Applies now
REMIT: Amended EU wholesale market integrity rules in force
Inside information platforms, notification of algorithmic trading and stronger ACER powers.
Energy & Utilities
Energy data that operations teams can act on.
For renewable energy developers, solar EPC firms, utilities and large industrial energy users, we would connect systems on a common network data model, build platforms for meter and generation data, give field crews searchable knowledge, and secure IT/OT links for the Cyber Security Act 2024 (Act 854) where an organisation is an NCII entity.
For renewable energy developers, solar EPC firms, utilities and industrial energy users in Malaysia, and for groups that also hold energy assets in the EU.
26 August 2024
Act 854 in operation
NCII entities assess and audit their cyber security risk and notify incidents within six hours.
SourceCyber Security Act 2024 (Act 854) (opens external site)
1 June 2025
PDPA breach notification applies
Under the Personal Data Protection Act 2010 (PDPA), data controllers notify personal data breaches to the Commissioner, customer and meter data included.
SourcePersonal Data Protection Act 2010 (Act 709) (opens external site)
2 December 2027
EU AI Act: AI in energy supply
AI used as a safety component in supplying electricity, gas or heating in the EU becomes high-risk, under the 2026 amendment.
What is changing for energy organisations
New capacity waits for network access
Solar, storage and new industrial loads ask for connections faster than networks can be reinforced. In the EU, the 2024 electricity market reform adds national flexibility assessments, flexible connection agreements and published connection capacity; developers everywhere need the data to plan around constraints.
Generation and meter data drive decisions
Solar portfolios, storage and on-site generation depend on reliable meter and generation data, on forecasts and on data exchange between producers, buyers and network operators. In the EU, distribution system operators are expected to buy flexibility before they reinforce.
SourceDirective (EU) 2019/944
Operational technology under cyber law
Since 26 August 2024, Act 854 has placed duties on National Critical Information Infrastructure (NCII) entities, including notification of a cyber security incident within six hours. In the EU, NIS2 lists energy as a sector of high criticality, and IEC 62443 gives engineers a shared vocabulary of zones and conduits.
Older assets, retiring experts
Plants and substations commissioned long ago are now looked after by engineers close to retirement, who know where each one is fragile. Their judgement, the condition data and the maintenance records need to live together where new crews can search them.
Problems and how we would respond
- The problem
Each system, from GIS and SCADA to asset management and billing, holds its own picture of the network.
How we would respondOne network model shared by planning, operations and commercial teams, built on the IEC Common Information Model (IEC 61970, IEC 61968) and an event backbone, in place of overnight file exchanges.
- The problem
Project and connection decisions wait because no one can show where capacity remains.
How we would respondA data product that combines meter data, SCADA measurements and the project pipeline into load and congestion forecasts per area, stating the accuracy and the assumptions behind each figure.
- The problem
Interval data from smart meters comes in volumes, and with access rules, that legacy systems cannot handle.
How we would respondA platform that checks, stores and serves interval readings, with consent records, access by role and a log for each party, built for the PDPA in Malaysia and for the GDPR and national access rules in the EU.
- The problem
Every link from operational technology to IT adds exposure.
How we would respondZones and conduits set out under IEC 62443, one-way paths where the risk calls for them, central identity and logs good enough to notify an incident within six hours for an NCII entity.
- The problem
Field crews look for drawings, procedures and work history in several systems.
How we would respondAn assistant that searches procedures, asset records, inspection findings and earlier work orders for crews and control room staff, naming the document and revision. It gives information only; switching instructions never come from it.
- The problem
Service teams are flooded during outages, billing runs and installation peaks.
How we would respondAn assistant that answers questions on outages, installations and invoices from the source systems and hands anything consequential to a person, together with document checks on applications and installer certificates before they reach an engineer.
IT/OT reference landscape for energy assets
The control levels are left as they are. Operational data reaches analytics, knowledge and reporting services through one integration layer, built on CIM and events, above the zone boundary.
Illustrative example
Data leaves the control zone at one point, the integration layer, and every service above draws on it.
Read the diagram as text
From the top: enterprise systems (ERP, asset management, customer and billing) at level 4; ADMS or EMS, outage and work management and the meter head-end at level 3; SCADA and IEC 61850 substation automation at level 2; RTUs, IEDs and relays for control and protection at level 1; and lines, transformers, switchgear, generation and storage as primary equipment at level 0.
An IEC 62443 zone boundary sits between level 4 and the levels below.
Data from levels 1 to 4 flows into an integration layer of CIM and events, and from there into a platform for network, meter and asset data. That platform supports analytics on congestion, load and asset health, an assistant for crews and control room staff, and regulatory reporting with data exchange.
The control room decides
Analytics and assistants read data and nothing more. Switching, setpoints and protection settings belong to the ADMS or EMS and the operator on shift.
Zones and conduits
Network segmentation follows IEC 62443; conduits are documented, and data leaves the control zone one way only where the risk demands it.
One network model
CIM is the shared vocabulary for GIS, operations, planning and commercial processes, so a network change is recorded once.
Forecasts that state their error
Every load, congestion or asset health model publishes its error margin. If the data will not support a forecast, you hear that from us.
Malaysian and EU dates for energy organisations
Rules on cyber security, personal data, market design and resilience arrive close together. In the EU, network codes and national transposition bring further dates.
Applies now
Network code on cybersecurity: EU network code enters into force
Cycles of risk assessment follow in stages, together with the naming of high-impact and critical-impact entities.
Applies now
Cyber Security Act 2024: Act 854 in operation in Malaysia
Duties for NCII entities, including incident notification within six hours.
Applies now
NIS2: National NIS2 laws take effect
Electricity, gas, hydrogen, oil and district heating are covered in the EU.
Applies now
Electricity market design: Deadline to transpose most provisions of the EU Directive
Applies now
PDPA: DPO and breach notification duties apply
Under the PDPA as amended by Act A1727, for customer and meter data linked to a person.
Applies now
Metering data access: EU national practices for metering data access reported
Each Member State describes how its procedures map onto the EU reference model.
Applies now
European Grids Package: European Commission presents its grids package
Proposals on infrastructure planning and permitting, with guidance on connecting to the grid on time.
Applies now
CER Directive: EU Member States identify critical entities
The entities identified then assess risks and take resilience measures.
Applies now
Hydrogen and gas package: Deadline to transpose most of the EU gas Directive
Common rules for the internal markets in renewable gas, natural gas and hydrogen.
Status on 12 October 2026
Coming
AI Act: EU high-risk AI duties apply
Covering AI used as a safety component in supplying electricity, gas or heating, under the 2026 amendment.
Rules and standards in brief
The EU instruments that shape data, integration and AI work where a Malaysian group develops, operates or supplies energy assets in the EU, and what each means for delivery. At home, Act 854 and the PDPA are the anchors described above.
For planning discussions, not legal or regulatory advice. In the EU, national transposition and network codes add requirements. EU dates checked on 12 October 2026; Malaysian dates on 6 November 2026.
- NIS2 for energyScopeEU law
NIS2 counts energy among its highly critical sectors. In electricity, covered entities range from producers, suppliers and network operators to aggregators, storage and demand response providers and recharging point operators; gas, oil, hydrogen and district heating are covered as well. They manage risk, report incidents and secure their supply chain.
What it means in practiceFor energy assets in the EU, OT security, supplier assurance and incident handling need evidence as well as policy. Our platforms and integrations come with access control, logging and incident data from day one.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- Network code on cybersecurityScopeEU law
Adopted as Delegated Regulation (EU) 2024/1366, the code sets cyber rules for cross-border electricity flows: risk assessments repeated at Union, regional and national level, a list of high-impact and critical-impact entities, and baseline and advanced controls for them that extend to suppliers.
What it means in practiceAn entity classed as high-impact or critical-impact in the EU must assess the products and services it buys. Our documentation of architecture, components and controls is written to slot into that assessment.
SourceDelegated Regulation (EU) 2024/1366, EUR-Lex (opens external site)
- Electricity market design reformScopeEU law
The 2024 reform (Regulation (EU) 2024/1747 and Directive (EU) 2024/1711) changes EU electricity market rules: national flexibility needs are assessed on system operator data, flexible connection agreements become possible, available connection capacity is published in detail, and customers can share energy and pick fixed-price or dynamic contracts.
What it means in practiceFlexibility, connection capacity and tariff choice all depend on data. For EU operations, we build the forecasting, publication and settlement flows behind them.
SourceRegulation (EU) 2024/1747, EUR-Lex (opens external site)
- Smart metering and data accessScopeEU law
Under the Electricity Directive, smart meters must meet functional requirements and metering and consumption data must be managed securely and opened to eligible parties without discrimination. Implementing Regulation (EU) 2023/1162 adds interoperability rules and access procedures, set out by each Member State.
What it means in practiceMetering data platforms need consent handling, standard interfaces and access logs, designed against the access procedure of each EU country you operate in.
SourceDirective (EU) 2019/944, EUR-Lex (opens external site)
- REMITScopeEU law
REMIT prohibits manipulation and insider trading on EU wholesale energy markets and obliges participants to publish inside information and report trades to ACER. The 2024 changes route disclosures through inside information platforms, require notice of algorithmic trading and widen ACER’s powers to investigate.
What it means in practiceIf you trade on EU wholesale markets, outage and capacity figures in your operational systems may count as inside information, so we make their disclosure and reporting timely and traceable.
SourceRegulation (EU) No 1227/2011, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU law
For critical entities in the EU, energy among them, the CER Directive covers physical and organisational resilience. Member States name those entities by 17 July 2026, after which each one assesses its risks and puts measures in place.
What it means in practiceResilience plans should treat a cyber attack and a physical outage alike. Our systems ship with their dependencies documented and their recovery tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and critical infrastructureScopeEU law
Annex III makes AI high-risk where it serves as a safety component in running water, gas, heating or electricity supply, with duties from 2 December 2027 after the 2026 amendment. A Malaysian provider falls within scope where the system’s output is used in the EU.
What it means in practiceWe decide the risk class at the start. Tools that advise people are kept and documented apart from anything that acts on the network, which we leave out of scope unless you plan for the high-risk regime.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Illustrative scenarios
Illustrative exampleField procedures and asset history
Crews would ask in their own language and receive the procedure, asset history and relevant drawings, with sources. Switching remains under the control room’s authority.
Installation document intake
At a solar EPC firm, applications, single-line diagrams and installer certificates would be read and checked for completeness; an engineer reviews each exception.
Customer questions at peak times
Customers of an energy service company would get service status and answers on their invoice from the source systems; staff take over complaints and payment difficulties.
Billing systems behind APIs
An older customer and billing system would get documented APIs, and its processes would move to new components one at a time while invoices keep going out.
From inspection report to work order
For a solar portfolio, thermography and inspection findings would be tied to the right asset and drafted as work orders that an engineer confirms.
Platforms for energy organisations
SAP
Gold PartnerMeter-to-cash on SAP S/4HANA Utilities, together with SAP asset management for plants, networks and solar portfolios.
Salesforce
Summit PartnerOnboarding, customer service and field service for utilities and energy service companies, integrated with billing and customer records.
Odoo
Gold PartnerProjects, field service, inventory and invoicing for solar EPC firms, energy service companies and smaller producers.
FromNine holds the partner levels shown. Product names belong to their respective owners.
Malaysia
Malaysian cyber law at home, EU rules for assets abroad
In Malaysia, an organisation designated as an NCII entity under Act 854 carries duties for risk assessment and audit, codes of practice and notification of incidents within six hours. Customer and meter data linked to a person falls under the PDPA.
Malaysian groups developing or running energy assets in the EU add NIS2, the network code on cybersecurity, the 2024 market reform and REMIT. Our integration and data platforms rest on international standards such as CIM, with market and country processes held in separate adapters, so a single architecture covers both.
- Cyber Security Act 2024Cyber Security Act 2024 (Act 854): National Critical Information Infrastructure duties and licensing of cyber security service providers, administered by NACSA (opens external site)
- Personal Data Protection Act 2010 (PDPA)Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727): data protection officer, breach notification, data portability (opens external site)
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
Frequently asked questions
Would your software operate our plant or network?
No. Our analytics and assistants read operational data only. Switching, setpoints and protection settings stay with the ADMS or EMS and the accountable operators, under your change control.
Do you use the Common Information Model?
Yes. Network and asset data follow IEC 61970 and IEC 61968, market messages IEC 62325, and grid model exchange between EU transmission system operators the ENTSO-E CGMES profiles. Anything in a proprietary format is mapped onto CIM in the integration layer.
How is meter data protected?
Readings every few minutes reveal how a household or business lives, so we handle them as personal data: under the PDPA in Malaysia where they are linked to a customer, under the GDPR in the EU. In practice that means purpose limits, access by role, consent where required, pseudonymised analysis and fixed retention periods.
Can you forecast congestion or equipment failures?
In some cases. Measurement coverage, operating history and how the assets are run decide it. We test first, share the accuracy and uncertainty we measured, and advise rule-based approaches where a model would be unreliable.
How do you support an NCII entity under Act 854, or an EU entity under NIS2?
Our information security management system holds ISO/IEC 27001 certification. Security requirements and incident notification are agreed in the contract, access to your environments is least-privilege and logged, and our components are documented for your supply-chain risk assessment.
Must we replace our billing or customer system?
No. We connect to it first and then modernise one process at a time where the case is clear, reconciling both paths until the old one can be switched off.
Plan your energy data programme
Integrating meter and generation data, preparing incident processes for Act 854 or securing IT/OT data flows? Begin with one site, one process or one data flow.