Mixed Portfolios, Fragmented Audits: Why CIRCIA Is Breaking the Case for Siloed EAM

When the Cybersecurity and Infrastructure Security Agency publishes its final CIRCIA rules, more than 300,000 entities across 16 critical infrastructure sectors will face mandatory incident reporting. The requirements are specific: report incidents with full operational context, within defined timescales, with sufficient detail for regulators to assess cascading risk.

For utilities managing both linear networks and discrete facilities — a water authority running both distribution mains and treatment plants, an energy company managing both transmission corridors and generation assets — this will surface a problem most organisations have quietly avoided: when something goes wrong in the network and cascades into the plant, which system tells the regulator what actually happened?

Most of the time, the honest answer is: neither, not cleanly.

The two-system trap

Utilities with mixed portfolios typically manage linear and discrete assets on separate platforms because, until recently, no single platform could handle both domains well. Linear assets — pipelines, distribution mains, rail corridors, electric transmission lines — are fundamentally network objects. Their behaviour is governed by topology: pressure gradients, flow paths, cascade failure propagation through connected segments. GIS-native tools and hydraulic modelling platforms were built for this.

Discrete assets — treatment plants, compressor stations, substations, manufacturing cells — are hierarchical objects. A treatment plant is a facility containing systems containing equipment containing components, each with its own maintenance schedule, OEE profile, and failure classification under ISO 14224. CMMS platforms and ERP bolt-ons were built for this.

Running two separate systems is a rational response to two genuinely different problems. The consequences of that choice, however, are becoming harder to absorb.

Where the audit gap lives

When a burst main triggers pressure loss across a distribution network and the downstream treatment plant loses buffer capacity, the regulator does not want two separate incident reports. They want one coherent account: what happened, in what sequence, across which assets, and what the maintenance history of every involved asset looked like in the preceding ninety days.

That account is very difficult to produce if the pipeline system and the treatment plant live in separate databases. The causal chain — which segment failed, what the upstream pressure at the pumping station was, what the station's maintenance backlog looked like, what the condition model said six months prior — spans both systems. Producing it manually, under a reporting deadline, from two platforms with different schemas and different event logs, is exactly the kind of failure mode that attracts regulatory attention rather than deflecting it.

Research from AquaAnalytics found that more than 70% of water utilities' assets are buried pipeline infrastructure — invisible without active monitoring, and extremely difficult to correlate with above-ground plant performance without deliberate data integration effort. That correlation is hard enough under normal operations. Under incident conditions, it is routinely inadequate.

Beyond water, the same dynamic applies across sectors. FERC has finalised new NERC CIP reliability standards for inverter-based resources and mandatory cybersecurity controls for control centre systems. The Pipeline Cybersecurity Preparedness Act has advanced through the House. Each of these frameworks is converging on the same demand: know your assets across their full operational context, and prove it.

The AI alignment problem

The case against siloed EAM has been building for years. What is accelerating it now is the industry-wide adoption of AI-driven operations — and the specific requirements that come with it.

A June 2026 SNS Insider analysis placed the global asset management market on a trajectory to $18 trillion by 2035, driven by AI, IoT, and predictive analytics at a 35% compound annual growth rate. More than two-thirds of maintenance teams plan to adopt AI within EAM by the end of this year. The business case is well-established: machine learning models operating on historical data and live sensor feeds now forecast equipment failures six to twelve months in advance, with accuracy rates exceeding 85% in bounded domains.

Bounded domains. That phrase carries weight. The accuracy figures vendors cite are typically from single-asset-type deployments: a manufacturing plant, a vehicle fleet, a pipeline corridor. When the same AI is asked to reason across both a linear network and the discrete facilities sitting on it — with data siloed in two platforms that do not share a data model — the effective accuracy degrades. The model cannot account for what it cannot see.

For linear assets, the relevant reasoning is graph-based: cascade propagation along connected segments, GIS-native context, dependency modelling across network topology. For discrete assets, the relevant reasoning is hierarchy-based: failure mode roll-up from component to sub-system to facility, OEE-grade telemetry aggregated by parent-child relationship. These are different computational problems. An AI agent layer that applies the right model to each asset type — and that can traverse the boundary between them — produces something neither silo can: a single, auditable decision trace covering the full operational picture.

That audit trail is what network-aware and hierarchy-aware asset management makes possible. It is also precisely what regulators will ask for when CIRCIA reporting goes live.

The practical question for 2026

If your organisation manages both linear networks and discrete facilities, the EAM consolidation question is no longer abstract. CIRCIA reporting requirements, NERC CIP audit standards, and pipeline cybersecurity legislation are collectively shaping a compliance environment in which fragmented operational records are a liability — not just an inconvenience.

The question is not whether to adopt AI in EAM. That decision is largely settled by market pressure and risk appetite at board level. The question is whether the AI can reason across your entire portfolio, or whether it goes dark at the system boundary between your network and your plant.

Regulators will not accept a gap at that seam. Your EAM platform should not have one either.

Curious how UniEAM handles both? Request a demo.