In application
Rail passenger rights: Recast rail passenger rights in application
EU-wide rules on travel information, through-tickets and compensation for rail passengers.
Transport & Infrastructure
Data that keeps people, cargo and vessels on schedule.
For logistics firms, shipping agents, ferry and tour operators and infrastructure owners in Malta we connect asset, operations and passenger systems, build data platforms for maintenance and open data, support field and control room staff with knowledge they can trust, and design IT/OT security around the NIS2 Order.
For logistics firms, shipping agents, ferry and tour operators and infrastructure owners in Malta and Gozo, working to EU transport rules and the NIS2 Order together.
28 June 2025
Accessible passenger services required
Passenger transport websites, apps, e-tickets and live travel updates must meet accessibility rules, applied in Malta through S.L. 627.03.
17 July 2026
Deadline to name critical entities
Each Member State, Malta included, lists its critical entities in transport and other sectors; those entities then assess risk and act on resilience.
2 December 2027
High-risk AI in road traffic
AI acting as a safety component in running road traffic counts as high-risk, on the timetable amended in 2026.
What is shifting for transport and logistics in Malta
Capacity is what runs out first
Roads, quays, terminals and airports operate near their limits, and works, maintenance slots and schedules all compete for the same space. The revised TEN-T Regulation fixes 2030 for the core network and 2040 for the extended core network, so renewal and day-to-day operation must be planned as one.
Sharing data is now a duty
Under the revised ITS Directive and its delegated acts, road authorities and transport operators must offer defined data through a National Access Point in standard formats such as DATEX II, NeTEx and SIRI. Open data is no longer a one-off project but a service that users expect to be reliable.
SourceDirective (EU) 2023/2661
Operational technology now falls under cyber law
NIS2 counts air, rail, water and road transport among the highly critical sectors, from port authorities and shipping companies to airport operators and road traffic management, and Malta applies it through the NIS2 Order with the CIP Department as competent authority. IEC 62443 and, for railway groups, CLC/TS 50701 give engineers a common approach to zones, conduits and security levels.
SourceDirective (EU) 2022/2555
Ageing assets, retiring experts
Quays, breakwaters, bridges and tunnels built long ago need closer inspection and sharper decisions, just as the engineers who know their history retire. Condition data, inspection reports and drawings belong in one searchable place for the crews that come next.
Where transport teams get stuck, and what we build
- The challenge
Design models, GIS, maintenance tools and spreadsheets each hold another version of the same asset.
Our responseWe integrate on open standards such as IFC 4.3 and railML with an event backbone, so design, construction and maintenance use a single asset register and each change to the network is captured one time only.
- The challenge
Inspection reports, photographs and defect notes pile up faster than engineers can handle them.
Our responseDocument intelligence reads inspection and survey reports, ties each finding to its asset and drafts a maintenance notification for an engineer to approve, with the source page attached.
- The challenge
Passengers want accurate information across operators, and EU law now asks for open data as well.
Our responseA data platform that merges timetables, live positions and disruptions, publishes NeTEx, SIRI or DATEX II feeds to the National Access Point and watches how complete and timely they are.
- The challenge
Each extra data flow out of vessel, terminal, tunnel or traffic control systems gives attackers another opening.
Our responseIT/OT architectures built on IEC 62443 zones and conduits (and CLC/TS 50701 where rail is involved), one-way transfer where the risk justifies it, central identity and the logs that incident reporting under the NIS2 Order relies on.
- The challenge
Field crews and control room staff dig through procedures, drawings and job history in several systems.
Our responseAn assistant that searches procedures, asset records, inspection reports and earlier work orders and names the document and revision. It advises only; it never sets a route, grants a movement authority or alters a traffic control setting.
- The challenge
Phone lines and desks are swamped during disruptions, works and schedule changes.
Our responseService assistance that answers questions on disruptions, journeys and compensation from the source systems and passes complaints and special cases to staff, in the languages your passengers use.
A reference landscape for transport IT and OT
Control levels stay as they are. Above the zone boundary, an integration layer based on events and open standards offers operational data to asset, analytics, knowledge and open data services.
Illustrative example
Operational data passes the zone boundary a single time, through the integration layer, and every service above reuses it.
Read the diagram as text
Five stacked layers make up the picture. Layer 4, the top, is enterprise IT: ERP, asset management, ticketing and customer systems. Layer 3 covers operations: traffic management, schedule and capacity planning, and port and airport operations. Layer 2 is supervision through interlocking control and SCADA for tunnels and road traffic. Layer 1 is field equipment such as signals, point machines, axle counters, sensors and message signs. Layer 0, the bottom, is the physical network of track, roads, bridges, tunnels, quays and locks.
A zone boundary following IEC 62443 and CLC/TS 50701 sits between layer 4 and everything beneath it.
Layers 1 to 4 pass their data into an integration layer based on events and open standards. It feeds an asset, traffic and passenger data platform, and three services draw on that platform: analytics for condition, capacity and punctuality; an assistant for field and control room staff; and open data feeds with regulatory reporting.
Operators keep control
Analytics and assistants only read. Routing, movement authorities and traffic control remain with the traffic management system, the safety systems and the operator on shift.
Zones and conduits
Network segmentation follows IEC 62443, and CLC/TS 50701 where rail is involved, with documented conduits and one-way transfer out of the control zone where the risk warrants it.
A single asset register
IFC 4.3 and railML give design, construction and maintenance one vocabulary, so a network change is recorded once and reused in every system.
Open data built in
National Access Point feeds come from the same platform as internal reporting and are checked for completeness and delay before release.
Key dates for transport and logistics
Rules on accessibility, data sharing, cybersecurity and resilience follow one another closely, and rail, freight and maritime law add dates of their own.
In application
TEN-T: Revised TEN-T Regulation takes effect
Core network by end-2030, extended core network by end-2040 and comprehensive network by end-2050.
In application
NIS2: Transposition deadline
Air, rail, water and road transport are covered; Malta’s NIS2 Order has applied since 23 January 2026.
In application
European Accessibility Act: Accessibility rules in application
Covers passenger transport websites, apps, e-tickets and live travel information; in Malta through S.L. 627.03.
In application
EMSWe: European Maritime Single Window environment starts
Ships report port calls through harmonised national single windows.
In application
ITS Directive: First road data due at the National Access Point
Traffic rules, road works and safety events on the TEN-T core network, with more of the network and more data types added up to 2028.
In application
Rail telematics TSI: Telematics TSI takes effect
A single TSI for passenger and freight telematics takes over from TAP and TAF, applied in stages up to the 2030 working timetable.
In application
CER Directive: Critical entities named
Those named then assess their risks and put resilience measures in place.
Status on 15 October 2026
Upcoming
eFTI: Electronic freight information accepted
Competent authorities have to accept regulatory freight information offered through certified eFTI platforms.
Upcoming
AI Act: High-risk duties start
Covering AI that serves as a safety component in managing road traffic, on the timetable amended in 2026.
Upcoming
Rail capacity regulation: Digital capacity and traffic management rules
Rules on exchanging traffic management information and on digital capacity tools apply; the new capacity process follows from the 2031 working timetable.
Laws and standards at a glance
The EU instruments that most often define data, integration and AI work for transport operators and infrastructure owners serving Malta, and what each one changes in a delivery programme.
This summary is meant for planning and is not legal or regulatory advice; national measures and sector law add requirements of their own. EU dates were reviewed on 15 October 2026 and the Maltese references on 4 November 2026.
- NIS2 for transportScopeEU-wide
Transport ranks among the highly critical sectors. On the water this means shipping companies, port managing bodies and vessel traffic services; in the air, air carriers, airport managing bodies and traffic management control operators; on the road, road authorities in charge of traffic management control and operators of intelligent transport systems; and on rail, infrastructure managers and railway undertakings. The duties cover risk, incidents and the supply chain. Malta gives effect to them through the NIS2 Order (S.L. 460.41), in force since 23 January 2026, with self-registration at the CIP Department.
What it means for your operationOT security, supplier assurance and incident handling must be backed by evidence, not just written policy. Access control, logging and incident data are part of our platforms and integrations from day one.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- ITS Directive and National Access PointsScopeEU-wide
Directive 2010/40/EU, revised by Directive (EU) 2023/2661, frames intelligent transport systems. Its delegated regulations oblige each Member State to offer defined road, traffic and travel data through a National Access Point, in standard formats, with deadlines that widen the coverage in stages.
What it means for your operationData once released on request must now be available, up to date and machine-readable, and we build the pipelines, format conversion and quality monitoring that make that possible.
SourceDirective (EU) 2023/2661, EUR-Lex (opens external site)
- Multimodal travel informationScopeEU-wide
Delegated Regulation (EU) 2017/1926, amended by Delegated Regulation (EU) 2024/490, lists the static and dynamic travel data for every mode that authorities and operators share through the National Access Point: NeTEx for timetables and networks, SIRI for live information. Disruption and real-time status data are due for the comprehensive TEN-T network from 1 December 2025 and for the remaining network from 1 December 2028.
What it means for your operationSchedules, stops, accessibility details and live data need one consistent source, so we link planning and operations systems to NeTEx and SIRI feeds and check them before they go out.
SourceDelegated Regulation (EU) 2017/1926, EUR-Lex (opens external site)
- European Accessibility Act for passenger transportScopeEU-wide
From 28 June 2025, the websites, apps, e-tickets, ticketing services and live travel information of air, bus, rail and waterborne passenger services must be accessible. Malta applies this through the Accessibility Measures (European Accessibility Act) Regulations, S.L. 627.03, with the CRPD as market surveillance authority.
What it means for your operationJourney planners, booking pages and disruption notices fall within scope, so we design and test them to WCAG 2.2 AA and keep the accessibility statement accurate.
SourceDirective (EU) 2019/882, EUR-Lex (opens external site)
- Rail passenger rightsScopeEU-wide
Regulation (EU) 2021/782 has applied since 7 June 2023 and matters to groups that also run rail services elsewhere in the EU. Railway undertakings and ticket sellers must inform passengers before and during the trip, on real-time data where possible, and deal with assistance, re-routing and compensation within fixed deadlines. Infrastructure managers pass live arrival and departure data to railway undertakings, ticket sellers and station managers.
What it means for your operationDisruption updates and compensation claims are data processes, so we link operations, ticketing and customer service to give passengers one consistent answer and settle claims in time.
SourceRegulation (EU) 2021/782, EUR-Lex (opens external site)
- Rail telematics and capacityScopeEU-wide
Implementing Regulation (EU) 2026/253, the telematics TSI, merges the former passenger (TAP) and freight (TAF) TSIs, applies in stages and makes timetable data free through the National Access Points. Regulation (EU) 2026/1184 on rail capacity adds rules for digital capacity planning and for exchanging traffic management information from the end of 2027.
What it means for your operationTimetable, path and running data shift to shared message formats and tools, and we link planning, operations and customer systems to them without touching the systems that run the trains.
SourceImplementing Regulation (EU) 2026/253, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU-wide
The CER Directive addresses the physical and organisational resilience of critical entities, transport being one of its sectors. By 17 July 2026 each Member State identifies its critical entities, which must then assess their risks and adopt technical, security and organisational measures.
What it means for your operationContinuity plans must cover both cyber incidents and physical events, so the systems we deliver come with recorded dependencies and recovery routes that have been tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and transportScopeEU-wide
Under Annex III, AI meant as a safety component in managing and operating road traffic is high-risk, and after the 2026 amendment those duties apply from 2 December 2027. For marine equipment, vehicles, rail interoperability and drones, the requirements arrive through the laws listed in Annex I, Section B, as their delegated and implementing acts are revised. In Malta the MDIA leads market surveillance under Legal Notice 226 of 2025.
What it means for your operationEvery use case is classified early. Assistants and analytics that inform staff are designed and documented apart from systems that act on traffic, which stay outside scope unless the high-risk regime is planned in.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Illustrative use cases in transport and logistics
Illustrative exampleQuay and road inspections into the asset register
Reports on quays, bridges and road structures are read, each finding is matched to its asset and offered as a draft maintenance notification for an engineer to confirm.
Procedures and history for maintenance crews
A crew member asks in plain words and receives the procedure, the asset’s history and the drawings that matter, each with its source. Operational decisions remain with the control room.
Ferry and tour disruption questions at busy times
Passengers of a ferry or tour operator see the current status, alternatives and their compensation options from the source systems; staff deal with complaints and assistance requests.
Shipping and customs documents
Shipping documents, customs papers and permits at a logistics firm or shipping agent are read and checked for gaps before a planner looks at the exceptions.
Older planning systems behind APIs
An ageing scheduling, berth or maintenance planning system receives documented APIs and is replaced one function at a time while operations continue.
Platforms in transport and logistics
SAP
Gold PartnerSAP S/4HANA asset management, with linear asset management for roads and pipelines, alongside maintenance planning, procurement and finance in one system.
Salesforce
Summit PartnerCustomer service, passenger and freight accounts and field service, linked to ticketing, operations and asset systems.
Odoo
Gold PartnerProjects, field work, stock and invoicing for contractors, terminal operators, shipping agents and smaller logistics firms.
The partner levels shown are FromNine’s own. Product names are trademarks of the companies that own them.
Malta
An island network under EU transport rules
For Malta and Gozo, connections run by sea and air, and freight, ferries and passengers depend on ports, terminals and roads working together. TEN-T, the ITS Directive, the European Maritime Single Window and NIS2 apply across the EU, while cybersecurity comes in Maltese form: the NIS2 Order (S.L. 460.41), in force since 23 January 2026, with the CIP Department as competent authority. Passenger services also fall under S.L. 627.03 for accessibility.
We build integration and data platforms on European standards such as IFC, NeTEx, SIRI and DATEX II, keep national profiles and reporting in separate adapters, and give a logistics or ferry operator that also works abroad a single architecture.
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- European Accessibility ActEuropean Accessibility Act, Directive (EU) 2019/882 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
- Malta NIS2 OrderMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025, with the Critical Infrastructure Protection Department as competent authority (opens external site)
- Malta accessibility regulations (EAA)Accessibility Measures (European Accessibility Act) Regulations, with the Commission for the Rights of Persons with Disability (CRPD) as market surveillance authority (opens external site)
Questions from transport and logistics firms
Will your software steer vessels, vehicles or traffic?
No. Unless agreed otherwise, analytics and assistants only read operational data. Routing, movement authorities, traffic control and signalling remain with the systems and operators who are accountable for them, under your change control.
Do you write safety-critical signalling or control software?
No. We do not build software that needs certification under the CENELEC railway safety standards or similar safety regimes. We connect to such systems through defined and documented interfaces, normally read-only, and keep our components outside their safety case.
What data standards do you use?
For infrastructure and asset data, IFC 4.3 and railML; for public transport schedules and live information, NeTEx and SIRI; for road traffic, DATEX II. Systems with formats of their own are mapped to these in the integration layer.
Could you handle our publication to the National Access Point?
We can build and operate the pipelines, format conversion and quality checks behind it. Deciding what to publish, and answering for it, remains your responsibility.
As a supplier to an operator under the NIS2 Order, what do you provide?
We are ISO/IEC 27001 certified for information security management. The contract fixes security requirements and how we notify incidents; we reach your environments with least privilege and every access is logged; and we document our components so your supply-chain risk assessment for the CIP Department can include them.
Must our asset or planning systems be replaced?
No. Integration comes first and modernisation follows in steps: APIs around the current system, then one function at a time where it pays, with reconciliation running until the old route is closed.
Talk to us about your transport or logistics programme
Linking asset and inspection data, publishing open data to a National Access Point or securing data flows between IT and OT? Begin with one route, one asset type or one data flow.