Since 1 October 2025 the Digital Security Act has covered waterworks that produce at least 2,000 m³ a day, with Mattilsynet as supervisor from autumn 2026, and a waterworks must make sure that its suppliers meet its security requirements (Mattilsynet). So these are the answers we give, each one something you can check without us. The duties are the waterworks'; nothing here makes anyone compliant.
What runs, and what it touches
One program on one machine you already have: a server, a virtual machine, a PC, or a locked-down container in your own cloud account. It reads export files that your control system already makes, in a folder: CSV or Excel, in the plant's own language and clock. It has no connection to a PLC, a SCADA server or a historian, so it has nothing to write through (an optional OPC UA reader, off unless you turn it on, reads from the plant's own server and writes nothing); the assistant's tool for changing a setpoint exists only to be refused. It stands outside the control loop: if the machine stops, the plant runs as before.
No door in, nothing out
The console listens on 127.0.0.1 only, so nothing on the network can reach it. It answers only requests addressed to localhost, so a web page in the operator's own browser cannot point a name of its own at the machine and read the plant (the attack is called DNS rebinding), and it accepts a change only from its own page. The language model runs on the same machine. There is no licence server and no telemetry.
Your security team can check it: a sealed run that ships with it blocks every connection to any address that is not the machine itself and then runs a full working day through the product. If anything reached out, the run fails and names what it reached for. You can also watch it with a packet capture of your own.
What it keeps, and who owns it
Everything it writes sits in the plant's own folder in open formats (JSON and TOML): the result, the answers people on site gave, the questions asked. A name is stored only if someone types who answered a tag. A backup is a copy of the folder. You own all of it, including if you stop.
A bad file is a note, not an outage
Each export is read on its own. A file that cannot be read, a huge field, binary junk, a broken workbook, an XML entity bomb, or an Excel file that would unpack to more than 4 GB, becomes a line on the list of what was skipped, and the files beside it are still read. Instructions hidden in a tag name or a PDF cannot make the assistant act or write a number: it can only point at one of the plant's own facts, or say there is none.
What is in a release
Every outside component is pinned to a SHA-256 in the build. From the next release, each bundle carries a CycloneDX bill of materials and a checksum of every file, and a signature you check with OpenSSH, which Windows 10 and later, macOS and Linux already have. Nothing updates itself: you decide when a new version comes in. The language model is Ministral 3 (3B) from Mistral AI in France, Apache 2.0, and can be swapped.
What is not there yet
We say it before you ask. Roles in the console choose what each job sees; they are not access control, and the console has no login of its own yet. Today access is the machine's own login, which you can put behind multi-factor authentication. Logs cannot yet be sent to a SIEM. The signing key is not published yet. Source code escrow and an incident clause are not yet in a contract. We have no IEC 62443 certification. And we have not yet read an export from a Norwegian waterworks: ours so far come from utilities and plants that published their data in Denmark, the United Kingdom, Germany and Spain, and a test rig.
The full security pack, with the regulation's § 10 point by point, a threat model and input for your risk assessment, is sent on request: [email protected]. If you are the integrator or consultant who serves the plant, this is for you.