Applies now
Rail passenger rights: Recast EU rail passenger rights apply
Rules on travel information, through-tickets and compensation for rail travellers in the EU.
Transport & Infrastructure
Shipment, fleet and asset data that keeps goods and people moving.
For logistics firms, freight forwarders, warehouse operators, last-mile delivery firms and transport operators, we would connect asset, operations and customer systems, build data platforms for tracking and maintenance, give field and control room staff searchable knowledge, and secure IT/OT links for the Cyber Security Act 2024 (Act 854) where an organisation is an NCII entity.
For logistics firms, freight forwarders, warehouse operators and transport operators in Malaysia, including those that move goods or people in the EU.
26 August 2024
Cyber Security Act 2024 in operation
An NCII entity carries risk assessment and audit duties and must notify a cyber security incident within six hours.
SourceCyber Security Act 2024 (Act 854) (opens external site)
1 June 2025
PDPA breach notification in force
Under the Personal Data Protection Act 2010 (PDPA), data controllers notify breaches of customer, consignee or passenger data to the Commissioner.
SourcePersonal Data Protection Act 2010 (Act 709) (opens external site)
28 June 2025
EU accessibility rules for passenger transport
Passenger services sold to consumers in the EU must make their sites, apps, e-tickets and live travel updates accessible.
What is changing for transport and logistics firms
Capacity is the constraint
Warehouse space, vehicles, yards and road slots are booked close to the limit, and peak seasons, servicing and delivery windows all draw on the same capacity. In the EU, the revised TEN-T Regulation fixes 2030 for completing the core network, which ties renewal plans to daily operation there.
Live data is now expected
Shippers and partners now expect to see where a consignment is at any moment. In the EU, the revised ITS Directive goes further: road authorities and transport operators publish defined data through National Access Points in DATEX II, NeTEx or SIRI, so data exchange runs as a service with quality targets.
SourceDirective (EU) 2023/2661
Operational technology under cyber law
Since 26 August 2024, Act 854 has placed risk assessment, audit and incident notification duties on National Critical Information Infrastructure (NCII) entities, with six hours to notify an incident. In the EU, NIS2 covers air, rail, water and road transport, and IEC 62443 gives engineers a shared approach to zones and conduits.
Ageing assets, departing experts
Bridges, quay walls, warehouses and vehicle fleets need closer inspection and better-informed decisions at the moment the staff who know their history are leaving. Drawings, inspection findings and condition data have to sit in one searchable place for those who follow.
Problems and how we would respond
- The problem
Design models, GIS, maintenance systems and spreadsheets each keep their own version of an asset.
How we would respondAn asset register shared by design, construction and maintenance, fed through an event backbone and open standards such as IFC 4.3 and railML, so each change is captured a single time.
- The problem
Inspection reports, photos and defect notes pile up faster than engineers can read them.
How we would respondDocument intelligence turns inspection and survey reports into findings tied to the right asset, each with a draft maintenance notification and the source page, for an engineer to approve.
- The problem
Customers want accurate shipment and journey information across carriers.
How we would respondA data platform that combines schedules, live positions, delivery events and disruptions into one feed for customers and partners, and for EU operations publishes NeTEx, SIRI or DATEX II to the National Access Point with checks on completeness and timeliness.
- The problem
Every data flow out of control, tracking or warehouse automation systems widens the attack surface.
How we would respondZones and conduits under IEC 62443, one-way transfer where the risk warrants it, central identity and logging complete enough to notify an incident within six hours where Act 854 applies.
- The problem
Field crews and control room staff look for procedures, drawings and history in several systems.
How we would respondAn assistant that searches procedures, asset records, inspection reports and earlier work orders and names the document and revision. It advises staff; route setting, movement authorities and traffic control settings are never touched.
- The problem
Customer service is swamped during disruptions, peak seasons and schedule changes.
How we would respondService assistance that answers delivery, disruption and claims questions from the source systems, in Malay and English, and hands complaints and special cases to staff.
IT/OT reference landscape for transport networks
The control levels are left as they are. Operational data reaches asset, analytics, knowledge and data-sharing services through one integration layer, built on events and open standards, above the zone boundary.
Illustrative example
Operational data leaves the control zone at a single point, the integration layer, and each service above it draws on that data.
Read the diagram as text
From the top: enterprise systems (ERP, asset management, ticketing, customer systems) at level 4; traffic management, schedule and capacity planning and port and airport operations at level 3; interlocking control and SCADA for tunnels and roads at level 2; signals, point machines, axle counters, sensors and message signs at level 1; and track, roads, bridges, tunnels, quays and locks as the physical network at level 0.
Between level 4 and the levels below runs a zone boundary set according to IEC 62443 and CLC/TS 50701.
Data from levels 1 to 4 flows into an integration layer of events and open standards, and from there into a platform for asset, traffic and traveller data. That platform supports analytics on condition, capacity and punctuality, an assistant for field and control room staff, and data feeds with regulatory reporting.
Operations keep control
Analytics and assistants read data and nothing more. Routes, movement authorities and traffic control belong to the traffic management system, the interlocking and the duty operator.
Zones and conduits
Network segmentation follows IEC 62443 and CLC/TS 50701; conduits are documented, and data leaves the control zone one way only where the risk demands it.
A single asset register
With IFC 4.3 and railML as the common vocabulary of design, construction and maintenance, a change to the network is entered once and used everywhere.
Data sharing by design
Customer feeds, partner feeds and, for EU operations, the National Access Point draw on the platform that serves internal reporting, after checks on completeness and delay.
EU and Malaysian dates for transport and logistics
Accessibility, data sharing, cyber security and resilience rules follow each other closely, and EU rail, freight and maritime legislation adds dates of its own.
Applies now
Cyber Security Act 2024: Act 854 in operation in Malaysia
Risk assessment, audit and six-hour incident notification duties for NCII entities.
Applies now
NIS2: National NIS2 laws take effect
Air, rail, water and road transport are covered; each EU country transposes in its own way.
Applies now
European Accessibility Act: Accessibility requirements take effect
Passenger transport websites, apps, e-tickets and live travel information included.
Applies now
EMSWe: European Maritime Single Window environment applies
Port-call reporting through harmonised national single windows in the EU.
Applies now
ITS Directive: First road data deadlines for National Access Points
Road works, traffic rules and safety events on the TEN-T core network first; further roads and data types follow up to 2028.
Applies now
Rail telematics TSI: Telematics TSI in force
TAP and TAF merge into one TSI for passenger and freight telematics, phased in up to the 2030 working timetable.
Applies now
CER Directive: EU Member States identify critical entities
The entities identified then assess risks and take resilience measures.
Status on 15 October 2026
Coming
eFTI: EU authorities accept electronic freight information
Authorities must take regulatory freight data from certified eFTI platforms instead of paper.
Coming
AI Act: EU high-risk AI duties apply
Covering AI used as a safety component in managing and operating road traffic, under the 2026 amendment.
Coming
Rail capacity regulation: Digital capacity and traffic management tools
Rules on exchanging traffic management information and on digital capacity tools apply; the new capacity process starts with the 2031 working timetable.
Rules and standards in brief
These EU instruments matter to transport and logistics firms that operate in the EU or sell services to consumers there. Each entry closes with its practical consequence.
For planning discussions, not legal or regulatory advice. In the EU, national transposition and sector legislation add requirements. EU dates checked on 15 October 2026; Malaysian dates on 6 November 2026.
- NIS2 for transportScopeEU law
NIS2 treats air, rail, water and road transport as highly critical. Covered entities include rail infrastructure managers and operators, airlines and airport managing bodies, shipping companies and port managing bodies, and road authorities that control traffic. They manage risk, report incidents and secure their supply chain.
What it means in practiceFor EU operations, and for suppliers to EU operators, security needs evidence as well as policy. Our platforms and integrations come with access control, logging and incident data from the start.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- ITS Directive and National Access PointsScopeEU law
The EU framework for intelligent transport systems, revised in 2023. Delegated rules oblige operators and authorities to make specified road, traffic and travel data available through a National Access Point in each Member State, with coverage growing in steps.
What it means in practicePublishing data stops being an occasional favour and becomes a duty with freshness and format requirements. We build the pipelines, conversions and monitoring that keep it reliable.
SourceDirective (EU) 2023/2661, EUR-Lex (opens external site)
- Multimodal travel informationScopeEU law
Delegated Regulation (EU) 2017/1926, as amended in 2024, defines the travel data for each mode that goes to the National Access Point: NeTEx for networks and timetables, SIRI for live updates. Live status and disruptions are due on the comprehensive TEN-T network from 1 December 2025 and elsewhere from 1 December 2028.
What it means in practiceStops, timetables, accessibility data and live updates should come from one source. We connect planning and operations to NeTEx and SIRI output and check it before release.
SourceDelegated Regulation (EU) 2017/1926, EUR-Lex (opens external site)
- European Accessibility Act for passenger transportScopeEU law
From 28 June 2025, air, bus, rail and waterborne passenger services must make their websites, apps, e-tickets, ticket sales and live travel information accessible, through national laws. Services offered to consumers in the EU are covered whatever the operator’s home country.
What it means in practiceJourney planners, booking flows and disruption notices are covered. We build and test them to WCAG 2.2 level AA and keep the accessibility statement current.
SourceDirective (EU) 2019/882, EUR-Lex (opens external site)
- Rail passenger rightsScopeEU law
In force since 7 June 2023, Regulation (EU) 2021/782 obliges railway undertakings and ticket sellers to keep passengers informed, with live data where possible, and to arrange assistance, re-routing and compensation on time. Infrastructure managers share live arrival and departure data with them.
What it means in practiceCompensation and disruption messages depend on data flowing between operations, ticketing and service desks; we connect them so answers agree and claims meet their deadlines.
SourceRegulation (EU) 2021/782, EUR-Lex (opens external site)
- Rail telematics and capacityScopeEU law
A single telematics TSI, Implementing Regulation (EU) 2026/253, takes over from the passenger and freight TSIs and applies in stages, with free timetable data on the National Access Points. Regulation (EU) 2026/1184 adds digital capacity planning and traffic management data exchange from late 2027.
What it means in practiceRail timetable and running data are moving to shared formats and tools. Our integrations link to them and leave train control systems untouched.
SourceImplementing Regulation (EU) 2026/253, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU law
For critical entities in the EU, transport included, the CER Directive covers physical and organisational resilience. Member States name those entities by 17 July 2026, after which each one assesses its risks and puts measures in place.
What it means in practiceResilience plans should treat a cyber attack and a physical outage alike. Our systems ship with their dependencies documented and their recovery tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and transportScopeEU law
AI used as a safety component in road traffic management is high-risk under Annex III from 2 December 2027, after the 2026 amendment. For rail, vessels, vehicles and drones, the rules come in through the sector laws listed in Annex I, Section B, as those are updated.
What it means in practiceWe decide the risk class at the start. Tools that advise people are kept and documented apart from anything that acts on traffic, which we leave out of scope unless you plan for the high-risk regime.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Illustrative scenarios
Illustrative exampleInspection reports linked to assets
For bridges, warehouses and yards, each inspection finding would be tied to its asset and turned into a draft work order that an engineer approves.
Field crew knowledge on demand
Crews would ask in their own language and receive the procedure, asset history and drawings, with sources. Operational decisions remain with the control room.
Delivery questions at peak times
Customers of a last-mile delivery firm would see current status, options and claim routes from the source systems; staff handle complaints and special requests.
Shipping and customs documents
At a freight forwarder, bills of lading, invoices, permits and certificates would be read and checked for completeness before a planner reviews the exceptions.
Planning systems behind APIs
An older warehouse or fleet planning tool would get documented APIs, and its functions would move to new components one at a time without halting operations.
Platforms for transport and logistics
SAP
Gold PartnerAsset management in SAP S/4HANA, linear assets such as track, roads and pipelines included, together with maintenance planning, procurement and finance.
Salesforce
Summit PartnerCustomer service, shipper and passenger accounts and field service, connected to booking, operations and asset systems.
Odoo
Gold PartnerProjects, field service, inventory and invoicing for logistics firms, warehouse operators and contractors.
FromNine holds the partner levels shown. Product names belong to their respective owners.
Malaysia
Malaysian duties at home, EU rules on European routes
In Malaysia, an organisation designated as an NCII entity under Act 854 assesses and audits its cyber security risk, follows codes of practice and notifies incidents within six hours. Customer, consignee and passenger data falls under the PDPA, including breach notification to the Commissioner since 1 June 2025.
Operating in the EU, or selling transport services to consumers there, adds NIS2, the ITS Directive, the European Accessibility Act and rail passenger rights. Our integration and data platforms rest on open standards (IFC, railML, NeTEx, SIRI, DATEX II), with each country’s profiles and reporting held in separate adapters, so a single architecture covers every market.
- Cyber Security Act 2024Cyber Security Act 2024 (Act 854): National Critical Information Infrastructure duties and licensing of cyber security service providers, administered by NACSA (opens external site)
- Personal Data Protection Act 2010 (PDPA)Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727): data protection officer, breach notification, data portability (opens external site)
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- European Accessibility ActEuropean Accessibility Act, Directive (EU) 2019/882 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
Frequently asked questions
Would your software control vehicles, traffic or vessels?
No. Our analytics and assistants read operational data only. Signalling, traffic control, route setting and movement authorities stay with the accountable systems and operators, under your change control.
Do you develop safety-certified control software?
No. Software that needs certification under the CENELEC railway safety standards or a comparable regime is outside what we build. We connect to such systems through defined and documented interfaces, normally read-only, and our components stay outside their safety case.
Which data standards do you use?
For infrastructure and assets, IFC 4.3 and railML; for public transport schedules and live updates, NeTEx and SIRI; for road traffic, DATEX II. Anything in a proprietary format is mapped onto these in the integration layer.
Can you run the publication of our data feeds?
We build and operate the pipelines, format conversion and quality checks behind each feed, whether it goes to customers, partners or an EU National Access Point. What you publish, and accountability for it, stays with you.
How do you support Act 854 or NIS2 duties as a supplier?
FromNine’s information security management system is ISO/IEC 27001 certified. The contract sets out security requirements and how we notify incidents, our access to your systems is least-privilege and logged, and our components are documented for your supply-chain risk review.
Must we replace our asset or planning systems?
No. We integrate first and modernise in stages: APIs around the existing system, then function by function where the benefit is clear, with reconciliation until the old route can be switched off.
Plan your transport or logistics programme
Connecting asset and inspection data, sharing live shipment data or securing IT/OT data flows? Begin with a single route, asset type or data flow.