Energy & Utilities

A useful clarification first: NIS 2 applies to you, the regulated entity, not to us. A supplier cannot make compliance "native"; it can make it demonstrable. In practice we design the zone and conduit segmentation to IEC 62443, produce the incident register and risk analysis the regulator expects, and rehearse the continuity plan rather than document it. ANSSI counts around fifteen thousand entities in scope in France across eighteen sectors, against five hundred under NIS 1: the implementing decrees and the official list land during 2026, with the first inspections to follow.

Through the trail, not the promise. Every decision keeps its input variables, the contribution of each to the score, the business rationale and who validated what. REMIT requires five years of transaction record retention, which sets our default horizon, and the logs are exportable for the French energy regulator as well as for ACER. On the European AI regulation, the timing changed: regulation 2026/1744 of 24 July 2026 moved high-risk obligations to 2 December 2027 for standalone systems, and to 2 August 2028 for AI embedded in a regulated product. That extra time is for building the documentation, not for waiting.

On our energy engagements, we see ×4 short-term forecast accuracy, −12% balancing cost and +30% RES integration with no additional grid investment. Payback typically lands between 9 and 18 months, depending on portfolio size and sensor maturity.

Read-only first, replacing nothing. We connect through the protocols your systems already expose, IEC 61850 and OPC UA, and through the interfaces of the main control-system vendors. The analysis layer runs inside your perimeter or in sovereign cloud depending on how sensitive the data is. What takes time is not the protocol: it is reconciling your asset registers across the EMS, the DMS and the maintenance system, which rarely name the same equipment the same way.

Framing takes 2 to 6 weeks depending on scope, sector and the level of compliance required. A first orchestrated sub-portfolio in a real environment follows in 4 to 10 weeks, depending on system complexity and the number of integrations. Extending to the full portfolio, including training the control room teams, runs to 3 to 6 months. These ranges are the ones we apply everywhere, and each comes with what makes it vary: a duration announced without its variable only exists to be exceeded.

The first question to settle is whether you are still in scope. The Omnibus directive of 18 March 2026 raised the thresholds to one thousand employees and four hundred and fifty million euros of revenue, taking a large share of the initially covered companies out of the mandatory scope, and the later waves were postponed to 2028. For those still in scope, we automate the collection and the calculation, from sensor data through to the footprint per MWh generated. We do not automate the report itself: it goes through external assurance, and a chain claiming to replace that would expose you rather than protect you.