pipelines, the format conversion and the quality checks behind it. What you publish, and the responsibility for it, remains yours.
How do you help a transport operator with NIS2 while the Irish Act is pending?
Our information security management system holds ISO/IEC 27001 certification. Security requirements and incident notification go into the contract, our access to your systems is least-privilege and logged, and our components are documented for your supply-chain risk assessment. That serves your duties under S.I. No. 360 of 2018 today and under the National Cyber Security Bill once it becomes law.
Must we replace our asset or planning systems?
No. We integrate first and modernise step by step: APIs around the current system, then one function at a time where the case holds up, with reconciliation running until the old route is closed.
Talk through your transport or infrastructure programme
Want to join up asset and inspection data, publish open data to the National Access Point or secure data flows between IT and OT? Pick one route, one asset class or one data flow to start.