Critical Infrastructure Regulations Are Demanding One Risk Picture. Two EAM Systems Can't Provide It.

In June 2026, Australia's Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules came into force. They cover critical electricity assets, critical gas assets, critical water assets, critical liquid fuel assets, and several other sectors — with staggered compliance deadlines running through June 2027 and June 2028. The US is on a parallel track: DHS held stakeholder consultations in early 2026 on finalising CIRCIA's mandatory incident reporting framework, while the expanded NERC CIP standards brought low-impact substations and remote facilities into scope for cybersecurity controls for the first time.

The common thread across both jurisdictions: regulators are no longer satisfied with sector-level assurances. They want a unified, auditable picture of physical asset risk — who owns which asset, in what condition, with what dependency relationships to adjacent assets, and what controls are in place. They want it producible on demand. And they want a traceable record of every maintenance decision affecting high-criticality assets.

The vast majority of operators subject to these rules manage both linear network assets and discrete facility assets. That is exactly the combination these requirements are hardest to satisfy with.

The two-database problem

Utilities, transit authorities, and energy companies with mixed portfolios almost universally end up with two EAM systems — one that grew out of GIS for the linear network, another that grew out of CMMS for the facilities. This happened for legitimate reasons. Linear assets — pipelines, transmission corridors, water distribution mains, rail track — are spatial and topological. Their failure modes propagate across a network. Managing them well requires GIS-native data structures, network-graph reasoning, and cascade failure simulation. The right question when a segment of AC water main degrades is not just "when will it fail?" but "which pressure zones, pump stations, and downstream customers are exposed, in what sequence, and how quickly?"

Discrete assets — treatment plants, compressor stations, substations, maintenance depots — are hierarchical. A facility contains systems, systems contain equipment, equipment contains components. Performance is tracked against ISO 14224 taxonomies, with OEE-grade telemetry flowing upward through the hierarchy. Failure modes follow parent-child relationships, not network topology.

Both approaches are correct for their domain. The problem emerges when a regulator asks for a single, consolidated physical asset risk register and the operator has to reconcile two databases with different asset ID schemes, different metadata models, and different update cadences. In practice, that reconciliation is a quarterly spreadsheet exercise run by whoever knows where the records actually live. It is slow, error-prone, and — critically — not defensible as an auditable process.

What the data gap costs

Beyond the compliance problem, fragmented asset data sets a hard ceiling on what AI can do. Machine learning models for predictive maintenance can now forecast asset failures six to twelve months in advance with accuracy rates exceeding 85%. But a model that sees compressor station vibration data cannot factor in the maintenance state of the gas corridor it serves if that corridor data lives in a separate system with no shared asset identifier. The model is reasoning over an incomplete picture.

This matters for compliance in a specific way. The new regulatory frameworks — SOCI's enhanced risk management program rules, NERC CIP's expanded scope, CIRCIA's incident reporting requirements — are converging on a shared principle: AI recommendations affecting critical infrastructure must be traceable, not just statistically accurate. An 85% accuracy rate is not a compliance argument. A decision log showing what inputs the model used, what alternatives it evaluated, and what threshold triggered the action is.

If the AI is reasoning from incomplete data — because 70% of the relevant asset graph is in a different system it cannot see — the decision log is incomplete too. The audit fails not because the AI got the answer wrong, but because it was never given the full question.

For a deeper look at how linear network data modeling differs from discrete hierarchy management at the AI layer, see our linear asset management knowledge guide.

One platform, one risk picture, one audit trail

The architectural requirement follows from the compliance requirement. A platform capable of natively representing both linear topology and discrete hierarchy — not via a nightly ETL between two vendor systems, but at the data model level — can produce the unified asset risk register regulators are asking for as a system output, not a manual reconciliation task.

That means a shared asset ID that survives the crossing between the network and the facility. A pump station on a water main, a substation on a transmission corridor, a compressor station on a gas pipeline — these assets live at the intersection of two domains. Their criticality can only be scored correctly when both domains are visible.

It also means an AI agent layer that knows which reasoning model applies to which asset — network-graph traversal for the linear segment, hierarchy-aware failure mode analysis for the discrete facility — and that can cross the boundary when a maintenance recommendation touches both. Every agent action is logged with its full decision trace: inputs, confidence, alternatives considered. The audit trail is a byproduct of how the system works, not a separate documentation exercise.

For operators facing the 2027 compliance deadlines under SOCI or the ongoing expansion of NERC CIP scope, that distinction between "we can produce this report" and "we cannot produce this report without a manual data exercise" is increasingly consequential.

The question to ask before the deadline

If your organisation sits in scope for any of the major critical infrastructure frameworks currently being tightened — SOCI, CIRCIA, NERC CIP — a reasonable starting question for your EAM vendor is this: can you produce a complete, auditable physical asset risk register, including dependency relationships between my linear network assets and my discrete facilities, without manual data reconciliation between two systems?

If the answer requires a data export, a third-party integration, or a quarterly spreadsheet — you have a compliance gap. And the regulators have timelines.

Curious how UniEAM handles both? Request a demo.