In application
Rail passenger rights: Recast rail passenger rights apply
Travel information, through-tickets and compensation rules for rail passengers across the EU.
Transport & Infrastructure
Asset, traffic and traveller data that keeps networks moving.
What we build for rail and road infrastructure managers, transport operators, ports and airports: integration across asset, operations and passenger systems, data platforms for maintenance and open data, knowledge for field and control room staff, and IT/OT security designed for NIS2.
For infrastructure managers and operators working across several EU Member States, with one European network and many national rulebooks.
28 June 2025
Accessible passenger transport services
Websites, apps, e-tickets and real-time travel information of passenger transport services must meet the accessibility requirements.
17 July 2026
Critical entities identified
Member States designate the critical entities in transport and other sectors, which then assess risks and take resilience measures.
2 December 2027
AI Act duties for road traffic
AI used as a safety component in the management and operation of road traffic is high-risk; application date as amended in 2026.
What is changing for infrastructure managers and operators
Capacity is the scarcest asset
Rail lines, roads, locks and terminals run close to their limits, while works, maintenance windows and timetables compete for the same capacity. The revised TEN-T Regulation sets dates to complete the core network by 2030 and the extended core network by 2040, so renewal and operation have to be planned together.
Data sharing becomes an obligation
The revised ITS Directive and its delegated acts require road authorities and transport operators to make defined data available through National Access Points, in standard formats such as DATEX II, NeTEx and SIRI. Open data stops being a project and becomes a service with quality expectations.
SourceDirective (EU) 2023/2661
Operational technology is now inside cyber law
NIS2 lists air, rail, water and road transport among the sectors of high criticality, from infrastructure managers and railway undertakings to port authorities and road traffic management. IEC 62443 and the railway specification CLC/TS 50701 give engineering teams a shared approach to zones, conduits and security levels.
SourceDirective (EU) 2022/2555
Assets age, and so does the expertise
Bridges, tunnels, interlockings and quay walls built decades ago need more inspection and better decisions, while the engineers who know their history retire. Condition data, inspection reports and drawings have to be in one place, searchable by the next generation of crews.
Challenges and what we build
- The challenge
Design models, GIS, maintenance systems and spreadsheets each hold a different version of the same asset.
Our responseIntegration on open standards such as IFC 4.3 and railML, with an event backbone, so design, construction and maintenance share one asset register and every change to the network is recorded once.
- The challenge
Inspection reports, photos and defect notes arrive faster than engineers can process them.
Our responseDocument intelligence that reads inspection and survey reports, links each finding to the asset and proposes a maintenance notification for an engineer to confirm, with the source page attached.
- The challenge
Travellers expect accurate information across operators, and the law now expects open data too.
Our responseA data platform that combines timetables, real-time positions and disruptions, publishes NeTEx, SIRI or DATEX II feeds to the National Access Point and monitors their completeness and timeliness.
- The challenge
Every new data flow out of signalling, tunnel or traffic control systems widens the attack surface.
Our responseIT/OT architectures with zones and conduits following IEC 62443 and CLC/TS 50701, one-way data transfer where the risk calls for it, central identity and the logging that NIS2 incident reporting depends on.
- The challenge
Field crews and control room staff search procedures, drawings and work history across several systems.
Our responseA knowledge assistant over procedures, asset records, inspection reports and past work orders, citing document and revision. It informs; it never sets a route, issues a movement authority or changes a traffic control setting.
- The challenge
Contact centres are overwhelmed during disruptions, works and timetable changes.
Our responseService assistance that answers disruption, journey and compensation questions from the source systems and hands complaints and special cases to staff, in every language your passengers use.
Transport IT/OT reference landscape
The control levels stay intact. A network data integration layer, built on events and open standards, makes operational data available above the zone boundary, where asset, analytics, knowledge and open data services use it.
Illustrative example
Operational data crosses the zone boundary once, through the integration layer, and is reused by every service above it.
Read the diagram as text
The diagram shows five levels from top to bottom: level 4 the enterprise with ERP, asset management, ticketing and customer systems; level 3 operations with traffic management, timetable and capacity planning and port and airport operations; level 2 supervisory control with interlocking control and tunnel and road traffic SCADA; level 1 field equipment with signals, point machines, axle counters, sensors and message signs; and level 0 the physical network: track, roads, bridges, tunnels, quays and locks.
A zone boundary based on IEC 62443 and CLC/TS 50701 separates level 4 from the levels below.
Levels 1 to 4 deliver data to a network data integration layer built on events and open standards. That layer feeds an asset, traffic and traveller data platform, which supports condition, capacity and punctuality analytics, a knowledge assistant for field and control room staff, and open data feeds and regulatory reporting.
Operations stay in control
Analytics and assistants read. Route setting, movement authorities and traffic control stay with the traffic management system, the interlocking and the operator on duty.
Zones and conduits
Segmentation follows IEC 62443 and CLC/TS 50701, with documented conduits and, where the risk calls for it, one-way data transfer out of the control zone.
One asset register
IFC 4.3 and railML give design, construction and maintenance a shared vocabulary, so a change to the network is recorded once and reused everywhere.
Open data by design
Feeds for the National Access Point come from the same platform as internal reporting, with checks on completeness and delay before they are published.
The regulatory timeline for transport and infrastructure
Accessibility, data sharing, cybersecurity and resilience rules arrive in quick succession, and rail, freight and maritime legislation add dates of their own.
In application
TEN-T: Revised TEN-T Regulation in force
Core network by the end of 2030, extended core network by the end of 2040, comprehensive network by the end of 2050.
In application
NIS2: National NIS2 rules apply
Air, rail, water and road transport are in scope; national transposition differs per country.
In application
European Accessibility Act: Accessibility requirements apply
Including websites, apps, e-tickets and real-time travel information of passenger transport services.
In application
EMSWe: European Maritime Single Window environment applies
Port-call reporting through harmonised national single windows.
In application
ITS Directive: First road data deadlines for the National Access Point
Traffic regulations, road works and safety-related events on the TEN-T core network, with further network and data types following until 2028.
In application
Rail telematics TSI: Telematics TSI in force
One TSI for passenger and freight telematics replaces TAP and TAF, with staged application until the 2030 working timetable.
In application
CER Directive: Member States identify critical entities
Identified entities then carry out risk assessments and take resilience measures.
Status as of 15 October 2026
Upcoming
eFTI: Authorities accept electronic freight transport information
Competent authorities must accept regulatory freight information made available through certified eFTI platforms.
Upcoming
AI Act: High-risk obligations apply
Including AI used as a safety component in the management and operation of road traffic, as amended in 2026.
Upcoming
Rail capacity regulation: Digital capacity and traffic management tools
Rules on traffic management information exchange and digital capacity tools apply; the new capacity process follows from the 2031 working timetable.
Regulation and standards reference
The instruments that most often shape data, integration and AI work for infrastructure managers and transport operators, and what each means for a delivery programme.
This overview supports planning conversations. It is not legal or regulatory advice, and national transposition and sector legislation add their own requirements. Dates reviewed on 15 October 2026.
- NIS2 for transportScopeEU-wide
Transport is a sector of high criticality. In rail, that covers infrastructure managers and railway undertakings; in air, air carriers, airport managing bodies and traffic management control operators; in water, shipping companies, port managing bodies and vessel traffic services; and on the road, road authorities responsible for traffic management control and operators of intelligent transport systems. Duties include risk management, incident reporting and supply-chain security.
What it means for your programmeOT security, supplier assurance and incident processes need evidence, not only policy. We design platforms and integrations with access control, logging and incident data in place from the start.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- ITS Directive and National Access PointsScopeEU-wide
Directive 2010/40/EU, as revised by Directive (EU) 2023/2661, is the framework for intelligent transport systems. Its delegated regulations require defined road, traffic and travel data to be made accessible through a National Access Point in each Member State, in standard formats, with deadlines that extend coverage step by step.
What it means for your programmeData that used to be published on request now has to be available, current and machine-readable. We build the data pipelines, format conversion and quality monitoring behind it.
SourceDirective (EU) 2023/2661, EUR-Lex (opens external site)
- Multimodal travel informationScopeEU-wide
Delegated Regulation (EU) 2017/1926, as amended by Delegated Regulation (EU) 2024/490, sets out which static and dynamic travel data for all modes transport authorities and operators make available through the National Access Point, in NeTEx for timetables and networks and SIRI for real-time information. Disruption and real-time status data on the comprehensive TEN-T network are due from 1 December 2025, and on the rest of the network from 1 December 2028.
What it means for your programmeTimetables, stops, accessibility information and real-time data need one consistent source. We connect planning and operations systems to NeTEx and SIRI feeds and check them before publication.
SourceDelegated Regulation (EU) 2017/1926, EUR-Lex (opens external site)
- European Accessibility Act for passenger transportScopeEU-wide
Since 28 June 2025, websites, mobile apps, electronic tickets and ticketing services and real-time travel information of air, bus, rail and waterborne passenger transport services must meet accessibility requirements, through national laws.
What it means for your programmeJourney planners, ticket shops and disruption messages are in scope. We design and test them against WCAG 2.2 AA and keep the accessibility statement current.
SourceDirective (EU) 2019/882, EUR-Lex (opens external site)
- Rail passenger rightsScopeEU-wide
Regulation (EU) 2021/782 applies since 7 June 2023. Railway undertakings and ticket vendors must give passengers travel information before and during the journey, where possible based on real-time data, and handle assistance, re-routing and compensation within set time limits. Infrastructure managers distribute real-time arrival and departure data to railway undertakings, ticket vendors and station managers.
What it means for your programmeDisruption information and compensation claims are data processes. We connect operations, ticketing and customer service so that passengers get consistent answers and claims are handled on time.
SourceRegulation (EU) 2021/782, EUR-Lex (opens external site)
- Rail telematics and capacityScopeEU-wide
Implementing Regulation (EU) 2026/253, the telematics TSI, replaces the separate TSIs for passenger (TAP) and freight (TAF) telematics, with staged application and timetable data available free of charge through the National Access Points. Regulation (EU) 2026/1184 on rail infrastructure capacity adds rules for digital capacity planning and traffic management information exchange from the end of 2027.
What it means for your programmeTimetable, path and train running data move to common message formats and shared tools. We connect planning, operations and customer systems to them without disturbing the systems that run the trains.
SourceImplementing Regulation (EU) 2026/253, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU-wide
The CER Directive covers the physical and organisational resilience of critical entities, with transport among its sectors. Member States identify critical entities by 17 July 2026; those entities then assess risks and take technical, security and organisational measures.
What it means for your programmeContinuity planning spans cyber and physical events. The systems we build come with documented dependencies and tested recovery paths.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and transportScopeEU-wide
AI systems intended as safety components in the management and operation of road traffic are high-risk under Annex III; under the Act as amended in 2026, these duties apply from 2 December 2027. For rail interoperability, marine equipment, vehicles and unmanned aircraft, the requirements reach the sector through the legislation listed in Annex I, Section B, as its delegated and implementing acts are updated.
What it means for your programmeWe classify each use case early. Assistants and analytics that inform people are designed and documented differently from systems that act on traffic, which stay out of scope unless the high-risk regime is planned for.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Illustrative use cases
Illustrative exampleInspection findings into the asset register
Bridge, tunnel and track inspection reports read, each finding matched to the asset and proposed as a maintenance notification for an engineer to confirm.
Procedures and history for field crews
Crews ask in their own language and get the procedure, the asset history and the relevant drawings, with sources. Operational decisions stay with the control room.
Disruption questions at peak times
Passengers get the current status, alternatives and their compensation options from the source systems; staff take over complaints and special assistance.
Freight and permit documents
Transport documents, permits and certificates read and checked for completeness before a planner or inspector looks at the exceptions.
Legacy planning systems behind APIs
An older timetable, possession or maintenance planning system wrapped in documented APIs and replaced function by function, while operations keep running.
Platforms in transport and infrastructure
SAP
Gold PartnerSAP S/4HANA asset management, including linear asset management for track, roads and pipelines, with maintenance planning, procurement and finance in one system.
Salesforce
Summit PartnerCustomer service, passenger and freight customer accounts and field service, integrated with ticketing, operations and asset systems.
Odoo
Gold PartnerProjects, field service, inventory and invoicing for contractors, terminal operators and smaller transport companies.
Partner levels are those held by FromNine. Product names are trademarks of their respective owners.
International
One European network, many national rulebooks
Trains, trucks and ships cross borders every day, but the rules around them are only partly European. TEN-T, the ITS Directive, rail interoperability and NIS2 apply across the EU; National Access Points, data profiles, safety authorities and national cybersecurity laws differ per Member State. Infrastructure managers coordinate through bodies such as RailNetEurope and the European Rail Infrastructure Managers, and rail safety and interoperability run through the European Union Agency for Railways.
We build integration and data platforms on European standards such as IFC, railML, NeTEx, SIRI and DATEX II and keep national profiles and reporting in their own adapters, so an organisation active in several countries keeps one architecture.
Frequently asked questions
Will your software control trains, traffic or vessels?
No. By default, analytics and assistants only read operational data. Route setting, movement authorities, traffic control and signalling stay with the systems and operators that are accountable for them, under your change control.
Do you build safety-related signalling or control software?
No. We do not develop software that has to be certified to the CENELEC railway safety standards or comparable safety regimes. We integrate with those systems through defined, documented interfaces, usually read-only, and keep our components outside their safety case.
Which data standards do you work with?
IFC 4.3 and railML for infrastructure and asset data, NeTEx and SIRI for public transport timetables and real-time information, and DATEX II for road traffic data. Systems with their own formats are mapped to these standards at the integration layer.
Can you take over the publication of our data to the National Access Point?
We build and run the data pipelines, format conversion and quality checks behind the publication. The decision on what you publish, and the responsibility for it, stays with you.
How do you support NIS2 as a supplier to a transport operator?
Our information security management system is certified to ISO/IEC 27001. We agree security requirements and incident notification in the contract, work with least-privilege, logged access to your environments, and document our components so they fit your supply-chain risk assessment.
Do we have to replace our asset or planning systems?
No. We integrate by default and modernise in steps: APIs around the existing system first, then function by function where it pays off, with reconciliation until the old path is retired.
Discuss your transport or infrastructure programme
Connecting asset and inspection data, publishing open data to a National Access Point or securing IT/OT data flows? Start with one corridor, one asset class or one data flow.