In application
REMIT: Revised wholesale market integrity rules in force
Inside information platforms, notification of algorithmic trading and wider ACER powers.
Energy & Utilities
Energy data your operations team can actually use.
For energy operators, energy service firms, renewable installers and producers in Malta we connect systems on a shared network data model, build platforms for meter and flexibility data, give field crews the knowledge they need on site and design IT/OT security around the NIS2 Order and the EU cybersecurity network code.
For energy operators, energy service firms, renewable installers and producers in Malta that answer to EU energy rules and to the NIS2 Order at the same time.
13 June 2024
Cybersecurity network code in force
Rules for the sector, aimed at entities whose activities affect electricity flows between countries.
SourceDelegated Regulation (EU) 2024/1366 (opens external site)
17 July 2026
Deadline to name critical entities
Each Member State, Malta included, lists its critical entities in energy and other sectors; those entities must then assess risk and act on resilience.
2 December 2027
High-risk AI in energy supply
AI acting as a safety component in electricity, gas or heat supply counts as high-risk, on the timetable amended in 2026.
What is shifting in Malta’s energy sector
Demand for connections outruns the grid
Rooftop solar, heat pumps, batteries and charging points all want grid capacity, and they want it before new cables and substations exist. Since the 2024 market reform, flexibility needs are assessed nationally, flexible connection agreements are possible and system operators have to show publicly what capacity remains for newcomers.
Flexibility turns into something you can buy
Distribution operators are expected to buy flexibility from aggregators, storage and demand response before they reinforce the network. None of that works without dependable meter data, forecasts and data exchange between operators, suppliers and aggregators.
SourceDirective (EU) 2019/944
Operational technology now falls under cyber law
NIS2 places energy among the highly critical sectors, from producers and suppliers to system operators, and in Malta it applies through the NIS2 Order with the CIP Department as competent authority. The cybersecurity network code adds rules for cross-border electricity flows, and IEC 62443 gives engineers a common way to talk about zones and conduits.
SourceDirective (EU) 2022/2555
Ageing assets, retiring experts
A large part of today’s network dates back decades, and the engineers who understand its peculiarities are leaving. Decisions on assets need condition data, maintenance records and that experience gathered in one searchable place for the crews who follow.
Where energy teams get stuck, and what we build
- The challenge
GIS, SCADA, asset management and billing each hold their own picture of the network.
Our responseOur integrations use the IEC Common Information Model (IEC 61970 and IEC 61968) plus an event backbone, which lets planning, operations and market processes rely on the same network model instead of files swapped overnight.
- The challenge
Requests for new connections queue up because nobody knows where spare capacity remains.
Our responseA data product that combines meter readings, SCADA measurements and pending connections into load and congestion forecasts for each grid area, stating its accuracy and the assumptions behind each figure it publishes.
- The challenge
Smart meter data comes in volumes, and under access rules, that older systems never anticipated.
Our responseA meter data platform that validates, stores and serves interval readings, with consent management, role-based access and logs for suppliers, aggregators, customers and the operator, in line with the GDPR as supervised by the IDPC and the applicable data access rules.
- The challenge
Each extra data flow from OT to IT gives attackers another way in.
Our responseIT/OT architectures built on IEC 62443 zones and conduits, one-way brokered data paths where the risk justifies them, central identity and the logs on which incident reporting under the NIS2 Order relies.
- The challenge
Crews look for drawings, procedures and job history in several systems.
Our responseAn assistant for field crews and control room staff that searches procedures, asset records, inspection reports and earlier work orders and names the document and revision. It advises; it never gives a switching instruction.
- The challenge
Phone lines are swamped during outages, tariff changes and connection rushes.
Our responseService assistance that answers questions on outages, connections and bills from the source systems and passes anything consequential to staff, together with document intelligence that checks connection applications and installer certificates before an engineer sees them.
A reference landscape for energy IT and OT
Control levels stay as they are. Above the zone boundary, an integration layer based on CIM and events offers operational data to analytics, knowledge and reporting services.
Illustrative example
Operational data passes the zone boundary a single time, through the integration layer, and every service above reuses it.
Read the diagram as text
Five stacked layers make up the picture. Layer 4, the top, is enterprise IT: ERP, asset management, customer and billing. Layer 3 is network operations with ADMS or EMS, outage and work management and the meter head-end. Layer 2 is supervision via SCADA and IEC 61850 substation automation. Layer 1 is control and protection through RTUs, IEDs and relays. Layer 0, the bottom, is the physical plant: lines, transformers, switchgear, generation and storage.
An IEC 62443 zone boundary sits between layer 4 and everything beneath it.
Layers 1 to 4 pass their data into an integration layer based on CIM and events. From there an energy, meter and asset data platform is fed, and three services draw on it: analytics for congestion, load and asset condition; an assistant for crews and control room staff; and regulatory reporting with market data exchange.
Operators keep control
Analytics and assistants only read. Switching, setpoints and protection settings remain with the ADMS or EMS and the operator on shift.
Zones and conduits
Network segmentation follows IEC 62443, with documented conduits and one-way transfer out of the control zone where the risk warrants it.
A single network model
CIM gives GIS, operations, planning and market processes one vocabulary, so a change in the network is recorded only once.
Forecasts that state their error
Models for load, congestion and asset condition report how far off they are, and where the data cannot carry a forecast we tell you so.
Key dates for energy operators
Rules on cybersecurity, market design and resilience follow one another closely, and network codes and national measures set further dates.
In application
Network code on cybersecurity: Network code takes effect
Risk assessment cycles and the naming of high-impact and critical-impact entities follow step by step.
In application
Electricity market design: Market reform takes effect
Assessments of flexibility needs, flexible connection agreements, energy sharing and contract choice for customers.
In application
NIS2: Transposition deadline
Electricity, gas, hydrogen, oil and district heating are covered; Malta’s NIS2 Order has applied since 23 January 2026.
In application
Electricity market design: Deadline for transposing most of the Directive
In application
Demand response: ACER proposes a demand response network code
Easier market access for small flexibility providers and better coordination between distribution and transmission operators; the Commission has still to adopt it.
In application
Metering data access: National practices on meter data access reported
Each Member State explains how its procedures fit the EU reference model.
In application
European Grids Package: European Grids Package presented
Commission proposals on planning and permitting of infrastructure, with guidance on connecting to the grid on time.
In application
CER Directive: Critical entities named
Those named then assess their risks and put resilience measures in place.
In application
Hydrogen and gas package: Deadline for most of the gas Directive
Shared rules for internal markets in renewable gas, natural gas and hydrogen.
Status on 12 October 2026
Upcoming
AI Act: High-risk duties start
Covering AI that serves as a safety component in electricity, gas or heat supply, on the timetable amended in 2026.
Laws and standards at a glance
The EU instruments that most often define data, integration and AI work for energy operators and energy service firms in Malta, and what each one changes in a delivery programme.
This summary is meant for planning and is not legal or regulatory advice; national measures and network codes add requirements of their own. EU dates were reviewed on 12 October 2026 and the Maltese references on 4 November 2026.
- NIS2 for energyScopeEU-wide
Energy ranks among the highly critical sectors. For electricity this includes suppliers, distribution and transmission system operators, producers, nominated electricity market operators, market participants offering aggregation, demand response or storage, and recharging point operators; district heating, oil, gas and hydrogen are covered as well. The obligations span risk management, incident reporting and supply-chain security. Malta applies them through the NIS2 Order (L.N. 71 of 2025, S.L. 460.41), in force since 23 January 2026, and operators within scope self-register with the CIP Department.
What it means for your operationOT security, supplier assurance and incident handling must be backed by evidence, not just written policy. Access control, logging and incident data are part of our platforms and integrations from day one.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- Network code on cybersecurityScopeEU-wide
Adopted as Delegated Regulation (EU) 2024/1366, this code governs cybersecurity where electricity crosses national borders. Risk is assessed in repeated cycles at EU, regional and national level; entities found to have high or critical impact must then run a minimum set of controls, and an advanced set where required, reaching into their suppliers.
What it means for your operationFor an entity with high or critical impact, everything it buys enters its risk assessment. Our documentation of architecture, components and controls is structured to map straight onto it.
SourceDelegated Regulation (EU) 2024/1366, EUR-Lex (opens external site)
- Electricity market design reformScopeEU-wide
Regulation (EU) 2024/1747 and Directive (EU) 2024/1711 revise the electricity market rules. Each Member State assesses its flexibility needs using data from system operators, who may offer flexible connection agreements and have to publish, in fine geographic detail, the capacity open to new connections. Customers obtain rights to share energy and to choose between fixed-price and dynamic contracts.
What it means for your operationFlexibility, connection capacity and tariff options are all data products, and we build the forecasting, publication and settlement flows that sit behind them.
SourceRegulation (EU) 2024/1747, EUR-Lex (opens external site)
- Smart metering and data accessScopeEU-wide
The Electricity Directive lays down functional requirements for smart metering and calls for efficient, secure data management with access to meter and consumption data on equal terms. Implementing Regulation (EU) 2023/1162 adds interoperability rules and access procedures, which each Member State documents in its national practices.
What it means for your operationA meter data platform needs consent handling, standard interfaces and access logs, and we design it against the data access procedure that applies to you.
SourceDirective (EU) 2019/944, EUR-Lex (opens external site)
- REMITScopeEU-wide
REMIT keeps the wholesale energy market honest: manipulation and trading on inside information are forbidden, inside information has to be made public, and transactions go to ACER. The 2024 revision moved disclosure onto inside information platforms, made algorithmic traders notify themselves and gave ACER stronger investigative tools.
What it means for your operationUnavailability and capacity data held in operational systems may count as inside information, so we build data flows that make disclosure and reporting punctual and traceable.
SourceRegulation (EU) No 1227/2011, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU-wide
The CER Directive deals with the physical and organisational resilience of critical entities, energy being one of its sectors. By 17 July 2026 each Member State identifies its critical entities, which must then assess their risks and adopt technical, security and organisational measures.
What it means for your operationContinuity plans must cover both cyber incidents and physical events, so the systems we deliver come with recorded dependencies and recovery routes that have been tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and critical infrastructureScopeEU-wide
Under Annex III, AI intended as a safety component in managing and operating water, gas, heating or electricity supply is high-risk, with the duties applying from 2 December 2027 after the 2026 amendment. In Malta the MDIA is the lead market surveillance authority under Legal Notice 226 of 2025.
What it means for your operationEvery use case is classified early. Assistants and analytics that inform staff are designed and documented apart from systems that act on the network, which remain out of scope unless the high-risk regime is planned in.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Illustrative use cases in the energy sector
Illustrative exampleProcedures and asset history on site
A crew member asks in plain words and receives the procedure, the asset’s history and the drawings that matter, each with its source. Switching remains a decision for the control room.
Applications from renewable installers
Connection applications, single-line diagrams and installer certificates are read and checked for gaps; an engineer looks at every exception.
Outage and billing questions at busy times
Customers see the current outage status and get answers on their bill from the source systems; staff step in for complaints and for customers who struggle to pay.
Billing and market messages behind APIs
An old customer information system is given documented APIs and replaced one process at a time, while market messages continue without interruption.
Inspection reports into asset records
Inspection and thermal imaging reports are read, linked to the right asset and offered as draft maintenance notifications for an engineer to confirm.
Platforms in energy
SAP
Gold PartnerSAP S/4HANA Utilities for meter-to-cash and market roles such as supplier, distribution operator and meter operator, plus SAP asset management for networks and generation plants.
Salesforce
Summit PartnerConnection requests, customer service and field service for energy operators and energy service firms, linked to billing and the customer information system.
Odoo
Gold PartnerProjects, field work, stock and invoicing for renewable installers, energy service firms and small producers.
The partner levels shown are FromNine’s own. Product names are trademarks of the companies that own them.
Malta
EU energy rules, Maltese cyber law
Most energy rules reaching Malta are European: the network codes, the market design reform, REMIT and NIS2 apply across the EU, with ACER coordinating regulators. Cybersecurity, however, comes with a Maltese legal form: the NIS2 Order (S.L. 460.41), in force since 23 January 2026, names the CIP Department as competent authority and requires operators within scope to self-register.
For an operator, an energy service firm or a growing renewable installer, that means two sets of evidence from the same systems. We build integration and data platforms on European standards such as CIM, keep national market processes in separate adapters and produce the logs and documentation the NIS2 Order asks for.
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- Malta NIS2 OrderMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025, with the Critical Infrastructure Protection Department as competent authority (opens external site)
Questions from energy operators
Will your software ever operate the network?
No. Unless agreed otherwise, analytics and assistants only read operational data. Switching, setpoints and protection settings remain with the ADMS or EMS and the accountable operators, under your change control.
Do you use the Common Information Model?
Yes: IEC 61970 and IEC 61968 for network and asset data, IEC 62325 for market communication and the ENTSO-E CGMES profiles where grid models are exchanged between transmission operators. Systems with formats of their own are mapped to CIM in the integration layer.
How do you protect smart meter data?
Interval readings reveal how a household lives, so we handle them as personal data under the GDPR, which the IDPC supervises in Malta: a defined purpose, role-based access, consent where the rules call for it, pseudonymised analysis and fixed retention. Suppliers and aggregators get access through the applicable data access procedure.
Is forecasting congestion or asset failure realistic?
In some cases. It depends on how well the network is measured, how much history exists and how it is operated. We test before promising, share the measured accuracy and uncertainty, and suggest rule-based methods wherever a model would not hold up.
As a supplier to an essential entity, how do you support the NIS2 Order?
We are ISO/IEC 27001 certified for information security management. The contract fixes security requirements and how we notify incidents; we reach your environments with least privilege and every access is logged; and we document our components so your supply-chain risk assessment for the CIP Department can include them.
Must our billing or customer information system be replaced?
No. Integration comes first and modernisation follows in steps: APIs around the current system, then one process at a time where it pays, with reconciliation running until the old route is closed.
Talk to us about your energy programme
Joining up network data, preparing meter data for new access rules or securing data flows between IT and OT? Begin with one area, one process or one data flow.