Applies now
Interoperable Europe Act: Regulation in application
A governance framework for interoperability across borders and for reuse of public-sector solutions.
Public Sector & Government
Systems a public body can account for.
We design, build and run digital services that a public body can answer for: accessible, secure from the start, able to exchange data and documented so they outlast any contract. That way of working comes from 600+ government projects for public authorities in EU Member States.
For federal agencies, statutory bodies, local authorities and government-linked companies that serve the public in Malay and English and answer to auditors.
12 December 2023
Ministry of Digital established
Its departments include the National Digital Department (JDN), responsible for digitalising government services.
26 August 2024
Cyber Security Act 2024 in operation
NCII entities carry duties for risk assessment, audit and incident notification.
SourceCyber Security Act 2024 (Act 854) (opens external site)
2 December 2027
EU AI Act high-risk duties
Public deployers in the EU carry out a fundamental rights impact assessment, under the Act as amended in 2026.
600+Projects for public authorities in EU Member States
- EU Member States
Credentials
- ISO/IEC 27001 certifiedInformation security management, independently certified
- Summit Partner · SalesforceOn platforms that public bodies already use
- Gold Partner · SAP and OdooOn platforms that public bodies already use
Public bodies we work with
- Infrabel BE
- Skeyes BE
- Bundesimmobiliengesellschaft (BIG) AT
- Austro Control AT
- Bulgarian Ports Infrastructure Company BG
- HŽ Infrastruktura HR
- Cyprus Ports Authority CY
- Správa železnic CZ
- DPP Prague CZ
- Naviair DK
- Energinet DK
- Elering EE
- Fintraffic FI
- Fingrid FI
- RATP Group FR
- EYDAP GR
- HungaroControl HU
- EirGrid IE
- ANAS IT
- Augstsprieguma tīkls (AST) LV
- Lithuanian Airports LT
- Litgrid LT
- LuxAirport LU
- Indis Malta MT
- TenneT NL
- PANSA PL
- Infraestruturas de Portugal PT
- Transelectrica RO
- NDS SK
- Enaire ES
What is changing for Malaysian public bodies
New duties for digital public services
Since 26 August 2024, the Cyber Security Act 2024 (Act 854) has placed risk assessment, audit and six-hour incident notification duties on National Critical Information Infrastructure (NCII) entities. Where a public body is designated as one, each duty adds documentation and reporting work for the systems involved.
One sign-in, fewer forms
People expect to apply, track progress and receive outcomes online, in Malay or English, without handing over the same documents twice. MyDigital ID, the national digital identity, gives services a common way to sign people in.
SourceAbout MyDigital ID
Experience is leaving with retirements
Long-serving officers and the engineers who understand older systems are retiring sooner than successors can take over. What they know has to move into documented services and tools that the next intake of staff can use.
AI has to be explainable in public
A public body using AI must explain each outcome, keep a named officer accountable and be open about the systems it runs. That shapes how AI is designed, not only how it is procured.
Problems and how we would respond
- The problem
Case systems built decades ago turn every rule change into a risky release.
How we would respondWe modernise in stages behind stable interfaces: services extracted, data migrated and reconciled, modules retired one by one. The public never faces a single big switchover.
- The problem
Applicants submit the same documents to one agency after another.
How we would respondServices read data from the register that holds it, under a documented mandate, and every access is logged. Data is requested once, not at every counter.
- The problem
Call centres handle questions the website should already answer.
How we would respondService assistants answer in Malay and English from your published procedures, stay within approved sources and pass the conversation to staff when a person is needed.
- The problem
Officers spend hours reading, sorting and retyping incoming files.
How we would respondDocument intelligence sorts files and extracts fields, an officer checks the uncertain values, and the case system receives structured data with a complete audit trail.
- The problem
AI pilots stop at the legal and ethics review.
How we would respondWe prepare for that review from discovery: risk classification, logging, human oversight and documentation, plus input for impact assessments where your policies or, in the EU, the AI Act call for them.
- The problem
Policy knowledge is spread across intranets, PDF circulars and individual officers.
How we would respondKnowledge search that respects permissions and cites the circular, guideline or procedure behind each answer, so officers can verify before they act.
The EU timeline behind our European public-sector work
EU dates that steer architecture and procurement for public authorities in Member States. National laws and implementing acts can add dates of their own.
Applies now
NIS2: National NIS2 laws take effect
Each national law applies once adopted. Public administration entities enter scope, with duties for risk management and incident reporting.
Applies now
Interoperable Europe Act: Interoperability assessment becomes mandatory
Due before a decision on a trans-European digital public service that is new or substantially changed.
Applies now
AI Act: Bans on prohibited practices apply
Social scoring by public authorities is among them. Duties on AI literacy start the same day.
Applies now
European Accessibility Act: Accessibility requirements take effect
For listed products and services, through national laws.
Applies now
Data Act: Data Act in application
Covers data requests by public bodies in exceptional need and the rules on switching cloud provider.
Applies now
AI Act: Transparency duties begin
People must be informed when they deal with an AI system, and generated content must be labelled.
Status on 2 October 2026
Coming
eIDAS 2: Wallets available in every Member State
At least one wallet per Member State; public services that need online identification must accept it.
Coming
AI Act: High-risk duties begin
Covers stand-alone high-risk uses, among them access to public services and benefits, under the 2026 amendment.
Rules and standards in brief
The EU instruments behind our European public-sector work, in plain terms. For a reader in Malaysia they show the discipline we bring, and some of them reach Malaysian providers that supply public authorities in the EU.
Prepared for planning discussions, not as legal advice. Member States transpose EU directives in different ways. EU dates checked on 2 October 2026; Malaysian dates on 6 November 2026.
- EU AI ActScopeEU law
Regulation (EU) 2024/1689 ranks AI systems by risk. Systems used to decide on access to essential public services and benefits, on migration, asylum and border control, or in justice and law enforcement count as high-risk.
A public body deploying a high-risk system carries out a fundamental rights impact assessment (Article 27), assigns human oversight and keeps logs. The 2026 amendment set 2 December 2027 as the date these duties apply.
What it means in practiceEach use case is classified in discovery, with oversight, logging and technical documentation built in. A Malaysian provider whose AI output is used by an EU public body can fall within the Act as well (Article 2(1)(c)). Your own counsel makes the legal assessment.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
- NIS2ScopeEU law
Directive (EU) 2022/2555 covers central government administrations and lets Member States add regional and local ones. It requires risk management and supply-chain security, and incident reporting in stages that opens with an early warning within 24 hours.
What it means in practiceEU authorities put security clauses in every contract; in Malaysia, Act 854 covers similar ground for NCII entities, with notification within six hours. We document our controls, report incidents through the agreed channel and hand over the evidence your oversight duties call for.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- eIDAS 2 and the EU Digital Identity WalletScopeEU law
Regulation (EU) 2024/1183 obliges each Member State to make at least one EU Digital Identity Wallet available by 24 December 2026. Public services that ask for electronic identification must accept it next to national eID schemes.
What it means in practiceSign-in, attribute sharing and signatures have to work with the wallet. We build identity integration so that adding a credential, a wallet in Europe or MyDigital ID in Malaysia, is a configuration change.
SourceRegulation (EU) 2024/1183, EUR-Lex (opens external site)
- Interoperable Europe ActScopeEU law
In application since 12 July 2024. From 12 January 2025, a public body assesses interoperability before it decides on a trans-European digital public service that is new or substantially changed, and reuse of shared solutions, open source included, is encouraged.
What it means in practiceWe help prepare the assessment, reuse building blocks that already exist and document interfaces so that other administrations can take over what is built.
SourceRegulation (EU) 2024/903, EUR-Lex (opens external site)
- Single Digital Gateway and once-onlyScopeEU law
Since 12 December 2023, people using key cross-border procedures in the EU can have evidence passed directly between authorities through the Once-Only Technical System, rather than uploading it themselves.
What it means in practiceEvidence exchange has to rest on the user’s request, show a preview first and leave a log entry. We wire national data exchange platforms and once-only connectors into the service flow.
SourceRegulation (EU) 2018/1724, EUR-Lex (opens external site)
- Web Accessibility Directive and EN 301 549ScopeEU law
Websites and mobile apps of EU public bodies must conform to EN 301 549, the harmonised standard built on WCAG, and carry an accessibility statement with a way to give feedback. Each Member State transposes the Directive into its own law.
What it means in practiceWe build to WCAG 2.2 level AA and test with assistive technology. For services in Malaysia, we would agree the same level with you as the acceptance target and keep the accessibility statement accurate.
SourceDirective (EU) 2016/2102, EUR-Lex (opens external site)
- European Accessibility ActScopeEU law
In application since 28 June 2025 for key products and services such as banking, e-commerce, e-books and passenger transport. It binds economic operators rather than public bodies, but public tenders reuse its requirements and services run with private partners can fall within it.
What it means in practiceAccessibility belongs to every link in the delivery chain, so we write it into the acceptance criteria instead of auditing at the end. A Malaysian operator providing covered services to consumers in the EU is in scope as well.
SourceDirective (EU) 2019/882, EUR-Lex (opens external site)
- Data ActScopeEU law
In application since 12 September 2025. Public bodies may request data held by companies in cases of exceptional need, and providers of data processing services must make switching possible, with switching charges removed by January 2027.
What it means in practiceExit plans and data portability are part of the cloud architecture we design, so that changing provider becomes a planned project and not an emergency.
SourceRegulation (EU) 2023/2854, EUR-Lex (opens external site)
Procurement on the buyer’s terms.
In Malaysia, ePerolehan is the Ministry of Finance e-procurement system for government procurement, and each tender sets its own documents, terms and timelines. In EU Member States, open, restricted and negotiated procedures, competitive dialogue and framework agreements follow Directive 2014/24/EU as each country has transposed it.
Our procurement experience comes from public authorities in the EU. Public buyers expect documentation that answers every requirement of the tender, and that is how we already write: an answer per requirement, named team members, clear pricing structures and delivery plans an evaluation panel can score.
Market engagement
Where a buyer consults the market, we explain what is technically realistic without steering the specification. Early dialogue lowers the risk of a tender nobody can deliver.
Clarifications
We test the specification against the law, the standards and your current systems, and raise questions only through the official channel.
Proposal
A structured answer covering architecture, plan, team, security and accessibility, with an exit plan from day one.
Mobilisation
Once the award is final: named people, onboarding to your security rules and an agreed first release.
Delivery and handover
Reporting against the contract’s indicators, a documented handover and the return of your data, so the next procurement starts cleanly.
Hosting, control and security
- Hosting location agreed
The hosting location, control of encryption keys and where support staff work are agreed with you before build and recorded in the architecture and the contract.
- Exit plans from the start
Open standards, documented data models and infrastructure as code keep the cost of switching visible.
- Reuse before building
Reusable public components and open-source options are assessed first, and their licence terms are documented.
- Certified security management
FromNine holds ISO/IEC 27001 certification. Controls, supplier management and incident handling run under the certified information security management system.
- Ready for Act 854 duties
Where your organisation is an NCII entity, incident channels, vulnerability handling and supplier transparency are agreed per contract, so you can notify an incident within six hours.
Data exchange and asking once
Illustrative example
Sign-in, the service portal and the case system sit above a data exchange layer that reads from the registers holding the data.
Read the diagram as text
A person or business signs in to a service portal with a national digital identity, such as MyDigital ID, or in Europe with an eID or EU Digital Identity Wallet. A service assistant can answer questions and open the correct form.
The portal hands the request to the case system, where an officer reviews exceptions and makes decisions.
Portal and case system read the data they need through a data exchange platform. The platform retrieves data from the registers that hold it, such as identity, company, and tax and benefits records, and logs every access.
For cross-border procedures in the EU, the exchange platform links to the Once-Only Technical System, which exchanges evidence with authorities in other Member States.
Read from the owning register
Services fetch data from the register responsible for it, through an exchange platform, rather than keeping copies of their own.
Standards before interfaces
Reference architectures and semantic standards shape the interfaces we design; in Europe that includes the European Interoperability Framework.
Mandate and logging
Every exchange has a documented mandate, a purpose and a log entry that the user and an auditor can trace.
Cross-border within the EU
For EU procedures covered by the Single Digital Gateway, services connect to the Once-Only Technical System through national access points.
Accessibility as a standard requirement
WCAG 2.2 AA as the minimum
We design and test to WCAG 2.2 level AA, the basis of EN 301 549 in the EU, so a service meets current requirements and is ready for the next revision.
Tested by tools and by people
Automated checks in the delivery pipeline, manual audits with keyboard and screen readers, and sessions with disabled users wherever you can arrange them.
Plain language in Malay and English
Content written for the task the reader has to complete, of equal quality in each language the service offers.
Accurate statements
We help you keep the accessibility statement and the feedback route correct as the service evolves.
Digital identity
MyDigital ID
For services in Malaysia, sign-in can be designed around MyDigital ID, the national digital identity. In Europe we integrate national eID schemes through their official brokers.
Wallets in Europe
For European services, wallet sign-in and verifiable attestations are added next to existing schemes, so users choose and the service does not split in two.
Minimum data, visible sharing
Ask only for the attributes a service needs, show the user what is shared and keep a record of it.
Acting for others
Acting on behalf of a company or another person, which most licence and grant processes require.
Public-sector types we design for
Federal ministries and agencies
Shared platforms, registers and back-office systems used across a ministry and its departments.
State governments
State departments with their own services, licences and enquiries from the public.
Local authorities
City, municipal and district councils: licences, local fees, local services and contact with residents.
Statutory bodies
Bodies set up by an Act of Parliament or a state enactment, often running grants, registrations or regulated services.
Government-linked companies
Companies under government control whose systems answer to commercial and public accountability at once.
Illustrative scenarios
Illustrative exampleGrant application intake
At a statutory body, applications and supporting documents would be sorted and checked for completeness. An officer reviews every flagged item and makes the decision.
Public enquiries in Malay and English
An assistant would answer questions about procedures in both languages, cite the page it relied on and pass the enquiry to staff when judgement is needed.
Circular and guideline search for officers
Officers would search circulars, guidelines and procedures in one place. Results follow access rights, and each answer links to its source.
Licensing system replaced in stages
At a local authority, an ageing licensing application would be replaced module by module behind a stable API, with data reconciled at each step and the old system switched off last.
Public complaint handling
Complaints would be logged, sorted by topic and matched to the responsible unit, with a draft reply prepared. An officer approves every response before it is sent.
Two workflows from start to finish
How the parts work together day to day. Both are illustrative workflows, not client work.
Public service: from first question to completed request
Illustrative workflow- Step 01Sign in
The user signs in with a national digital identity, such as MyDigital ID. The service requests only the attributes it needs.
- Step 02Ask or apply
An assistant answers in Malay or English from approved sources, or opens the correct online form.
- Step 03Prefilled data
Data already held is fetched once from the register that owns it and shown to the user to confirm.
- Step 04Routed with history
The request reaches the responsible unit together with its history, so nobody asks the same question twice.
- Step 05Officer decides
Human checkpoint. Officers deal with exceptions and every question of judgement. The assistant never decides on entitlements or approvals.
- Step 06Outcome sent
Status and outcome appear in the user’s account, with a clear route to appeal.
Case handling: from incoming file to a decision someone owns
Illustrative workflow- Step 01Intake
Applications come in through the portal, by email or by post; scanned post joins the same queue.
- Step 02Sort and extract
Each document is sorted and its key fields are extracted, with a confidence score per field.
- Step 03Completeness check
Rules list what is missing and draft a request for the outstanding information.
- Step 04Officer review
Human checkpoint. An officer confirms uncertain fields and makes the decision. Suggestions are marked as suggestions.
- Step 05Record
Decision, reasons and the data relied on are written to the case system and the audit log.
- Step 06Improve
Officer corrections feed the evaluation set, so quality is measured at every release.
Platforms for public bodies
Salesforce
Summit PartnerGrant and case processes and contact centres for the public, linked to back-office registers and to sign-in through a national digital identity.
SAP
Gold PartnerFinance, human resources and procurement for public bodies, with SAP connected to case systems and data platforms while the core stays stable.
Odoo
Gold PartnerA practical back office for smaller agencies and statutory bodies, with open-source licensing options to weigh.
FromNine holds the partner levels shown. Product names belong to their respective owners.
Malaysia
The Malaysian public sector and what we bring to it
The Malaysian public sector has its own frame: federal ministries and agencies, state governments, local authorities, statutory bodies and government-linked companies (GLCs), with the National Digital Department (JDN) under the Ministry of Digital responsible for digitalising government services. ePerolehan is the Ministry of Finance e-procurement system for government procurement, and MyDigital ID offers services a national sign-in.
The Personal Data Protection Act 2010 does not apply to the Federal and State Governments (section 3(1)); for their services we work to the government’s own policies and guidelines. Where a public-sector organisation is designated as an NCII entity, it carries the duties of Act 854.
What we bring is European: 600+ government projects for public authorities in EU Member States. For a reader in Malaysia, that experience means audit trails, accessibility and documentation built to survive procurement and audit.
- Interoperable Europe ActInteroperable Europe Act, Regulation (EU) 2024/903 (opens external site)
- eIDAS 2eIDAS 2 / EU Digital Identity Wallet, Regulation (EU) 2024/1183 (opens external site)
- Cyber Security Act 2024Cyber Security Act 2024 (Act 854): National Critical Information Infrastructure duties and licensing of cyber security service providers, administered by NACSA (opens external site)
- Ministry of DigitalMinistry of Digital (Kementerian Digital) (opens external site)
- National Digital Department (JDN)National Digital Department (Jabatan Digital Negara), formed in December 2023 from MAMPU, under the Ministry of Digital (opens external site)
- MyDigital IDMyDigital ID, the national digital identity, run by My Digital ID Sdn Bhd (opens external site)
- ePerolehanePerolehan, Ministry of Finance e-procurement system (opens external site)
Frequently asked questions
Where does your public-sector experience come from?
From 600+ government projects for public authorities in EU Member States, some completed and others still running. We name a public body only with its permission, and references are shared inside procurement procedures on the terms the contracting authority sets.
Can a Malaysian public body buy from FromNine?
ePerolehan, the Ministry of Finance e-procurement system, is used for government procurement, and each tender sets its own eligibility conditions. Tell us which procurement route you are planning, and we will say plainly whether FromNine can take part before you invest time in it.
How do you handle AI in public services?
We classify each use case in discovery. Where an EU public body deploys a high-risk system, such as one deciding on benefits, we build in oversight, logging and documentation and prepare input for its fundamental rights impact assessment. For public bodies in Malaysia we apply the same discipline of human oversight, logs and documentation.
Where would our data be hosted?
Where you decide. The hosting location, encryption key control and support locations are agreed with you before build, recorded in the contract and documented in the architecture, including sovereign options where your policies call for them.
Do you build to accessibility standards?
Yes. We design and test to WCAG 2.2 level AA, which also underlies EN 301 549 in the EU, combine automated and manual tests, and help you keep the accessibility statement current.
Can a service run in Malay and English?
Yes. Interfaces, content, assistants and documentation can be built for Malay and English, and for other languages where users need them, with equal quality in each. Your team approves the content in each language before release. We work with you in English.
Plan your public-sector programme
Preparing a modernisation, a service in Malay and English or an AI service that must stand up to audit? Take it through with a team that has written tenders, accessibility evidence and audit trails for public authorities in the EU.