How a Danish energy utility remediated its NIS2 audit and cut cloud costs by 31%

The audit that forced the issue

The trigger was not a breach. It was a letter. The Danish Energy Agency completed a routine audit of the utility’s operational technology stack and found that real-time SCADA telemetry, the continuous pulse of sensor readings, switching events, and load-balancing signals from across the grid, was transiting infrastructure owned and operated by a US hyperscaler. Under NIS2’s critical-infrastructure obligations, that was not a grey area. The regulator issued a formal remediation notice and gave the organisation ninety days to resolve it.

The utility served roughly two million households. Any disruption to its grid-balancing systems during a migration carried real operational risk. The compliance clock was running, the engineering complexity was substantial, and the existing architecture had grown organically over five years on the hyperscaler’s platform, with event streaming, edge inference, and long-term analytics all tightly coupled to proprietary managed services.

The organisation needed a migration path that would satisfy the regulator, preserve operational continuity, and not simply trade one set of vendor lock-in for another.

The technical and compliance challenge

NIS2 critical infrastructure compliance for an energy operator is not satisfied by contractual assurances alone. The Danish Energy Agency’s concern was architectural: data was physically leaving EU-sovereign control at the network layer, regardless of what the service agreement said. The remediation notice required the utility to demonstrate that operational telemetry, from ingestion through processing to storage, never traversed infrastructure subject to non-EU jurisdiction.

The existing pipeline ingested roughly 140,000 sensor events per minute during peak grid load. Those events fed two downstream systems: a real-time grid-balancing model running inference at the edge, and a historical analytics platform used for capacity planning and regulatory reporting. Both were built on the hyperscaler’s proprietary streaming and ML-serving primitives. A straight lift-and-shift was not possible; the architecture had to be rebuilt around open, portable standards to avoid recreating the same dependency in a new location.

Egress costs were a secondary but significant problem. The utility’s telemetry volumes meant it was paying substantial cross-region data transfer fees every month, charges that had been accepted as the cost of the architecture rather than scrutinised as a line item. Moving to infrastructure with no transatlantic data paths would eliminate those charges entirely, but only if the new platform was designed correctly from the start.

What DIVERSITY built and how

The migration was anchored at DIVERSITY’s HEL1 facility in Helsinki, chosen for its geographic proximity to the Danish grid operations, its 100% renewable energy supply (relevant to the utility’s own sustainability reporting), and its dense connectivity into the Nordic region. A secondary presence at AMS1 in Amsterdam provided the dual-site failover configuration required under the utility’s own internal disaster recovery policy.

The event streaming layer was rebuilt on DIVERSITY’s EU sovereign event streaming infrastructure, replacing the hyperscaler’s proprietary service with a Kafka-compatible platform. The utility’s engineering team retained their existing producer and consumer code with minimal modification; the interface compatibility meant the application layer did not need to be rewritten, only reconnected. All telemetry from the SCADA network now ingested directly into HEL1, with synchronous replication to AMS1, and no data path touching infrastructure outside EU jurisdiction.

Edge inference for the grid-balancing model was migrated to DIVERSITY’s GPU inference platform. The model itself, a gradient-boosted load-forecasting system the utility’s data science team had trained in-house, was containerised and deployed without modification. Inference latency at HEL1 was comparable to the previous setup; the utility’s operations team reported no perceptible change in the responsiveness of the balancing system during the cutover period.

Sovereign cloud is not a compliance checkbox. For critical infrastructure operators, it is a statement about who controls the data path when the grid is under stress. That control has to be architectural, not contractual.

The historical analytics platform was migrated to DIVERSITY’s managed object storage and block storage, with the long-term dataset transferred under a structured cutover plan that kept both environments live in parallel for three weeks. This overlap period allowed the utility’s engineering team to validate data integrity and confirm that regulatory reporting queries produced identical outputs before decommissioning the hyperscaler environment.

DIVERSITY’s ISO 27001 certified infrastructure and contractual data residency guarantees provided the documentary evidence the utility needed for its regulator submission. The architecture diagram, combined with network-layer attestations confirming that no telemetry transited non-EU infrastructure, formed the core of the remediation package submitted to the Danish Energy Agency.

The outcome: compliance met, costs reduced

The regulator accepted the remediation submission with eleven days to spare inside the ninety-day window. The Danish Energy Agency’s review confirmed that the new architecture satisfied NIS2’s critical-infrastructure data residency requirements, and the formal notice was closed.

The financial outcome was not incidental. By eliminating cross-region egress charges entirely and consolidating onto infrastructure priced for high-volume telemetry workloads, the utility reduced its annual cloud spend by thirty-one percent. The savings were attributable almost entirely to egress elimination and more predictable compute pricing, not to any reduction in capability or redundancy. The dual-site configuration at HEL1 and AMS1 actually improved the utility’s formal DR posture compared to its previous single-region hyperscaler deployment.

The utility’s engineering team now operates a SCADA telemetry pipeline that is fully under EU sovereign control, portable across open standards, and cheaper to run than the proprietary stack it replaced. The compliance crisis that forced the migration turned out to be the catalyst for an architecture the organisation should have built from the start.

For energy operators navigating NIS2 critical infrastructure obligations, the lesson is direct: grid analytics data residency is a network-layer question, not a legal one. The answer has to be built into the architecture, and the architecture has to sit on infrastructure that answers to European law.