Industries
Designed around the rules of your sector.
A bank in Malaysia works to the technology risk policy of Bank Negara Malaysia (BNM), an exporter to EU product rules, a private hospital to the Personal Data Protection Act 2010 (PDPA). We begin with the rules, systems and people in your workflow, then design the AI and software to suit them.
For organisations in Malaysia whose systems must satisfy Malaysian regulators and, often, EU rules as well.
Sectors (06)
Our method took shape in public administration: 600+ government projects for public authorities in EU Member States, some completed and others still running, where accessibility, security and accountability are written into every contract.
For Manufacturing & Industry, Financial Services, Energy & Utilities, Healthcare & Life Sciences and Transport & Infrastructure, each page sets out what we would build, the Malaysian and EU rules it must meet and where a person keeps the decision, so you can judge the fit yourself.
01Lead sector
Public Sector & Government
Digital services an auditor can follow, designed with what public authorities in the EU have taught us.
600+Government projects in the EU
Public authorities in EU Member States
ISO/IEC 27001 certified
Key dates
- 12 December 2023Ministry of Digital established
- 26 August 2024Cyber Security Act 2024 in operation
- 2 December 2027EU AI Act high-risk duties
02
Financial Services
AI in regulated decisions under the revised Risk Management in Technology (RMiT) policy, with DORA clauses covered where you serve EU financial entities.
Key dates
- 17 January 2025DORA applies in the EU
- 28 November 2025Revised RMiT in effect
- 2 December 2027EU AI Act: credit and insurance uses
03
Healthcare & Life Sciences
Less administration for clinicians, with patient information handled as sensitive personal data under the PDPA.
Key dates
- 25 March 2025EU Health Data Space in force
- 1 June 2025Amended PDPA: DPO and breach notice
- 2 August 2028EU AI Act duties for AI in medical devices
04
Manufacturing & Industry
Plant data for the business, and product data ready for CBAM, ecodesign and cyber rules on goods sold into the EU.
Key dates
- 1 January 2026CBAM definitive period begins
- 1 January 2026e-Invoice phase four
- 11 December 2027EU Cyber Resilience Act applies in full
05
Energy & Utilities
Meter and generation data you can use, with incident processes ready for the Cyber Security Act 2024 (Act 854) where an organisation is an NCII entity.
Key dates
- 26 August 2024Act 854 in operation
- 1 June 2025PDPA breach notification applies
- 2 December 2027EU AI Act: AI in energy supply
06
Transport & Infrastructure
Dependable shipment, fleet and asset data, with operational systems secured for Act 854 where it applies.
Key dates
- 26 August 2024Cyber Security Act 2024 in operation
- 1 June 2025PDPA breach notification in force
- 28 June 2025EU accessibility rules for passenger transport
Starting from a problem instead?
- Solutions by problem
Legacy modernisation, connected operations, case processing, document intelligence, enterprise knowledge and service assistance, each shown as a workflow.
- Our delivery approach
Four stages, each closing with a result you can review.
- Services overview
Seven services, with one team accountable for all of them.
Malaysia
Malaysian rules at home, EU rules through trade
At home, sector rules come from Malaysian law and regulators: the PDPA as amended by Act A1727, with amendments in force since 1 January 2025, Act 854 for NCII entities since 26 August 2024, and the revised RMiT policy document of BNM for financial institutions since 28 November 2025.
EU rules arrive through exports and contracts: the EU AI Act where AI output is used in the EU, DORA clauses from EU banks and insurers, and CBAM and product rules for goods sold into the Union. We design one architecture for both, with the Malaysian and EU obligations documented side by side.
- Personal Data Protection Act 2010 (PDPA)Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727): data protection officer, breach notification, data portability (opens external site)
- Cyber Security Act 2024Cyber Security Act 2024 (Act 854): National Critical Information Infrastructure duties and licensing of cyber security service providers, administered by NACSA (opens external site)
- BNM Risk Management in Technology (RMiT)Risk Management in Technology (RMiT), policy document of Bank Negara Malaysia for financial institutions (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- DORADigital Operational Resilience Act, Regulation (EU) 2022/2554 (opens external site)
- CBAMCarbon Border Adjustment Mechanism, Regulation (EU) 2023/956 (opens external site)
- Department of Personal Data Protection (JPDP)Personal Data Protection Commissioner and the Department of Personal Data Protection (JPDP), under the Ministry of Digital (opens external site)
- National Cyber Security Agency (NACSA)National Cyber Security Agency (NACSA), under the National Security Council (opens external site)
Frequently asked questions
Why does the public sector come first?
It is where our working method was formed: 600+ government projects for public authorities in EU Member States, some completed and others still running. Tender rules, accessibility requirements, services in several languages and public audit shaped how we design, document and hand over systems. That experience is European; for a reader in Malaysia it shows in the documentation and audit trails we deliver.
Do you work in sectors not listed here?
Yes. Our services and platforms are not tied to one sector, and much of our work is for private companies. These six pages cover the sectors where regulation decides the most about the architecture. If yours is missing, begin with the problem on the solutions pages.
Where are your offices?
FromNine has offices in Antwerp, Ghent, Amsterdam and Cyberjaya, Malaysia. Our government projects are all for public authorities in EU Member States. We work with you in English.
Plan the next step for your sector
Tell us which rules apply, which systems are involved and who decides, in Malaysia and in any EU market you serve.