Digital Twins as Tools for Energy Transition: Data Governance, Cybersecurity, and Spatial Planning—A Multi-Case Study of Polish Energy Groups

Abstract

Digital twins (DTs) in the energy sector are operational-data-driven models of assets, installations, and networks. Their value grows alongside renewable expansion, electronic communications, and stricter resilience requirements for critical infrastructure. This study evaluates DT applications in Poland’s energy transition, identifying regulatory and cybersecurity determinants required for safe, scalable use. The methodology combines an international literature review, regulatory assessment, and qualitative desk research focusing on DT projects across four Polish energy groups: Enea, Energa, PGE, and Tauron. Each case is assessed using a DT maturity and governance framework covering scope, data coupling, decision support, and security posture. The study identifies four primary deployment types: (1) operational network twins for distribution system operators leveraging SCADA/ADMS, GIS, and state estimation; (2) AI-driven asset performance twins for wind turbines and CHP plants; (3) flexibility twins for hydropower system services; and (4) immersive training twins for the offshore wind sector. Main constraints include data quality, interoperability, fragmented data access regulations, and expanded cyber-attack surfaces from OT/IT convergence. DTs aid spatial planning, mitigating location and land use conflicts. Recommendations emphasize harmonized data governance, cybersecurity-by-design, special determinants, and the creation of regulatory sandboxes to support DT implementation within critical energy infrastructure.

1. Introduction

The energy transition in Europe is currently driven by the convergence of two equally significant forces—(i) legally binding decarbonization targets and (ii) growing geopolitical uncertainty—which is redefining priorities regarding security of supply and the resilience of critical infrastructure. The European Climate Law establishes a framework for achieving climate neutrality by 2050 and an interim target of reducing net greenhouse gas emissions by at least 55% by 2030 (compared to 1990), thereby increasing pressure to accelerate electrification based on renewable energy sources (RES) [1].

After 2022, the climate agenda became strongly linked to energy security, and the REPowerEU plan prioritized rapidly reducing dependence on Russian fossil fuels through infrastructure modernization and the digitalization of processes on both the demand and supply sides. These geopolitical events and the subsequent policy shifts have unambiguously linked decarbonization with energy independence, positioning the modernization and digitalization of transmission and distribution networks as an absolute infrastructural priority. Consequently, the pace of decarbonization and real progress in electrification is determined not only by the nominal increase in generation capacity but also by the system’s ability to locate, connect, and safely integrate new sources and loads—in both grid and spatial terms [2]—and, above all, by its capacity for the spatial allocation, connection, and secure integration of these highly distributed resources.

These conditions reveal a systemic problem: the insufficient pace of infrastructure development and modernization. With a significant share of variable renewable energy sources (VRES) and distributed energy resources (DER), precise grid monitoring and rapid response to changes—at every voltage level—become critical. The implementation of the European Green Deal’s objectives will not be possible without the deep digitalization of the sector, as emphasized by the European Commission, which stresses the implementation of systems supporting energy management in near-real time [2,3].

In this context, digital twins (DT) are becoming one of the key technologies of modern infrastructure, evolving from purely engineering tools into integrated platforms for spatial and infrastructure management. By creating virtual representations of physical objects continuously fed with operational data, they can support the monitoring, simulation, and optimization of systems at various stages of their operation [4]. According to ISO/IEC 30173:2023, a digital twin is a digital representation linked to its physical counterpart by a strict bidirectional data flow [5]. This informational relationship enables continuous diagnostics, “what-if” scenario simulations, and the optimization of both operational and spatial decisions. Such a structure generates mutual value through advanced analytics and decision-making support. At the EU level, this direction is also reflected int the European Commission’s initiative to develop a digital twin of the electricity grid [6]. Understood in this way, digital twins serve an integrating function: they combine operational data and models into an environment that supports monitoring, forecasting, and testing of decision variants—including infrastructure decisions with significant spatial consequences [5].

However, the effective scaling of DT solutions in the energy sector faces barriers in the area of governance, interoperability, and spatial planning. The most important of these include data quality and interoperability, data-sharing rules, and cybersecurity requirements, which are particularly vital for critical infrastructure. Decentralization processes and the expansion of the Internet of Things (IoT) increase the complexity of the OT/IT environment and, consequently, the potential attack surface [3]. In response to these challenges, it becomes essential to adopt a cybersecurity-by-design and secure-by-default approach, as well as to operationalize the requirements stemming from horizontal legal frameworks such as NIS2, CRA, and—where applicable—the AI Act [7,8,9]. At the same time, the development and operation of digital twins require consistent rules for data access, sharing, and reuse; at the EU level, the Data Governance Act and the Data Act are of significant importance here, as they establish a general framework for data trust, access, and portability, but do not replace sector-specific interoperability standards) [10,11].

An important aspect of implementing digital twins is their role in spatial planning. Investments in the energy sector are fundamentally linked to local planning conditions, and disputes over location can be a real obstacle to the transition. In Poland, the entry into force of the landmark spatial planning reform under the Act of 7 July 2023 (amending the Act on Spatial Planning and Development and certain other acts) has revolutionized national localization regimes. This reform replaces the previous studies of conditions and directions of spatial planning with mandatory “general municipal plans”, which constitute acts of local law. Crucially for digitalization, the reform mandates that these general plans be developed exclusively in the form of structured spatial data (GML format) and establishes a central, publicly accessible Urban Registry.

Integrating the technological and grid data of a digital twin with these digital planning registries (GML) creates a novel paradigm in spatial management, conceptualized in the literature as “digital kin” [12]. This synergy allows for the objectification of social and spatial conflicts—such as the Not-In-My-Backyard (NIMBY) phenomenon—by replacing subjective, discretionary disputes with precise, virtual simulations of the infrastructure’s environmental and spatial impact zone. This approach, by leveraging realistic visualizations of an investment’s landscape impact, enhances public dialog and facilitates consensus [13]. Consequently, it increases the effectiveness of energy projects. It allows for anticipating risks and reducing transaction costs by better aligning technology with the needs of local communities [12]. This direction is also supported by the EU’s energy digitization plan, which emphasizes tools that streamline permitting and increase transparency regarding grid connection capacity [3]. At the same time, a critical stance must be adopted toward “sandbox urbanism” (experimental urbanism), where advanced DT implementations often remain confined to short-term pilot phases without inducing permanent institutional change [14]. Furthermore, without incorporating equity-by-design principles, the implementation of a universal digital twin could exacerbate spatial polarization and energy poverty within the most socially vulnerable regions.

Although digital twins are frequently discussed in the context of Industry 4.0 or aviation, their adaptation in the energy sector presents unique challenges. These include strict safety standards, the need to interoperate with legacy systems, the long lifespan of assets, and a dense regulatory framework. However, there remains a lack of in-depth knowledge regarding how energy companies in Central and Eastern Europe are addressing these challenges in practice. Most of the literature focuses on technical aspects, treating governance issues—such as data access, accountability, and regulatory compliance—as side issues rather than key success factors. This article aims to fill that gap. In it, we analyze the DT initiatives undertaken by the four largest Polish energy groups (Enea, Energa, PGE, and Tauron), situating their activities within the context of EU law, cybersecurity, and local planning realities [15,16,17,18].

1.1. Research Objectives and Contribution

The main objective of this research is a multidimensional analysis of the role of DT as tools supporting the “twin transition” (green and digital) in the Polish energy sector. In the context of the priorities of the REPowerEU plan and the growing need to protect critical infrastructure, digitalization is becoming an indispensable foundation for the effective implementation of climate goals and the transition away from fossil fuels [2,3].

To translate these assumptions into specific analytical actions, three research questions were formulated: (Q1) What DT models are being implemented in Polish energy groups, and to what extent do they address the technical and regulatory requirements of the transition? (Q2) How does the integration of GIS with DT technology impact the efficiency of investment processes, and what specific technical and social challenges does this synergy entail? (Q3) What data management frameworks and cybersecurity standards are necessary for Polish solutions to interact securely with the European energy data space?

The search for answers to the above questions was based on the achievement of sub-objectives. These include (i) a synthesis of the global literature on the use of DT in the energy sector; (ii) a comparative analysis of specific use cases in the areas of distribution and generation for four key entities (Enea, Energa, PGE, and Tauron); and (iii) the formulation of recommendations regarding data governance and digital security, which are prerequisites for scaling these solutions. Particular attention was paid to the planning dimension, examining how the integration of technical data with spatial data can improve the accuracy of investment decisions and mitigate disputes over location.

Key contributions include a practical framework for DT maturity and governance tailored to the needs of the transition; a structured mapping of initiatives by Polish energy companies in a multi-case study format; and a set of policy and regulatory recommendations supporting the reduction in transaction costs and project risks through better integration of DT technologies into the local socio-spatial context.

1.2. Structure of the Article

The structure of the article reflects the logic of the analysis, progressing from broad systemic conditions to application-oriented guidelines. Section 2 presents the geopolitical and regulatory context of the energy and digital transitions, taking into account the impact of the reform of the national spatial planning system on investment processes. Section 3 provides a synthetic overview of the global literature on DT applications in the energy sector, addressing technical aspects and the mitigation of social risks. The research methodology, based on multiple case studies and an original analytical framework linking “data governance” with territorial conditions, is described in Section 4. Section 5 presents the results of an analysis of DT initiatives in the four largest Polish energy groups. Section 6 discusses cross-cutting implications in the areas of data governance and cybersecurity. Section 7 formulates recommendations in the areas of economic and regulatory policy, while Section 8 contains a synthesis of conclusions, taking into account research limitations and future trajectories of DT system development in the context of the low-carbon transition.

2. Context: Geopolitical, Legal, and Market Conditions of the Energy and Digital Transitions

2.1. Political and Regulatory Conditions of the Digital Energy Transition

In the current decade, EU climate and energy policy has undergone profound institutionalization, shifting from political declarations to strictly binding legal regimes. The European Climate Law transforms the goal of climate neutrality by 2050 into a legal obligation and sets the EU’s 2030 climate target at a minimum of a 55% reduction in net domestic emissions compared to 1990 levels [1]. As a result, the focus of the debate has shifted from the question “whether?” to “how?”. Currently, it is up to the member states to demonstrate that their planning and regulatory strategies not only fulfill these objectives but also respect the principles of legal certainty and the protection of market participants’ interests. The legitimacy of the transition is therefore no longer a matter of indicators alone; today, it depends on the transparency of procedures, the quality of consultations, and the effectiveness of supervisory mechanisms that protect investment processes from arbitrary decisions.

A particular role is played here by the governance system established by Regulation 2018/1999 [19], which introduces a multi-level dialog. An additional impetus came from Russia’s invasion of Ukraine in 2022, which inextricably linked decarbonization with energy security. The REPowerEU plan prioritized accelerating the development of renewable energy sources, raising their target share in the energy mix to 45% and introducing the concept of areas particularly suited for such investments (so-called “renewables go-to areas”) [2]. The revised RED III Directive now establishes a binding EU target of at least 42.5%, supplemented by an additional indicative target of 2.5%, which together reflect the 45% ambition [1,2].

In this context, digitalization ceases to be a technological choice and becomes the foundation for the feasibility of new regulations. The EU’s Action Plan on the Digitalization of the Energy System links the energy transition to the “twin transition.” In Communication COM(2022) 552, the European Commission highlights the need for interoperability, standardization, cybersecurity, and data management as essential elements for integrating distributed resources and ensuring system flexibility [3]. Meeting these requirements necessitates the implementation of advanced real-time management systems. The application of advanced near-real-time Energy Management Systems (EMS) and Advanced Distribution Management Systems (ADMS), supported by artificial intelligence (AI), allows for grid operation optimization under the pressure of a dynamically growing number of prosumers. The use of AI-supported DT can improve the efficiency of operational processes; however, the scale of reported effects varies and depends on the type of asset, data quality, and the maturity of implementation. Selected reviews have highlighted, among other things, a reduction in unplanned downtime and improvements in selected performance indicators; however, these results should be treated as a comparative context rather than a universal outcome of every implementation [16,20]. From a microeconomic perspective, the implementation of these processes forces energy companies to undergo a profound restructuring of their management models. Digitalization and the Internet of Things (IoT) are redefining efficiency, becoming a prerequisite for companies to adapt to a dynamic market environment [21]. In the Polish legal framework, this direction is reinforced by the Act of 25 July 2025, amending the Act on the Informatization of the Operations of Public Entities, which implements EU Regulation 2024/903 (the Interoperable Europe Act) and imposes semantic and technological interoperability requirements on public infrastructure management systems.

2.2. Grid Constraints, Flexibility Needs, and the Role of “System Intelligence”

At an advanced stage of the transformation, the pace of change is determined by the “systemic acceptability” of new capacity, especially in distribution networks. Network infrastructure, being a natural monopoly, must reconcile regulatory requirements with public obligations, such as supply reliability. In an era of increasing variability in generation and demand, these tasks require support from a “smart grid.” High-resolution decarbonization modelling likewise shows that transformation pathways depend on the spatial and temporal representation of power-system constraints [22]. Under Polish legal frameworks, connection processes have become a bottleneck in the transition—delays in this area are treated as administrative offenses, forcing operators to professionalize their planning and utilize predictive analytics.

The integration of renewable energy sources and the electrification of further sectors of the economy drastically increase the need for flexibility. In the daily work of operators, this means the need to more frequently resolve issues related to overloads and voltage stabilization. Flexibility thus becomes the ability to actively balance the system, achieved through demand response (DSR) or dynamic pricing [23]. The latter is more than just a commercial product—it is a strategic tool for synchronizing consumption with generation, reducing the costs of intervention-based power control.

In this context, “system intelligence” should be understood as the ability to minimize the time between reading the grid’s status, analyzing it, and taking a specific operational response. DT goes beyond the framework of traditional models thanks to a feedback loop: constantly updated data allows not only for diagnosing faults but also for testing virtual scenarios before implementing them in reality. The only remaining challenge is ensuring the seamless integration of physical models with data analytics, which is essential for maintaining the resilience of modern generation systems [15,21].

2.3. The Spatial Dimension of the Energy Transition: Spatial Economy, Planning, and Location Regimes

The energy transition is inextricably linked to spatial conditions. Every new wind farm or transmission line must comply with local property laws, nature conservation requirements, and spatial planning regulations. The conflict of interests between the broader societal goal and the costs borne locally is therefore inherent in the nature of these changes. The REPowerEU plan identifies spatial constraints as one of the key “bottlenecks” for investment [2], which requires investors and the administration to ensure transparency in decision-making and the ability to objectively compare different location options.

In this context, Local Digital Twins (LDT) should be treated not as a multidimensional visualization, but as an advanced spatial decision support tool [12]. This integration enables multi-criteria modeling, environmental simulations, and the automatic verification of investment compliance with municipal General Plans. They allow spatial data to be combined with simulations and mechanisms of public participation [12,13]. As a result, subjective disputes can be replaced by a rigorous analysis of measurable scenarios. This approach reduces information asymmetry and lowers the costs of investment processes.

To illustrate the practical path an energy investor navigates within a digitalized planning environment following the 2023 reform, Table 1 presents a structured model of the investment procedure supported by LDT technology.

Table 1. Investment procedure using a Local Digital Twin (LDT) in light of the planning reform.

Phase of the Investment Process	Investor Activities in the LDT Environment	Reference Point with Administration (GML Data)	Risk and Conflict Reduction Mechanism
I. Data acquisition and preliminary analysis	Downloading and importing digital boundaries of municipal planning zones from the LDT database.	Central Urban Register (GML files compliant with the APP schema)	Elimination of interpretation errors at the stage of site selection
II. Modeling and impact simulation	Generating virtual scenarios of the physical impact of the investment (noise, visual analyses)	LDT analytical tools linked with topographic databases.	Objectification of project data and transition to a fact-based dialog
III. Public consultation and participation	Presenting interactive simulations to residents in real time, testing alternatives	Online participation platforms integrated with the municipal LDT	Reduction in social opposition (NIMBY) by involving the community in the co-design process
IV. Formal approvals and permitting	Automatic generation of compliance reports with municipal urban standards	Integrated Investment Plan (ZPI) procedure	Shortening the time for issuing administrative decisions and eliminating administrative arbitrariness

The implementation of this model allows for replacing the traditional, technocratic Decide–Announce–Defend (DAD) framework with a transparent cooperative procedure. Contemporary spatial planning utilizing LDT also enables a highly inclusive approach to urban planning. These models allow for the simulation of interventions that take into account the specific needs of social groups, including the creation of senior-friendly urban spaces, and also facilitate the identification of equitable models for allocating the benefits of renewable energy in buildings with complex ownership structures (multi-owned buildings) [13].

It should be remembered, however, that twins are not entirely neutral tools—they reflect the assumptions of their creators [12]. Importantly, it should be clarified that these advanced examples of inclusive design using LDTs cited in the literature—such as adapting urban spaces to the needs of seniors or the equitable allocation of benefits from micro-installations in multi-owned structures [24,25]—currently remain within the domain of international theoretical research and pilot implementations, rather than representing common operational practice within the Polish context. A critical analysis of so-called “sandbox urbanism” demonstrates that many LDT implementations end at the stage of short-term experiments, failing to bring about lasting institutional change [14]. Conversely, the implementation of the so-called Universal Digital Twin concept, without targeted protective interventions, may paradoxically exacerbate the phenomenon of energy poverty and social inequality [26]. This is why it is so important to involve residents in the very process of data creation.

The transition from isolated pilot projects to systemic solutions requires full interoperability of energy and geoinformation datasets. The ability to integrate urban systems is a necessary condition (conditio sine qua non) for building the resilience of critical infrastructure. Open spatial-energy data ecosystems directly support the achievement of the UN Sustainable Development Goals (SDG 7—affordable and clean energy; SDG 11—sustainable cities) [27]. As a result, DT technology is evolving into a strategic bridge, linking rigorous climate policies with the practice of investment processes.

2.4. The Digitalization Agenda and Energy Data Governance

The Commission’s Action Plan on the Digitalization of the Energy System identifies data availability and interoperability as prerequisites for advanced analytics and digital twins [3]. At the EU level, the emerging legal “stack” on data and interoperability—including, in particular, the Data Governance Act, the Data Act, and Regulation (EU) 2024/903 of the European Parliament and of the Council (the Interoperable Europe Act), is intended to increase access to data, as well as opportunities for its reuse and portability, while simultaneously strengthening the conditions for trust, neutrality, and interoperability in the public sector [10,11,28]. In the Polish legal system, this direction was further confirmed by the Act of 25 July 2025 amending the Act on the Computerization of the Operations of Public Entities, which explicitly states that the Act on the Informatization serves the implementation of Regulation (EU) 2024/903 [29]. For the energy sector, this means the need to design digital twins not only as analytical tools but also as solutions embedded within a coherent framework of data governance, interoperability, and regulatory compliance, which are essential for the secure sharing of information among system operators, market participants, and technology providers. The Data Act is one of the most significant pieces of legislation regulating the circulation, sharing, and use of data in the European Union [11,30]. In the energy sector, where data generated by devices, installations, and energy management systems play a fundamental role in operational, predictive, and investment processes, this regulation is driving a systemic transformation of the information management model.

The digital energy twin utilizes data on the status and operation of actual devices. The Data Act introduces specific, yet numerous, obligations for manufacturers, operators, and service providers, as well as user rights [31,32], which have a key impact on the possibility of its construction, integration, and use. The aim of the DA is to ensure a fair distribution of data value among entities in the digital environment, complementing the provisions of the GDPR, stimulating a competitive data market, creating opportunities for data-driven innovation, and making as much data as possible available to everyone [31]. It can be concluded that the DA introduces a harmonized legal framework (e.g., Recital 4, article 1, article 35 of the DA) defining the rules for access to data generated by so-called connected products (Article 2(5) of the DA) and related services (Article 2(6) of the DA), including, among others, Internet of Things devices used in the energy sector—such as photovoltaic inverters, energy storage systems, smart meters, heat pumps, electric vehicle charging stations, and monitoring and control systems.

As emphasized in Recital 14 of the DA, a connected product must have built-in components (e.g., sensors, an operating system, firmware) that enable the generation and communication of data. The primary criterion here is not merely the device’s technical ability to process data, but its role in creating an autonomous flow of data regarding usage and the environment—that is, the independent generation of data content. This approach is pragmatic: DA focuses on those devices that actually “participate” in the data ecosystem and that—regardless of the specific sector—serve as a source of information, rather than merely a carrier or transmission channel. A functional analysis of the definition also indicates that the boundaries of the concept of a “connected product” will need to be constantly revised in light of technological changes—especially in the context of the growing role of software, integrated cloud services, and solutions at the intersection of end devices and network infrastructure [33].

Pursuant to Article 3(1)–(3), manufacturers of energy devices should design them in such a way that users have easy, secure, and free access to data in a structured and machine-readable format, in accordance with the guidelines set forth in Recitals 20 and 21 of the DA. Data generated by connected products and related services constitute a digital representation of the user’s activities; therefore, it must be accessible to the user, encompassing both raw and pre-processed data as well as necessary metadata. This includes all information generated during the use of the device (data from sensors, applications, and the interface), as well as data generated during idle periods—excluding inferred information resulting from additional, advanced processing. However, the scope of the regulation does not cover copyright-protected content or data processed exclusively for third parties, which distinguishes markets for connected devices from markets for content-based digital services (Recitals 15 and 16 of the DA). It is also worth noting that access cannot be made conditional on fees or additional services (see Article 4(1)).

The foundation of the digital transformation in the energy sector is interoperability as defined in Articles 33–35 of the DA, which stipulate both the obligation to ensure the compatibility of communication interfaces and the requirement to use open specifications as well as potential EU common technical specifications, developed in cases where industry standards are insufficiently mature. Reference should be made here to Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) [28], which was implemented into the Polish legal system following the amendment to the Act on Informatization [29]. Interoperability encompasses not only the technical layer but also the semantic layer, which entails the obligation to provide descriptions of data structures, conceptual dictionaries, and metadata. In the context of the energy sector, this is particularly significant because it enables the integration of data from multiple sources and devices from different manufacturers that previously operated in closed, isolated systems. Among the numerous obligations, it is worth mentioning the fulfillment of the pre-contractual information obligation in accordance with Article 3(5) of the DA. Furthermore, the DA sets out the rules for making data available to a third party at the user’s request (Article 5(1)–(3) of the DA) and explicitly states in Recital 27 that it is prohibited to use user data to weaken the user’s market position. The DA explicitly prohibits manufacturers from engaging in practices aimed at restricting or hindering access to data, such as the use of non-standard formats, ecosystem-locking techniques, hiding or blocking APIs, or transferring data exclusively to proprietary cloud services (Recitals 5 and 35, article 6(2) of the DA). Such practices have been deemed to violate the principles of transparency and proportionality and to be contrary to the objectives of the internal data market. Furthermore, a manufacturer must apply the same terms and conditions to customers with a comparable profile (Article 8(4) of the DA).

In summary, one of the fundamental systemic changes introduced by the Data Act is a departure from the model in which the device manufacturer or system operator is de facto the sole owner of data generated by the energy infrastructure. Distribution and transmission system operators have long faced the fragmentation of data from distributed energy sources. The lack of consistent data on the operation of such devices significantly hinders grid management, particularly given the growing number of prosumers. The Data Act enables these barriers to be overcome by providing a legal framework and organizational solutions: users may authorize operators to collect data from devices, and manufacturers are required to grant access not only to users but also to third parties designated by them, which includes network operators and entities managing local and regional energy systems.

Another key element of the DA is ensuring the security and protection of entities’ economic interests. The Data Act establishes a balanced mechanism to protect the interests of device manufacturers by allowing them to refuse to share data in situations where the manufacturer can demonstrate a high likelihood of serious and irreversible economic harm, particularly in connection with the disclosure of trade secrets. However, such a refusal requires a written, detailed, and objectively justified statement (Article 4(6) of the DA).

The Data Act is the second major legislative initiative stemming from the European Data Strategy of February 2020. While the Data Governance Act (DGA) established processes and structures to facilitate data sharing by businesses, individuals, and the public sector, the Data Act clarifies who can create value based on data and under what conditions [31]. The DGA establishes a horizontal institutional and procedural framework for the reuse of data held by the public sector, data brokerage services, and data altruism. The DGA specifies the conditions for the reuse of public sector data (Article 1(1)(a)), the framework for the notification and supervision of data brokerage services (Article 1(1)(b)), the rules for the registration of data altruism organizations (Article 1(1)(c)) [34], and the establishment of the European Data Innovation Board (Article 1(1)(d)). The DGA does not impose direct obligations on device manufacturers or private entities operating in the energy sector but creates a dense network of institutional and procedural obligations that determine the functioning of the data market, including access to data used in services such as digital twins. The literature indicates that the DGA is a coordinating act intended to establish a “system of trust” and to make data reuse procedures more systematic [33]. The DGA imposes an obligation to apply protective procedures prior to data disclosure. Public sector entities must assess whether protected data (e.g., covered by trade secrets, intellectual property rights, statistical confidentiality, or personal data protection) may be reused and under what conditions. The DGA and DA form two complementary layers of the European data economy. The DGA, as an “institutional–procedural layer” that stabilizes trust, oversight, and legal frameworks (intermediaries, altruism, reuse principles), facilitates the flow of public and commercial data. In contrast, DA, as a “substantive–legal layer,” imposes technical and contractual obligations on producers, enforcing actual access to data and guaranteeing private entities the ability to use it, including in automation, simulation, and optimization processes (e.g., a digital twin of a device).

At the same time, digital twins in the energy sector often process mixed datasets, combining measurements from operational technology (OT), asset registers, and—especially in distribution networks—smart metering data that may relate to identifiable customers. This necessitates the operationalization of GDPR principles (data minimization, purpose limitation, security of processing) in parallel with sector-specific requirements [35]. Considering the content of recitals 7–9 and 34–37, the manufacturer must ensure compliance with GDPR provisions, including data minimization and anonymization where necessary. It should be clearly stated that the DA operates in a manner complementary to the GDPR regime and the ePrivacy Directive, as expressed in the frequently repeated “without prejudice” clause. Consequently, no provision of the DA may be interpreted as derogating from or narrowing the right to the protection of personal data, the right to privacy, or the confidentiality of communications. The data sharing regime does not create an autonomous source of legality for the processing of personal data that competes with the GDPR. Any processing of personal data under this regime must be based on the grounds set forth in Article 6(1) of the GDPR, and with regard to special categories of data—on the grounds set forth in Article 9(2) of the GDPR. Consequently, the obligation to provide data to the user or a third party designated by the user does not exempt the data controller/processor from the requirement to demonstrate compliance with the principles of lawfulness, fairness, and transparency (Article 5(1)(a) of the GDPR), as well as the principles of purpose limitation, data minimization, storage limitation, and integrity and confidentiality (Article 5(1)(b)–(f) of the GDPR). The DA prioritizes data minimization (Article 5(1)(c) of the GDPR) and the incorporation of data protection by design and by default (Article 25 of the GDPR).

The new regime for sharing data from connected devices enhances the operational enforceability of access and portability rights but does not modify or weaken personal data protection standards. From a systemic perspective, it constitutes a technical and organizational instrument designed to facilitate data sharing while maintaining the full jurisdiction of the GDPR and ePrivacy Regulation over all processing of personal data and access to end devices. DA must not be viewed as a “loophole” for the expanded use of personal data by data holders; on the contrary, it imposes obligations regarding data sharing while maintaining the legal and technical rigor appropriate for the protection of personal data and the privacy of communications.

2.5. Cybersecurity and Infrastructure Regulations

The past decade has been marked by a significant increase in cybersecurity regulations. The first comprehensive European legal act in the field of cybersecurity was the NIS Directive, adopted in 2016 and implemented into Polish law as the Act on the National Cybersecurity System [36,37]. The list of critical services subject to regulation included those provided in the energy sector. Energy companies, given the appropriate scale of their operations, could be designated as operators of critical services. A critical service operator implements a security management system within the information system used to provide the critical service, encompassing the systematic assessment of the risk of an incident occurring and the management of that risk (including the obligation to report a serious incident to the competent CSIRT) as well as the implementation of technical and organizational measures that are appropriate and proportionate to the assessed risk. At the same time, neither the Polish Act nor its implementing regulations specify how risk should be assessed and managed, leaving this to the recommendations of cybersecurity authorities [38].

In line with the adopted approach, the NIS Directive was reviewed to determine which provisions had proven effective in practice and to adapt them to the current situation. As a result, a new directive was adopted—the NIS2 Directive—which expands the scope of the regulation to include many new sectors, with entities in the energy sector primarily classified as critical entities subject to ex ante and ex post supervision. The new regulations include, among other things, the implementation of cryptographic tools, ensuring supply chain security, and shaping cooperation among businesses in the area of cybersecurity [7]. With regard to the energy sector, the Polish law implementing the NIS 2 Directive introduces specific requirements for entities with significant impact and entities with critical impact, which have been identified as such by the minister responsible for energy. A key element of the risk assessment method is supply chain threats such as, among others, the introduction of vulnerabilities or backdoors, information leaks, and product unavailability. Regarding entities with significant impact and entities with critical impact, EU law also includes provisions on the development of recommendations for public procurement in the field of cybersecurity. These recommendations are to be consistent with the latest available European cybersecurity certification schemes applicable to a given ICT product, ICT service, or ICT process and take these schemes into account [39].

The European certification framework was introduced by the Cybersecurity Act, which establishes a mechanism for setting up certification and validation schemes to confirm that ICT products, services, and processes, as well as managed security services, assessed in accordance with these schemes, comply with security requirements. The European Commission publishes the EU rolling work program for European cybersecurity certification schemes [40]. To date, one European scheme based on common criteria (EUCC) has been adopted, covering, among others, firewalls (both hardware and software), switches, SIEM systems, and IDS/IDP [41]. European certification schemes may be accompanied by national ones. In Poland, both European and national certification are currently voluntary, and the minister responsible for informatization may at most encourage the use of ICT products, ICT services, and ICT processes certified under European or national cybersecurity certification schemes [38]. Mandatory certification may be introduced for products with digital components under the CRA Regulation described below.

The second key regulation in the area of security is the CER Directive [42], which, unlike the NIS and NIS2 Directives, focuses on the physical protection of critical infrastructure facilities rather than the cybersecurity of essential services. The CER Directive is to be implemented into Polish law by an act amending the Act on Crisis Management and certain other acts. (The draft was submitted to the Sejm on 6 March 2026—Document No. 2355). Critical infrastructure consists of facilities, installations, equipment, and services included in the critical infrastructure list, compiled by the Director of the Government Security Center based on detailed criteria specified in the National Critical Infrastructure Protection Program. The main mechanism for protecting critical infrastructure is the preparation and implementation by infrastructure owners of critical infrastructure protection plans, as well as the maintenance of their own backup systems ensuring security and sustaining the operation of this infrastructure until its full restoration [43]. These plans are coordinated with public administration, i.e., the provincial governor, the competent minister, or the head of a central office. An essential element of the plan, according to the Council of Ministers’ regulation, is risk assessment [44]. It is significant that in the currently applicable Crisis Management Act, the word “risk” appears six times, whereas in the draft act implementing the CER Directive, it appears 98 times [41,44]. This confirms the trend toward individualizing protection, manifested primarily in the fact that the selection of protective measures depends on the results of risk assessment and analysis.

The Cyber Resilience Act (CRA), adopted in 2024, sets out the obligations of economic operators, conformity assessment, notification of bodies, and market surveillance. It is the first horizontal EU law that legally mandates the incorporation of cybersecurity principles throughout the entire lifecycle of products with digital components (so-called “secure-by-design”), assuming that they should be secure by default, i.e., made available on the market in a secure default configuration (secure-by-default) [8]. Cybersecurity is not addressed in the CRA as the overall resilience of the socio-economic system, but rather as a set of common requirements pertaining to the market for products with digital components, further detailed in other EU and national legal acts as well as technical standards, as evidenced by the article containing 51 definitions—including 15 that refer to 7 earlier EU acts—and the article defining the scope limitations of the CRA. This horizontal approach should therefore not conflict with tailoring the protection of specific categories of products with digital components to diverse threats and risk levels. However, for the Polish energy sector, the translation of the term “cybersecurity risk”—which is key in the CRA—as “risk in cyberspace” [45] may be problematic. In Poland, “cyberspace” has a broad legal definition unrelated to incidents (1b. Cyberspace is understood as the space for processing and exchanging information created by information and communication technology systems, as defined in Article 3(3) of the Act of 17 February 2005, on the computerization of the activities of entities performing public tasks, together with the connections between them and their relationships with users) [46]. In Commission Delegated Regulation (EU) 2024/1366 supplementing Regulation (EU) 2019/943 by establishing a network code on sector-specific rules regarding cybersecurity aspects in cross-border electricity flows [39], in which the word “risk” appears 236 times, a corrigendum was issued changing “risk in cyberspace” in the Polish text to “cybersecurity risk.” Thus, currently in the English texts of EU acts related to cybersecurity and cyber resilience, including in the energy sector, there is a single term (cybersecurity risk) composed of two words with legal definitions (cybersecurity and risk), whose equivalents in the Polish texts of these acts are two terms (cybersecurity risk and risk in cyberspace) with different scopes. The analysis presented here justifies the request to issue a corrigendum to the Polish text of the CRA. The second inconsistency requiring a corrigendum is the assumption in the Polish texts of many EU acts that “information systems” (encompassing hardware, software, and processed data) are not “information systems” but “telecommunications and information systems,” which is incorrect because the statutory definition of the term “telecommunications and information system” does not include data [47]. The issues presented highlight the importance of establishing a consistent conceptual framework for digital transformation to ensure uniform application of the law.

The European AI Act is the world’s first comprehensive legal regulation concerning artificial intelligence systems, completed earlier than similar legislative processes in China, India, or the U.S. The AI Act applies to providers and users of AI systems. The aim is to ensure that AI systems are safe, transparent, and compliant with citizens’ fundamental rights. To avoid “overregulation” in the name of security that could undermine competitiveness, the AI Act adopts a risk-based approach, dividing AI systems into four categories with varying levels of legal intervention. In this context, AI in critical infrastructure has been assigned the status of a system subject to the strictest requirements due to high risk [9]. A specific challenge for Europe is the multitude of European Union and member state authorities, among which tasks and competences (powers and responsibilities) are distributed. Regulations impose cooperation obligations on these bodies, but these obligations are vague, which may lead to disputes or conflicting decisions.

The AI Act introduces numerous obligations regarding management systems and their documentation, and failure to comply may result in severe penalties. The lack of required technical documentation for a high-risk system or a violation of the requirements for maintaining logs of events generated by high-risk AI systems will be subject to an administrative fine of up to 15,000.000 EUR or—if the offender is a company—up to 3% of its total annual global turnover from the previous fiscal year, whichever is higher. Furthermore, in the event of violations of the AIA provisions, the supervisory authority will be able to order the withdrawal of a high-risk AI system from use or from the market altogether. For this reason, diligent compliance with documentation and procedural obligations is crucial to minimizing legal risk and ensure the safe use of AI.

3. Literature Review

3.1. Conceptual Foundations and Reference Architecture

Digital twins are currently one of the fundamental tools of the energy sector’s digital transformation. Their concept stems from earlier digital representations and support models, originating, among others, from NASA’s support systems of the 1960s, but today refers to dynamic replicas of physical systems coupled with real-time data. This evolution has transformed the perception of the model from a simple representation of an object, it has become a tool for continuous monitoring, simulation of operating states, and decision support at every stage of the infrastructure’s lifecycle [16,48]. In energy sector research, the term Energy Digital Twin (EDT) is increasingly used, reflecting the systemic nature of this solution. EDT does not refer exclusively to a single device or installation but encompasses the entire energy value chain: from energy generation in renewable and conventional sources, through transmission, distribution, and storage, to final energy consumption [49,50]. Reviews also indicate that DTs are no longer serving solely as predictive tools and are increasingly becoming data integration platforms, which facilitates risk management in an increasingly complex environment [20,48].

Systematic reviews indicate that the development of DT in the energy sector is strongly linked to growing integration with artificial intelligence (AI) algorithms, machine learning (ML), and Big Data and IoT technologies. Review studies indicate that AI-supported DT can, in specific applications, improve asset availability, reduce unplanned downtime, and increase energy yield [16,20]. However, it should be emphasized that the reported numerical results are highly dependent on the type of asset, the scope of implementation, data quality, and the method of measuring outcomes; therefore, they should not be interpreted as universal benchmarks for the entire sector. At the same time, the literature consistently indicates that the realization of benefits depends on the maturity of the information architecture and the ability to integrate with existing operational systems. Earlier review work also framed digital twins as instruments for industrial data-driven energy savings and operational optimization [51].

Reference architectures for digital twins in the energy sector are described in a multi-layered structure. Five basic modules are most distinguished: (i) data acquisition (SCADA, AMI), (ii) data management (repositories, data lake, semantic layer), (iii) modeling and simulation (physical, data-driven, and hybrid models) (iv) analytics and decision support, and (v) visualization and user interfaces [48]. In the energy sector, these architectures must additionally account for real-time requirements, operational resilience, cyber-physical security, and interoperability with existing OT and IT systems [52].

3.2. Digital Twins for Power Grids and Traffic Management

Digital twins of power grids are closely linked to advanced distribution management systems (ADMS), energy management systems (EMS), and network information models. A comprehensive review of digital twin technology in smart grids highlights applications in monitoring, fault location, Volt/VAR optimization, asset management, and scenario analysis, while identifying barriers such as a lack of interoperability and cybersecurity concerns [17].

At the European level, there is discussion about building a federated digital twin of the grid, which would become the foundation of the EU’s “dual transition” (green and digital) [17]. System operators (TSOs/DSOs) are increasingly moving away from isolated implementations in favor of federated models. In such a setup, individual digital twins—though operating independently—communicate with one another thanks to common standards and semantics. As a result, this technology ceases to be a niche tool and becomes the glue linking investment planning with the ongoing operation of assets [4].

Industry literature and reports emphasize that keeping digital twins within the logic of siloed projects leads to a digital “patchwork”: the parallel development of incompatible models and data repositories, increased integration costs (custom-built interfaces, duplication of data management and SLAs), limitations on automation (manual workarounds at system interfaces), and gaps in governance (unclear responsibility for data quality and consistency). Consequently, organizations achieve high levels of digitalization activity but low gains in system efficiency—which is particularly problematic given cost pressures and staff shortages in the energy sector [4].

A prerequisite for the functioning of network twins on an inter-organizational scale is interoperability understood more broadly than technical compatibility. It requires shared semantics, standardized data-exchange mechanisms, and mature procedures for maintaining grid, asset, and operational data as a reliable “single source of truth.” In the energy sector, this includes the use of common information models, secure industrial communication architectures, and OT/IACS cybersecurity requirements, in particular the IEC 62443 series [53]. Data spaces are also becoming increasingly important because they enable secure information exchange within critical infrastructure and support the development of federated digital twin architectures [54].

3.3. Digital Twins for Generation Assets and Flexibility Resources

Digital twins are increasingly being used for power generation assets to improve reliability and reduce lifecycle emissions through predictive maintenance and operational optimization. These applications are particularly evident in wind turbines, where multiphysics models, condition monitoring data, and AI are combined to predict failures and optimize power generation. A literature review on predictive digital twins in wind energy describes the shift toward hybrid modeling and real-time data fusion, while also highlighting challenges related to model scalability and interpretability [49].

Hydropower is another significant area, as flexibility services (ramping, balancing) are critical with high shares of renewable energy sources. A detailed Polish case study proposes a modular digital twin architecture for the Wały Śląskie hydroelectric power plant, combining data acquisition, processing, visualization, and integration layers, and utilizing CFD and AI modeling to support efficiency and operational management [50].

The maturity of an asset’s digital twin can be described as a path from a simple connection (“smart connection”), through condition analytics (“prediction”), to the “cognitive” level, where the system independently suggests the best decision options. However, the greatest value is achieved when the digital twins of individual devices are integrated into larger ecosystems (e.g., from a turbine to the entire network area). This federated approach allows solutions to be scaled without the risk of vendor lock-in [4].

3.4. Scalable Building Performance Twins, GIS in Inclusive Spatial Planning, and Public Acceptance

In the context of facility management and building lifecycle optimization, the application of digital twins extends beyond macro-level grid monitoring to high-fidelity operational tracking at the asset and building scale. Research conducted by Zheng et al. (2025) [55] introduces a practical, scalable, and cost-effective digital twinning framework specifically designed for monitoring Indoor Environmental Quality (IEQ). By establishing an integrated workflow that couples Building Information Modeling (BIM) and 3D point clouds with localized Internet of Things (IoT) sensor deployments, this approach systematically addresses the challenges of multidisciplinary data integration and high infrastructure implementation costs. Their implemented platform demonstrated high operational stability, maintaining data transmission with less than 3% data loss during a campus office proof-of-concept deployment. Furthermore, by incorporating multi-dimensional indexing (including IAQ, thermal comfort, acoustics, and visual parameters), the platform enables real-time 3D spatiotemporal visualizations of occupant thermal comfort under varying environmental conditions.

This building-level paradigm demonstrates that advanced digital twins must transcend traditional, static cyber-physical systems (CPS) by leveraging continuous data–model coupling to enable predictive environmental simulations and data-driven management. From a systemic perspective, the data integration workflows and scalability solutions validated by Zheng et al. (2025) [55] provide a vital technical parallel to the larger-scale distribution grid and asset twins discussed in this study, illustrating how robust semantic and technological architectures can mitigate data heterogeneity and strengthen infrastructure resilience throughout the low-carbon transition.

The synergy between digital twin (DT) technology and geographic information systems (GIS) is becoming one of the most important directions for the development of tools supporting spatial planning and the energy transition. This integration enables a transition from static cartographic studies to dynamic simulation environments, allowing for the analysis of location options, the assessment of the spatial impacts of investments, and better adaptation of infrastructure to local social and environmental conditions. The literature emphasizes that Local Digital Twins (LDT) can support not only the optimization of RES and grid infrastructure locations, but also more inclusive urban design that considers the needs of diverse user groups, including older adults and residents of areas with heightened social vulnerability [13,56]. In this sense, EDT/LDT should be treated as spatial decision support tools that combine technical, geospatial, and social data within a single analytical environment.

A key challenge of contemporary spatial planning is ensuring the equitable distribution of the benefits of the energy transition. Poshnath et al. [24] argue that adaptive planning supported by DT enables the identification of optimal models for the allocation of energy resources in multi-ownership structures, taking into account socio-economic variables such as the material status of tenants or specific legislative conditions. Adopting an “equity-by-design” approach requires simultaneously considering the fair distribution of benefits and burdens, inclusive decision-making processes, the identification of exclusions, and mechanisms for preventing and remedying harm throughout the entire energy transition cycle [57]. According to Savage et al. [26], decarbonization of the heating sector based on the mass adoption of heat pumps carries the risk of escalating inequalities; without precisely targeted policy interventions and the use of advanced geospatial analytics, this transition may result in a paradoxical increase in energy costs in regions with the highest rates of energy poverty.

Achieving the sustainability of implemented solutions, however, requires moving beyond the framework of so-called “sandbox urbanism.” Steiner [14] argues that the success of City Digital Twin (CDT) initiatives depends on their ability to generate lasting changes in the institutional structures of spatial management. Without deep integration with administrative systems, advanced DT projects risk remaining at the stage of ephemeral pilot projects, which—despite their high technological potential—do not translate into systemic urban transformation [24,26]. This approach underscores that the success of digital planning tools depends not only on their precision but, above all, on their embedding in inclusion policies and real decision-making processes.

Contemporary literature on the subject indicates that the success of investments in the energy sector is conditioned not only by high technological efficiency, but above all by the effective mitigation of NIMBY (Not In My Back Yard) public resistance. Energy Digital Twins (EDT) serve in this process as tools that objectify dialog with stakeholders through high-fidelity visualization of the physical parameters of planned projects. Simulations of noise propagation, wind turbine shadow flicker, and visual impact analysis of infrastructure enable public consultations based on verifiable operational models. This approach enables the replacement of residents’ subjective concerns with objective model data, which is a key element in building social consensus [13,16,48].

As a result, an evolution of the planning paradigm is observed from the traditional, technocratic DAD (Decide–Announce–Defend) model toward Participatory Digital Twins. Sharma et al. [56] emphasize that the implementation of the Sustainable Development Goals (SDG 11 and SDG 7) requires a profound democratization of technology. Providing citizens with interactive simulation environments to test hypothetical location and operational scenarios significantly increases trust and lends credibility to investment processes, transforming residents from passive recipients into active co-creators of the energy space [13,56].

Algorithmic transparency is the foundation for building lasting relationships with citizens. Research on the implementation of artificial intelligence (AI) in the optimization of energy systems emphasizes the need to use Explainable AI (XAI) [16,52]. The explainability of models is essential for overcoming the “black box” barrier, which allows for the validation of multi-criteria location decisions made by advanced hybrid models. Abdessadak et al. [16] point out that despite the high analytical precision of AI systems, it is the transparency of computational processes and rigorous data security standards that determine the long-term implementation of the technology in the public sector.

A recent significant trend noted in the literature is the ongoing democratization of DT technologies. These technologies are evolving from closed, highly specialized tools used by transmission system operators toward open operational platforms for local energy communities. These solutions facilitate bottom-up planning of renewable energy assets and independent management of microgrids. This approach not only supports the inclusivity of decision-making processes but also tangibly increases the resilience of local energy systems by tailoring infrastructure to the specific needs and potential of the region [24,56].

3.5. Governance, Data, and Cybersecurity in Energy Digital Twins

Beyond technical feasibility, the scaling of digital twins in the energy sector depends on governance solutions: data ownership and access rights, accountability for decisions, model validation, and continuous cybersecurity risk management [10]. Literature reviews explicitly identify cybersecurity and regulatory alignment as factors limiting the development of digital twins in smart grids [17,18].

Cybersecurity in energy digital twins can be considered from two perspectives: the role of digital twins in enhancing cybersecurity and the cybersecurity of the solutions themselves used in digital twins. This study focuses on the second aspect [17,18]. The number of cybersecurity incidents in the energy sector handled by CERT NASK stands at several thousand (2024—4632, 2023—9196, 2022—4320) and is lower than in the financial and retail sectors. Due to the specific nature of the energy sector, it is primarily the scale and target of the attack that matter, rather than the number of incidents. On 29 December 2025, a coordinated cyberattack targeting the energy sector in Poland took place. According to the Energy Sector Incident Report—29 December 2025 prepared by CERT Polska [58], coordinated attacks were launched against numerous wind and solar farms, a private company in the manufacturing sector, and a combined heat and power plant supplying heat to nearly half a million customers in Poland. The aim of the attacks was to damage equipment. Based on technical analysis, it was determined that all of the aforementioned attacks were carried out by the same attacker. These incidents affected both IT systems and physical industrial equipment, which is rare in the attacks described so far. This benchmark incident proved that modern hybrid warfare directly strikes the physical integrity of energy critical infrastructure through the manipulation of the control data layer. In this context, protecting the mathematical models of digital twins against data poisoning and implementing robust decision authorization mechanisms have emerged as critical national security requirements.

The increasing degree of digitalization and integration of IT systems with operational technologies (OT) drastically expands the attack surface of energy infrastructure. Digital twins, acting as central systems that aggregate critical telemetry and control data, increasingly become prime targets for sabotage-oriented attacks. Because digital twins are often integrated with dispatch systems and asset management platforms, they expand the attack surface for cyberattacks on energy infrastructure. From a security perspective, digital twins are vulnerable to threats such as attacks on data integrity (falsification of sensor signals, man-in-the-middle), model manipulation (including “poisoning” of AI components), unauthorized access to sensitive operational information, and cascading effects if the twin is used to support decision-making or control [17,18,59]. Digital twins integrated with operational systems amplify cybersecurity risks through three channels: (i) increased connectivity between OT and IT domains; (ii) the concentration of sensitive operational data; and (iii) reliance on third-party software components and cloud services [18,60].

3.6. Key Trends in the Literature and Research Gaps

A targeted literature review indicates a marked increase in interest in digital twins in the energy sector, particularly in research combining DT with artificial intelligence methods. The analyzed publications most frequently reported the potential or observed operational benefits of these solutions, including the reduction in unplanned downtime, improved system efficiency, and better optimization of energy resource utilization [16,20]. Recurring themes also included the integration of digital twins with IoT infrastructure, cloud computing, and machine learning algorithms; the development of multi-layer architectures; the use of federated environments for model testing; and the growing importance of scenario-based applications at the network, asset, and entire energy ecosystem levels. Based on this, it can be concluded that the role of digital twins is gradually extending beyond classic predictive functions and increasingly encompasses support for risk management and decision-making in complex energy systems [48].

However, a review of the literature reveals several clear research gaps. First, standards for data exchange and interoperability, including common ontologies and open integration platforms, remain insufficiently developed. Second, there is a noticeable shortage of standardized test datasets and benchmarking frameworks that would enable the comparison of models developed in different research environments. Third, the social and organizational dimension—encompassing user acceptance, participation mechanisms, and the human role in DT-assisted systems—remains relatively underdeveloped. The scalability of real-time solutions and the cyber-physical security of digital twin-based infrastructure also remain significant challenges. Consequently, further research should focus not only on improving models but also on building mature, resilient, and interoperable DT ecosystems capable of being implemented in real-world energy sector conditions.

A summary of key research areas, technologies, and main conclusions from the literature is presented in Table 2.

Table 2. Summary of key research areas and trends in the literature on digital twins in the energy sector.

Category	Technologies and Methods Used	Results and Main Conclusions	Representative Sources
Reference architectures and conceptual foundations	IoT, Big Data, cloud/edge computing, hybrid models, AI/ML, layered DT architectures	The literature demonstrates a shift from DT as a predictive tool to a system management platform. Reviews have reported up to a 25% reduction in downtime, a 10–20% increase in energy yield, and, in the review by Abdessadak et al., a 35% reduction in unplanned downtime and an 8.5% increase in energy production. Recurring barriers include data heterogeneity, lack of interoperability, implementation costs, and cybersecurity	Abdessadak et al., 2025 [16], Mbasso et al., 2025 [48] Kim et al., 2026 [61]
Smart Grids	ADMS, EMS, federated architectures, federated learning, DNN, smart meters, model-free DT	In this area, DT supports forecasting, adaptive control, fault localization, RES integration, and scenario analysis. EnerTEF demonstrates a federated AI testing environment using high-fidelity twins and “regulatory sandboxing,” while Fanuel et al. show that a model-free DT based on DNN can reconstruct the topology of a low-voltage network using AMI data without costly field verification.	Mastoi et al., 2026 [20], Sarmas et al., 2026 [52], Fanuel et al., 2026 [62]
Generation assets and flexibility resources (RES)	Multiphysics models, predictive maintenance, RUL (Remaining Useful Life), SCADA, DL, physics-based and data-driven models	In the asset domain, applications in diagnostics, predictive maintenance, and RUL estimation dominate, particularly for wind turbines. SPL highlights the dominance of hybrid approaches and the growing role of deep learning, but also identifies gaps: a lack of benchmarks, the dominance of DT at the component level over system-level architectures, and real-time scalability issues.	Maldonado-Correa et al., 2026 [63]
Scalable Building Performance and IEQ Twinning	BIM, IoT sensors, 3D point clouds, spatiotemporal model integration, predictive analytics	Proposes a scalable, cost-effective framework for indoor environmental quality (IEQ) monitoring with high data stability (<3% loss). Demonstrates that integrating real-time telemetry with 3D models provides spatiotemporal insights that surpass traditional cyber-physical systems and support data-driven facility management.	Zheng et al., 2025 [55]
Spatial Planning and GIS	Local Digital Twins (LDT), GIS, spatial analytics, policy scenarios, urban simulations	DTs and LDTs support evidence-based spatial planning, including the siting of RES and a more equitable allocation of energy benefits in urban environments. Poshnath et al. show that a politically integrated DT can support equitable RES allocation in multi-unit buildings, while Steiner warns that some CDT projects remain at the experimental stage and may reinforce the logic of “sandbox urbanism” rather than sustainable institutional change.	Villanueva-Merino et al., 2024 [13], Poshnath et al., 2025 [24], Steiner, 2025 [14],
Social acceptance, inclusion, and co-creation	Explainable AI (XAI), participatory platforms, co-creation, visual scenarios, urban digital twins	This trend shows that digital twins can support more inclusive decisions, but the social effects are not automatically positive. It emphasizes the role of communities and inclusive policies in urban transformation and also demonstrates that low-carbon technologies modeled within the Universal Digital Twin framework can simultaneously reduce emissions and increase energy costs in more socially vulnerable regions.	Savage et al., 2022 [26], Sharma et al., 2025 [56]
Cybersecurity and governance	Intrusion detection systems (IDS) for ICS, threat modeling (poisoning, MitM), CIM/CGMES standards, IEC 61850, NIST SP 800-82, IEC 62443, and the EU legal framework for European data spaces (DGA, Data Act, AI Act).	The literature highlights the dual nature of digital twins as both security tools and new attack vectors (poisoning attacks), identifying regulatory barriers and the lack of standards as the main obstacles to their scaling; It is necessary to implement secure data exchange spaces and manage risk based on the EU’s governance legal framework, such as the DGA and the Data Act. The 2025 cyberattack highlights that hybrid warfare targets physical assets via control data, establishing data poisoning protection and decision authorization as vital imperatives.	Bitton et al., 2018 [64], Jørgensen & Ma, 2025 [18], Piskorz-Ryń & Sakowska-Baryła, 2025 [60], Maroni, 2024 [65], CERT Polska, 2026 [58]

4. Materials and Methods

4.1. Study Design

The study combines three complementary components: (i) a targeted review of the latest scientific literature on digital twins in energy systems, (ii) a qualitative multiple case study based on desk research of publicly disclosed digital twin initiatives in four Polish energy groups, and (iii) an analysis of EU documents and national legal instruments relevant to digitalization, data governance, and cybersecurity. The literature review was analytical and mapping in nature. Its aim was not to provide an exhaustive catalog of the entire research field, but rather to identify the main categories of DT applications, the most frequently described architectures, implementation barriers, and governance issues relevant to the energy sector. For this reason, the article adopts the term “targeted literature review” rather than a full scoping review in the procedural sense.

A desk-based approach was chosen because DT programs in critical infrastructure are often not fully transparent, and the scope of public disclosures by companies varies. The objective was therefore to create a structured map of verified public signals—including press releases, official project websites, integrated reports, procurement documents, and peer-reviewed case study publications—rather than an independent technical validation of the operational results of individual implementations. Publicly available information was used as evidence confirming the existence of announced or partially documented initiatives, but not as an independent technical validation of their effectiveness or full implementation maturity.

The project approach adopted in the study aligns with the growing conviction among system operators that digital twins should be treated as a business-critical integration layer, rather than as isolated tool implementations. Therefore, in addition to identifying technical functions and use cases, the analysis also covers interoperability, data governance, and organizational dependencies, such as process and data ownership, OT/IT collaboration mechanisms, and solution scaling logic [4].

4.2. Case Selection and Data Sources

The cases were selected through purposive sampling to cover both distribution system operators (DSOs) and generation/flexibility assets, as well as to represent the major national energy groups reporting activities in the area of digital twins. The selected cases are (1) Enea (Enea Operator), (2) Energa (Energa-Operator and selected generation assets), (3) PGE, and (4) Tauron (Tauron Ekoenergia).

Evidence was gathered from publicly available sources published between December 2024 and January 2026, including official company news and press releases, project websites, integrated reports, procurement documents, and scientific publications describing specific digital twin concepts. All online sources were reviewed on 4 February 2026.

Publicly available information was used as evidence confirming the existence of announced or partially documented initiatives, but not as an independent technical validation of their effectiveness or full implementation maturity.

4.3. Analytical Framework: Digital Twin Maturity and Governance Dimensions

To compare heterogeneous initiatives, an energy-specific digital twin maturity framework was applied, combining technical and governance dimensions. The framework differentiates maturity according to (i) scope (asset, installation, network, enterprise), (ii) data integration (offline, periodic, near-real-time, real-time), (iii) functional sophistication (descriptive, diagnostic, predictive, prescriptive), (iv) integration level (standalone vs. integrated with EMS/ADMS/APM and market interfaces), and (v) governance approaches (data quality management, accountability, and cybersecurity mechanisms).

The maturity levels used in the analysis are summarized in Table 3. The coding is indicative and based solely on publicly disclosed information; it should therefore be interpreted as a comparative heuristic rather than a certification.

Table 3. Digital twin maturity levels for energy transition applications (proposed framework).

Level	Label	Data Integration	Typical Functions	Example in the Energy Sector
0	Digital model	Offline	Design documentation; static simulations	CAD/GIS model without linkage to operational data
1	Digital shadow	Periodic/batch	Monitoring dashboards; key performance indicators	Asset register enriched with periodic data dumps from sensors
2	Operational twin	Near-real-time	Diagnostics; what-if simulations; condition monitoring	Plant twin supporting O&M decisions
3	Predictive twin	Near-real-time to real-time	Forecasting; anomaly detection; predictive maintenance	Network twin with state estimation and contingency analysis
4	Prescriptive twin	Real-time (optional closed-loop)	Optimization; prescriptive recommendations; automated workflow	Integrated network twin coordinating flexibility resources under constraints

Note: These levels are conceptual and may coexist within a single organization for different assets or network layers.

4.4. Limitations

The study is based on public disclosures and therefore does not allow for an assessment of the full depth of implementation, real-time integration, model validation practices, or quantitative performance effects. The maturity assessment is heuristic and comparative in nature. The results should be interpreted as a mapping of initiatives and governance patterns, rather than as a technical audit of individual solutions. This limitation is particularly relevant for projects implemented in critical infrastructure, where some information remains inherently classified or commercially sensitive.

5. Results: Digital Twin Initiatives in Polish Energy Groups

The results presented in this section should be interpreted as a reconstruction of publicly disclosed DT initiatives, rather than as an independently verified assessment of the full technical maturity or operational effects of the implementations studied.

5.1. Enea: HV Grid Digital Twin and Immersive Decision Support

Enea Operator publicly announced the implementation of a “digital twin system” for the 110 kV grid. The system was described as an EMS-class solution with a state estimator, designed to minimize transmission losses and the risk of outages by forecasting grid behavior in advance [66]. The same announcement indicated that the company plans to extend this approach to medium-voltage networks [66].

Enea Operator’s informational material regarding the implementation of EMS specifies that the system supports the operation and planning of the 110 kV grid and generation connected to the 110 kV distribution grid. EMS integrates SCADA software and computational modules; the network status is presented on the same graphical diagrams based on both measurements and calculation results.

The core of the system is an online state estimator that determines the most probable operating states of the grid for both observable and unobservable parts. This allows for the determination of active and reactive power, currents, and voltages even for unmetered stations or those outside the observable area.

The estimator also serves as a data quality filter: before starting calculations, it rejects measurements with significant errors (based on residuals), and the rejected readings serve as an indication of potential inconsistencies in the telemechanics system or in the CIM. Implementation practice indicates the need for daily work by administrators related to updating and editing the CIM and calibrating data.

In terms of decision support, EMS enables the execution of numerous analyses and simulations: the dispatcher can specify the planned power flow in “n + 5 min” mode (immediately before a network element is deactivated), and the system periodically checks compliance with the N-1 criterion and may suggest corrective measures in the form of operational actions.

A key feature is integration with the OMS (Outage Management System), which allows for the import of pre-prepared operational maneuvers into EMS simulations, thereby supporting work planning and coordination of planned network states with the transmission system operator.

Extending the concept to the medium-voltage level is implemented within the DMS module. The scope of implemented functionalities includes, among others, load estimation (determination of unknown P and Q) and voltage/current overloads at MV network nodes, short-circuit calculations, optimization of the network configuration to minimize active power losses in MV lines and HV/MV transformers, risk analysis reported to the dispatcher’s dashboard, and calculation of the network state in a simulation (e.g., for the network following planned configuration changes). HV/MV transformer load forecasts and the A1–A5 emergency restriction plan are also transferred from the EMS to the DMS.

Concurrently, the EMS is planned to be enhanced with functions for better integration with forecasts and control: incorporating generation forecasts, HV/MV transformer load forecasts, DOL forecasts, and data on scheduled work and RES redispatching in the power flow module following estimation; the ability to generate reports in the N-1 and N-X rule modules; and performing control from the optimal power flow module after estimation (prescriptive functions).

In addition to operational modeling, Enea Operator presented immersive technologies relevant to training and situational awareness supported by digital twins. In January 2026, the company announced the presentation of its proprietary VR system to the European Commission, positioning it as an innovation supporting the functioning of the energy sector and potentially training and safety practices [67].

Collectively, public disclosures and company informational materials point to a portfolio comprising (i) an operational digital twin of the 110 kV grid in the control room (EMS), (ii) developing functions of the MV grid twin within the DMS, and (iii) a competency twin (VR). In terms of maturity, this corresponds to a range from Level 1 (training) to Levels 2–3 (operational/predictive twins), with indications of a shift toward prescriptive functions (OPF) in selected modules.

5.2. Energa: Digital Twin of the Distribution Network and Asset Performance Twins

Energa-Operator has launched a dedicated “Digital Twin” project to build an integrated digital representation of its distribution network. The company emphasizes that it already possesses the key foundations: a SCADA/ADMS system for remote monitoring and control, a GIS system, and an extensive smart metering infrastructure with data streams from over three million remote meters [68]. The stated goal is to standardize access to high-quality integrated data and enable the simulation of network events and investment scenarios in a non-stationary environment [68].

Energa’s press materials clarify the scope: representation ranging from high-voltage substations and lines down to individual connections and meters, utilizing AI mechanisms to better predict and replicate the effects of events in the real world [68]. This approach corresponds to a DSO-oriented digital twin, aimed at increasing observability and decision support for RES integration.

In addition to the DSO, the Energa Group also reports on the implementation of digital twins for generation assets. The digital twin of the Elbląg combined heat and power plant is positioned as a system supporting plant management, with integration and initial functionalities planned following implementation [69]. In January 2026, the group announced a digital twin for wind turbine assets to forecast productivity and failure rates, including analysis of blade aerodynamics under real-world conditions and assessment of the impact of extreme weather events [70].

Energi’s portfolio thus illustrates a multi-layered approach: a large-scale grid twin (strategic and operational applications) combined with asset twins for O&M optimization.

5.3. PGE: Offshore Competency Twins and Flexibility Twin Signals

Publicly available PGE materials indicate the use of digital twin approaches in the field of offshore wind energy, particularly in the areas of competency development and preventive diagnostics. The group’s integrated reporting on offshore projects describes an “innovative digital twin concept” combined with VR simulators at the competence center in Ustka, intended for training and preventive diagnostics in offshore wind operations [71]. This positions the digital twin primarily as a training and “operational readiness” tool, rather than as a real-time operational network twin.

Additionally, PGE’s procurement documentation for 2026 includes a planned pre-implementation analysis of the construction and implementation of a digital twin for the Żarnowiec pumped-storage power plant [72]. Although the document does not contain technical details, the signal is significant because ESP is a key flexibility resource for balancing and reserves; in this context, the digital twin would likely focus on operational optimization, asset durability, and flexibility valuation.

5.4. Tauron: A Digital Twin for Hydropower Flexibility and Sustainable Operation (D-HYDROFLEX)

Tauron Ekoenergia is participating in the EU’s D-HYDROFLEX project, which focuses on digitalization, flexibility, and sustainable development in hydropower. Project information indicates that the initiative involves the development of a digital twin for the Wały Śląskie hydroelectric power plant, aimed at supporting flexible operation and modernization pathways [73].

The concept and architecture of the digital twin for Wały Śląskie have been documented in peer-reviewed scientific literature; a modular architecture with layers for data acquisition, processing, visualization, and integration has been proposed, along with the use of CFD modeling and AI [50]. This combination suggests a maturity path toward predictive and prescriptive functions for hydropower performance and flexibility services.

5.5. Cross-Sectional Synthesis: Archetypes, Maturity, and Contribution to Sustainable Development

In four cases, digital twin initiatives fall into four archetypes: (i) operational grid twins at DSOs (Enea, Energa), (ii) performance and asset twins for RES and CHP (Energa), (iii) flexibility twins for hydropower and potentially pumped-storage power plants (Tauron, PGE), and (iv) competency-training twins utilizing immersive simulation (PGE, Enea).

From a sustainability perspective, these archetypes contribute to the outcomes of the energy transition through different mechanisms: grid twins increase connection capacity for RES and reduce losses/outages; asset twins improve availability and reduce O&M emissions through condition-based maintenance; flexibility twins support balancing and reduce the need for curtailment; whereas competency twins reduce operational risk and improve safety and the pace of learning in high-cost environments, such as offshore wind. To compare heterogeneous initiatives, an energy-specific digital twin maturity framework was applied, combining technical and governance dimensions. The coding is indicative and based solely on publicly disclosed information; it should therefore be interpreted as a comparative heuristic rather than a certification. The maturity levels are conceptual and may coexist within a single organization for different assets or network layers. Table 4 summarizes the cases based on the analytical framework.

Table 4. Matrix of case studies of disclosed digital twin initiatives (desk-based synthesis).

Case	DT Scope	Main Application(s)	Key Data/Systems	Estimated Maturity	Main Contribution to Sustainability
Enea (Enea Operator—110 kV EMS)	Grid (110 kV HV; nodes and connected generation)	State estimation (observable and unobservable domains); N-1 analysis; n + 5 min simulation; dispatch decision support and work planning	SCADA + EMS (state estimator, power flow modules, N-1/N-X rules); CIM; integration with OMS	L2–L3 (operational/predictive; prescriptive elements)	Higher reliability and resilience to telemetry failures; loss reduction; safer integration of renewable energy sources
Enea (Enea Operator—MV DMS)	Grid (MV; extension of DT functions from HV to MV)	P/Q load estimation; voltage/current overcurrent estimation; short-circuit calculations; configuration optimization (loss minimization); risk analysis; simulations following planned changes; HV/MV transformer load forecasts; A1–A5 emergency restriction plan	DMS + LV network models; topological data and parameters; measurements/SCADA; estimation results	L1–L2 (implementation; diagnostics/simulations)	Better operational decisions at the MV level; reduction in losses and overloads; faster identification of risks; preparation for greater DER/RES penetration
Enea (Enea Operator—VR)	Training/competencies	Immersive training and situational awareness (VR) for grid operations	VR system; training scenarios; (optional) infrastructure models	L1–L2	Safer training; faster skills transfer; reduction in operational risk
Energa (Energa-Operator)	Grid (distribution; HV–LV)	Integrated network representation; event simulation; analysis of investments and the impact of renewable energy sources	SCADA/ADMS; GIS; AMI (>3 million meters); data quality programs	L2–L3 (depending on the project)	Higher connection capacity; faster planning; better outage management
Energa Group (generation assets)	Asset/facility (CHP; wind turbines)	Plant management support; predictive diagnostics; weather impact assessment	SCADA; sensor data; historical operational data; AI analytics	L2–L3 (depending on the asset)	Higher availability; condition-based maintenance; lower O&M footprint
PGE	Training/competencies; (signal) installation flexibility	Offshore training and preventive diagnostics; twin analysis for ESP	VR simulators; DT concept; procurement related to the Żarnowiec analysis	L1–L2 (training); TBD for the facility	Safer offshore operations; potential for flexibility optimization
Tauron (Tauron Ekoenergia)	Facility (hydropower)	Flexibility and sustainable operation; work optimization	D-HYDROFLEX; modular DT architecture with CFD/AI	L2–L3 (concept→implementation)	Balancing support; efficiency; reduced curtailment and emissions

Note: Maturity was estimated based on public disclosures, and for the Enea case, it was supplemented with the company’s internal materials; it should be considered indicative.

6. Discussion

6.1. Digital Twins as a “Capability Stack” for the Energy Transition

The analyzed cases suggest that digital twins are not a single technology, but a “capability stack” built on data infrastructure, semantic models, and analytics integrated with operational processes. At DSOs, network twins are emerging as an extension of SCADA/ADMS and GIS toward a unified, simulation-ready representation covering the HV–LV levels. In generation assets and flexibility, twins focus on improving availability and controllability under more dynamic operating regimes.

A parallel evolution is evident: (i) “operational twins” for decision support in the control room and (ii) “competency twins” for training and procedures. This dualism is particularly significant in offshore wind, where physical access is limited and operational risk is high. Training twins can therefore be interpreted as an early adoption path, building organizational readiness before full operational twins become feasible.

The case of Enea Operator shows that, for a DSO, a network twin can be implemented as an EMS coupled with SCADA [66], in which the state estimator serves as a modeling layer ensuring observability even for unmetered areas and in the event of data transmission disruptions. Simulation (n + 5 min) and contingency (N-1 analysis) modules are used operationally by dispatchers, and the planned development toward Optimal Power Flow (OPF) control signals a transition from a predictive to a prescriptive twin. The DMS being developed for MV networks extends this set of capabilities to a level where voltage constraints and network configuration are critical for DER/RES integration.

6.2. Data Governance and Interoperability

In the analyzed set of case studies, a noticeable and recurring implementation constraint is not access to advanced analytical methods or machine learning algorithms, but rather the insufficient maturity of data governance frameworks and the inadequate quality of the raw data used to build network models. The functioning of digital twins of energy infrastructure remains dependent on the existence of complete, consistent, and up-to-date network asset registers, a detailed network topology, correct technical connection relationships, properly documented protection settings, and high-quality operational measurements, which form the basis for creating and validating simulation models. The practical value of digital twins increasingly depends on the effective integration of data streams from AMI metering infrastructure with the network model. However, this integration requires the implementation of personal data protection principles, in particular the principles of data minimization, purpose limitation, and ensuring that processing complies with the GDPR [35], which is directly applicable to data generated by end users, prosumers, and devices installed at energy consumption points.

The lack of interoperability should be considered a factor generating serious strategic risks. In a situation where there are no standard information models or unified data exchange interfaces at the sectoral level, the implementation of digital twins may lead to a dependency on a single technology provider, which significantly undermines the long-term flexibility and scalability of the implemented solutions. EU regulations (DGA and DA) establish a framework for the structured exchange of information resources between public and private sector entities; however, they do not eliminate issues related to the semantic ambiguity of sectoral data or the limitations arising from real-time data processing. Consequently, a key requirement for effective data governance in the energy sector is the development of reference information models and standardized APIs, enabling the creation of federated digital twin architectures that operate across organizational boundaries. Only such an approach allows for the realization of the principles of interoperability, scalability, and regulatory compliance, which form the foundation of the digital transformation of the European energy sector.

Reference [60] emphasizes that the DGA is geared toward enabling the creation of common European data spaces in strategic areas, which explicitly include the energy sector. The DGA establishes a legal framework intended to significantly improve the “data-sharing ecosystem,” but also imposes new legal requirements ensuring data security, trust, and transparency [65], the maintenance of which is essential when implementing digital twins in the energy sector. The DGA aims to increase data availability and facilitate its reuse by various groups of entities [10,60]. In the energy sector, this means the ability to use more sector-specific data to build digital models, greater transparency in the rules for sharing infrastructure data, and the obligation to apply protective clauses for data covered by trade secrets or critical infrastructure.

DGA does not, in and of itself, resolve semantic issues—it does not define industry-specific data models or integration standards. In the energy sector, this leaves an unmet need for the creation of common information models (e.g., CIM—Common Information Model), standardized APIs between operators and technology providers, and the standardization of measurement and real-time data. DGA also emphasizes the importance of protecting commercial, technical, and infrastructure secrets. Based on an analysis of digital twins, their operation may involve the processing of personal data, which implies the need to designate a data controller and comply with the principles of the GDPR, including data minimization, accountability, and transparency [35,74]. We always apply the GDPR whenever personal data is processed—and in the energy sector, especially in smart grids, this is common. Data used by digital twins may include, for example, household energy consumption profiles, the location and parameters of prosumer installations, and data on the behavior of IoT device users. In light of the above, it is important to remember the obligations arising from the GDPR.

In summary, the GDPR, DGA, and Data Act regulations differ in nature but complement each other, creating a coherent legal framework for privacy protection, data sharing and management, as well as data access and interoperability. In the case of digital twins in the energy sector, this means the need to simultaneously address the protection of users’ and prosumers’ personal data, the rules for the transfer and reuse of sectoral data, and the rights to access and control data generated by energy devices. The complexity of the energy sector’s data ecosystem means that entities implementing such solutions must ensure compliance not only with regard to the protection of personal data, but also in the areas of the flow, sharing, and interoperability of technical and sectoral data.

6.3. Legal Implications of Cybersecurity for Digital Twins

There are no legal acts directly concerning the cybersecurity of digital twins; in particular, none of the sources of law discussed in Section 2.4 contain provisions directly relating to digital twins. This stems from the current method of drafting legal acts—avoiding unnecessary casuistry—as well as the principle of technological neutrality derived from European law, meaning that the use of a specific type of technology is neither imposed nor favored.

In operational practice, the digital twin (EMS) at Enea Operator is used in the control room for real-time traffic management, and the state estimator is intended to ensure the continuity of observability even in the event of communication failures and partial loss of measurement data. This role increases the criticality of the digital twin in risk analysis and reinforces the argument that, depending on the implementation context, it may be subject to NIS2/CER regimes as part of essential services or critical infrastructure.

Digital twins may be subject to, or potentially all of, the regulations listed in Section 2.4. First and foremost, as information systems used to provide essential services, they will be subject to the Act on the National Cybersecurity System, which implements NIS2. At the same time, neither the Act nor its implementing regulations specify how incident risk should be assessed and managed, or what security measures would be appropriate and proportionate to the assessed risk, leaving this to the recommendations of cybersecurity authorities (Article 42(1)(5) and (8) of the National Cybersecurity System Act). Neither ENISA nor the minister responsible for energy has yet published recommendations regarding the cybersecurity of digital twins. Non-binding international standards concerning digital twins, which are more or less useful for risk assessment and the selection of protective measures, include the ISO standards ISO 23247 (Automation systems and integration—Digital twin framework for manufacturing), the currently draft ISO/IEC WD TS 27568 (Security and privacy of digital twins), and the U.S. standard NIST IR 8356 (Security and Trust Considerations for Digital Twin Technology).

In the context of digital twins, supply chain security is of great importance and, in light of the provisions of the Act on the National Cybersecurity System, must be addressed when conducting a risk analysis. Ensuring supply chain security is one of the pillars of digital sovereignty, and in specific cases, a supplier of hardware or software used by critical or important entities may be subject to proceedings to designate them as a high-risk supplier. The procedure is complex, and the grounds are of a non-technical nature (e.g., threats to national security of an economic, intelligence, or terrorist nature, as well as threats to the fulfillment of allied and European obligations, or the fact that the supplier is under the control of a state outside the territory of the European Union or NATO). If a supplier is designated as a high-risk supplier, the identified key and important entities shall not put into use the types of ICT products, types of ICT services, and specific ICT processes within the scope of the decision, supplied by the high-risk supplier, and shall withdraw from use the types of ICT products, types of ICT services, and specific ICT processes within the scope of the decision provided by a high-risk supplier no later than 7 years from the date of the decision’s announcement (Articles 67b–67c).

Digital twins used within an energy company may constitute one of the elements of critical infrastructure. Furthermore, in the draft law implementing the CER Directive into Polish law, the definition of critical infrastructure is significantly expanded compared to the definition in the CER Directive and includes, among other things, services necessary to ensure the functioning of enterprises, which, it seems, in some situations may also include digital twins—i.e., the digital twin itself could be considered critical infrastructure and included in the list of critical infrastructure. It should be noted that falling under the critical infrastructure regulations may significantly curtail the decision-making autonomy of the digital twin owner, primarily due to the requirement to coordinate the critical infrastructure protection plan with public authorities (i.e., with the provincial governor, the competent minister, or the head of a central office) and the possibility that these entities may refuse to approve the plan.

AI systems in digital twins intended for use as security-related components of critical electricity supply infrastructure management processes constitute high-risk systems (Annex III to the AI Act, point 2). Obligations related to the use of a high-risk AI system include following the provider’s instructions, monitoring the system’s operation, and retaining logs (Article 26) Regarding the obligation to ensure human oversight, entities using high-risk AI systems must designate competent persons authorized to monitor system operation, detect anomalies, and intervene (including system shutdown) to prevent risks (Article 14).

“Smart meter gateways in smart metering systems are classified as ‘critical products with digital components’ under the CRA (Annex IV). As critical products with digital components, they may be subject to mandatory certification. For products with digital components that fall within the scope of the CRA and are classified as high-risk AI systems in accordance with Article 6 of the AI Act, they are deemed to meet the cybersecurity requirements set forth in Article 15 of the AI Act if such products meet the essential cybersecurity requirements specified in Annex I of the CRA; the procedures implemented by the manufacturer comply with the essential cybersecurity requirements set out in Part II of Annex I to the CRA; and the achievement of the level of cybersecurity protection required under Article 15 of the CRA has been demonstrated in the EU Declaration of Conformity.

In accordance with the requirements of Annex I of the CRA, products with digital components must be designed and manufactured in a manner that ensures a level of cybersecurity appropriate to the risk. They must be made available in a secure default configuration and without known vulnerabilities. Manufacturers must ensure effective access control, protection of data confidentiality and integrity, and minimization of data processing. It is crucial to enable the elimination of vulnerabilities through updates, including automatic ones, and to ensure the resilience of functions, e.g., against DoS attacks. If vulnerabilities are detected, manufacturers are required to respond immediately, conduct testing, and implement a coordinated vulnerability disclosure policy. It is also essential to provide detailed documentation, including a list of software components, and to enable users to securely delete data.

Conclusions from the discussion regarding the Enea Operator case indicate that the core of network twins is the state estimation mechanism and the consistent semantic model (CIM), and their value increases with integration into dispatch processes (simulations, safety criteria, work planning). At the same time, proximity to the OT layer (SCADA) and the growing role of predictive and prescriptive functions (reconfiguration, OPF) increase the requirements for data governance and cyber resilience.

6.4. Barriers to Scaling, Lessons Learned, and the Sandbox Urbanism Risk

Empirical analysis reveals significant discrepancies between the level of technological advancement declared by energy groups and the actual operational maturity of their implementations. The majority of analyzed projects, such as those within PGE or Energa, exhibit the characteristics of isolated pilot initiatives, carrying a distinct risk of becoming trapped in an experimental phase—a phenomenon conceptualized as “sandbox urbanism” [14]. The lessons learned from these deployments highlight several critical barriers to scaling [75], beginning with deep-seated organizational silos. A profound lack of information flow between Information Technology (IT) departments, which are responsible for advanced AI/ML algorithms, and Operational Technology (OT) departments, responsible for physical grid security, reliability, and SCADA systems, generates systemic delays and inconsistencies in dynamic network modeling [53,76]. This structural friction is further compounded by low semantic maturity, wherein the parallel application of inconsistent coding standards and the absence of full, native integration with the Common Information Model (CIM) standard forces utilities to develop bespoke, highly capital-intensive integration interfaces, which drastically inflates the lifetime operational costs of digital twin systems [54]. Ultimately, steep competency barriers obstruct scalability, as the paradigm shift in dispatching roles—transitioning from manual control toward the oversight of autonomous decisions executed by Explainable Artificial Intelligence (XAI) systems—demands a profound transformation of organizational culture, an evolution for which contemporary energy enterprises are frequently underprepared [16,20].

7. Policy and Regulatory Recommendations

7.1. Toward a Regulatory Taxonomy of Digital Twins in the Energy Sector

Regulators and system operators would benefit from a common taxonomy distinguishing between (i) digital models, (ii) digital shadows, and (iii) operational/predictive/prescriptive digital twins. Such a taxonomy could be embedded in reporting templates for network development plans and resilience assessments, enabling benchmarking and more targeted regulatory expectations. A clear classification is also essential to determine when a digital twin should be treated as a critical service element within the meaning of NIS2 and sector-specific cybersecurity rules [7,39].

Based on the Enea Operator case study [66], it is proposed that the taxonomy should distinguish at least (a) an operational network twin (110 kV EMS with a state estimator), (b) the MV network twin implemented by DMS modules (load estimation, analysis, and configuration optimization), and (c) the competency twin (VR) focused on training and procedures. Distinguishing these classes facilitates the definition of data, validation, and cybersecurity requirements appropriate to their functions.

7.2. Energy Data Spaces, Access Rights, and Interoperability Requirements

Scaling network twins and flexibility twins requires predictable access to high-quality data across organizational boundaries (e.g., DSO–TSO coordination, market participants providing flexibility). EU data governance instruments (Data Governance Act, Data Act) establish a general framework enabling data sharing and portability [10,11], but energy regulators should supplement it with (i) mandatory minimum data quality requirements for asset and network topology registries; (ii) standardized APIs compliant with energy information models; (iii) governance solutions for trusted data intermediaries; and (iv) clarification of the legal basis and safeguards when smart metering data is processed for operational analytics in accordance with the GDPR [35].

The development of digital twins in the energy sector requires a coherent regulatory ecosystem covering data quality, interoperability, security, sharing mechanisms, and neutral data intermediary structures. The DA and DGA establish horizontal principles for data flow and reuse, but they do not address a number of sector-specific conditions characteristic of the energy sector, including the specific nature of infrastructure data and near-real-time requirements. Consequently, it is necessary to develop a dedicated “regulatory hub” that will complete the structure of the EU data governance framework and enable the scaling of digital twin models of energy systems.

The growing dependence of digital twin models on operational, measurement, and infrastructure data requires the establishment of quality standards for asset registers, network topologies, and measurement data. Taking into account the principles established under the DGA, the national regulator should implement a legal framework covering indicators of data completeness, timeliness, and consistency, and make the approval of network development plans contingent on the results of data quality audits. The DGA does not address the issues of sectoral data semantics or real-time interoperability, leaving it to Member States to fill these regulatory gaps. It is therefore essential to establish a sectoral interoperability profile, based on common information models, covering both static data (topology, assets) and dynamic data (measurement, control).

The DGA introduces a new category of entities—data intermediaries—and therefore it is necessary to establish an industry-specific registry of energy data intermediaries and to define requirements regarding their competence, independence, and compliance with regulations concerning transfers to third countries. This mechanism should also enable the operation of “data safe rooms,” where protected infrastructure data can be processed in a manner compliant with the DGA.

The DGA stipulates that the reuse of personal data requires the use of anonymization or pseudonymization mechanisms and strict adherence to privacy protection rules. Consequently, sector-specific guidelines for operators should be developed regarding the separation of personal and non-personal data, permissible legal bases for processing for the purposes of operational and predictive analytics (including in digital twins), sector-specific DPIA templates, and methods for mitigating the risk of re-identification. This mechanism is key to ensuring compliance with the GDPR and the principles of transparency and proportionality. The obligations regarding update frequency, data exchange standards, and quality indicators should be clarified, as these are directly related to the obligations under the DGA concerning transparency and the non-discriminatory provision of information resources by the public sector.

The recommendations presented reflect the need to create a coherent regulatory framework that not only complements the horizontal provisions of the DGA and the Data Act but also enables their practical implementation in the energy sector—a sector characterized by highly sensitive data, significant operational consequences, and growing dependence on digital technologies. The proposed solutions are complementary in nature: they encompass both legal frameworks and technical and institutional requirements, which together form the foundation for scalable and regulatory-compliant digital twins of energy networks.

7.3. Standards for Cybersecurity Requirements for Digital Twins

In terms of cybersecurity, digital twins are subject to extensive legal acts stemming from European law, such as the provisions of the Act on the National Cybersecurity System [37], the Act on Crisis Management [41], and directly to European regulations such as the CRA [8] or the AI Act [9]. These impose numerous, often overlapping obligations, the fulfillment of which depends largely on the risk analysis and assessment conducted by the obligated entity. Supporting the development of digital twins requires the cybersecurity authority to develop recommendations that clarify the requirements arising from applicable regulations and provide guidelines on risk analysis and appropriate measures. Such recommendations should be developed with the active participation of the energy sector (establishment of a working group). It appears that in this case, rules for cooperation among businesses within the working group should be developed in accordance with the provisions of the Act on the National Cybersecurity System, which implements the NIS2 Directive (an agreement on information exchange pursuant to Article 8h(6)) [7].

In cases where the digital twin is tightly integrated with SCADA and includes functions that recommend or execute control actions (e.g., OPF control following estimation, as indicated in EMS development), cybersecurity requirements should cover not only data protection but also model integrity and decision authorization mechanisms (human-in-the-loop, log accountability).

7.4. The Spatial Dimension in DT Systems and Recommendations for Spatial Planning

In the context of spatial planning, DT is subject to the provisions of the Act on Spatial Planning and Development, particularly as amended by the 2023 reform [77]. This amendment, by introducing the Urban Planning Register and the obligation to fully digitize spatial planning acts (APP), makes data standards based on GML application schemas the foundation for the interoperability of DT systems with public administration. This process is not merely a technological change, but a profound redefinition of public law instruments, intended to ensure the “governability” of state and local government bodies in the digital environment by moving away from case-by-case approaches in favor of systemic legal solutions [45]. The implementation of LDT enables the transformation of static cartographic studies into dynamic simulation environments, allowing for a precise assessment of a site’s investment potential and an analysis of the energy balance at the territorial level.

Supporting siting processes requires a systematic integration of network operators’ (DSOs) models with municipal urban planning standards through the development of a sectoral metadata profile for the “energy layer” in the GML standard. In light of the 2023 spatial planning reform [77], a key recommendation for both state and local government administrations is the creation of uniform metadata standards for this “energy layer” within GML spatial database structures. Current technical regulations implementing the INSPIRE Directive [78] and national executive regulations fail to ensure full semantic interoperability between technical network models (CIM) and planning registers (APP) [77]. Consequently, it is indispensable to develop standards for the automated validation of critical infrastructure compliance with municipal General Plans using certified Local Digital Twin (LDT) algorithms [13,56]. This would allow for the automatic verification of the compliance of investment projects (including renewable energy farms or energy storage facilities) with general plans in real time, reducing regulatory uncertainty for investors and the risk of the transition being blocked by planning barriers.

When using DT technologies in public participation procedures (Article 8e of the Act), these solutions serve to mitigate NIMBY-type conflicts through high-fidelity visualization of physical impacts, such as noise emissions or shadow flicker. Legal requirements in this regard should cover not only the esthetics of visualizations but, above all, their semantic and geodetic accuracy, ensuring a “single source of truth” for all stakeholders in the process. It is recommended to strive for the recognition of certified DT simulations as admissible evidence in administrative proceedings concerning the issuance of environmental and siting decisions. Granting certified digital twin simulations evidentiary status in these administrative proceedings will significantly shorten permitting timelines and curb the risk of arbitrary bureaucratic decisions, while simultaneously ensuring effective human oversight of automated spatial inference processes (human-in-the-loop), which aligns with the AI Act’s requirements for high-risk systems used in critical infrastructure management [9].

It is important to note that regulatory sandboxes should be treated as controlled testing environments, not as proof of market or operational maturity of digital twin technology. Evidence from European pilot programs indicates that a significant share of DT initiatives do not progress beyond the sandbox phase, due to insufficient data quality, lack of interoperability with legacy systems, unclear accountability structures, or the absence of a viable business case beyond the pilot. This phenomenon—analogous to “sandbox urbanism” observed in urban digital twin deployments—underscores the need for structured transition conditions: transparent data governance arrangements, defined timelines, independent validation of results, and explicit risk assessment frameworks. The lessons from pilots that have not scaled should be systematically documented and shared across the sector, so that regulatory sandboxes generate cumulative institutional knowledge rather than isolated experiments. A deeper structural driver of this risk lies in the design of sandbox frameworks themselves: most national regimes, including those in the energy sector, tightly formalize sandbox entry while leaving exit at the regulator’s discretion—with no binding obligation to determine the future status of a tested solution once the pilot concludes. Closing this institutional gap, rather than improving technical rigor alone, is the fundamental condition for sandbox programs to function as instruments of managed technological change rather than perpetual experimentation.

7.5. Regulatory Sandboxes

In the context of accelerating technological progress, which poses a challenge not only due to the pace of change but above all due to the growing complexity of individual elements of reality (including services and devices introduced to the market), the legal system and regulatory institutions are no longer fully fulfilling their function [79]. This results in a significant contradiction between the demands for specificity and flexibility in the law. On the one hand, complex technological matters necessitate the creation of highly detailed standards; on the other hand, the dynamics of innovation require a flexible framework capable of adaptation without the need for constant amendments.

This trend increases tension between state institutions and market participants and leads to a paradoxical situation in which the state must constantly adapt the law to changing realities and take into account an ever-increasing number of phenomena, yet at the same time cannot do so without limit, due to the market’s demand for greater legal stability and general guidelines on good legislation.

The solution to this situation is to create a closed space between the market and the regulatory system, where different rules will apply and the protection of the entire market against irregularities will be guaranteed. One such solution would be for regulators to increase the use of regulatory sandboxes and controlled pilot programs with regard to digital twins. Sandboxes allow for the verification of benefits and risks under supervision (e.g., cybersecurity testing, model validation, KPI measurement) prior to large-scale implementation [80,81].

This approach is part of a broader European trend toward agile innovation, in which regulatory sandboxes are viewed as controlled environments designed for iterative validation and safety certification. As indicated in recent studies on the digital twin of the European power grid, countries such as the Netherlands and France are introducing sandboxes to mitigate regulatory rigidity and reduce the risk (de-risk) of early implementations [18].

International experience with regulatory sandboxes in the energy and urban digital twin domains shows that many projects demonstrate promising results under sandbox conditions but fail to transition to systemic deployment. This risk, described in the literature as “sandbox urbanism”, is equally relevant for energy sector DTs. The Polish cases analyzed in Section 5 illustrate that several initiatives remain at the level of public announcements or early pilots, with limited evidence on whether clearly defined exit criteria and performance thresholds have been met. The main barriers reflected in these cases include insufficient data governance maturity (especially with regard to state estimation quality and CIM consistency), the absence of ex ante defined exit criteria, limited transparency of data sharing between project participants and regulators, the fragmented scope of sandbox exemptions under the Energy Law, and the reputational incentive to overstate DT maturity in public communications. To mitigate these risks, regulatory sandboxes for energy DTs should explicitly link pilot design to the KPI framework outlined below, define time-bound pilot periods, and require public reporting of both successful and failed outcomes.

In the Polish financial system, the sandbox model is successfully used by the Polish Financial Supervision Authority (KNF) as an instrument to support the FinTech market. In the energy sector, a landmark step was the introduction of Article 24d of the Energy Law (amendment of June 2023), granting the President of the Energy Regulatory Office (URE) the authority to grant exemptions from certain statutory obligations for the purpose of implementing innovative projects [82]. In early 2026, the President of the URE announced the first call for proposals in this regard].

Related manufacturing literature also shows that digital twins can support modular system design and digital shopfloor management in controlled operational environments [83,84].

Creating a controlled environment enables the verification of benefits and risks prior to system-wide implementation. This includes, among other things, advanced cybersecurity testing (e.g., simulations of attacks on AMI infrastructure or verification of compliance with the NIS2 Directive [7] in a secure virtual environment) [69,70], validation of the accuracy of physicochemical models (e.g., transformer degradation), and precise measurement of key performance indicators (KPIs) under simulated extreme conditions [85].

However, the effectiveness of a regulatory sandbox depends on the upfront definition of measurable success criteria. For digital twin pilots in the energy sector, a standardized set of Key Performance Indicators should be established before the sandbox commences, including reduction in grid connection waiting times, accuracy of state estimation residuals, frequency and duration of unplanned outages, network loss reduction, data quality improvement rates, and accuracy of predictive maintenance forecasts. These KPIs serve a dual purpose: they enable objective evaluation of the pilot’s outcomes and provide regulators with evidence-based grounds for deciding whether to proceed with full-scale deployment. Equally important are exit criteria—predefined thresholds that determine when a pilot has generated sufficient evidence to justify transition to operational status, or conversely, when it should be terminated. Without such criteria, sandboxes risk becoming indefinitely extended experiments rather than time-bound validation environments.

In the context of digital twin ROI, sandbox frameworks for energy DTs should therefore include a minimum standardized KPI set, covering at least (i) reduction in grid connection waiting times, (ii) state estimation accuracy (residual error under normal and stressed conditions), (iii) reduction in unplanned outages (e.g., improvements in SAIDI/SAIFI), (iv) reduction in network losses in MV and LV grids, (v) data quality indices (completeness, consistency and timeliness of CIM and asset models), and (vi) cyber incident detection and response time. These KPIs should be defined ex ante, measured throughout the sandbox period and reported transparently as a precondition for exiting the pilot phase.

Section 7.5 operationalizes this recommendation by proposing a standardized KPI framework for energy sector DT sandboxes and by specifying the conditions under which sandbox results can justify scaling beyond the pilot phase.

The impact of regulatory sandboxes on legal culture is also significant. Through structured dialog between market regulators and market participants, it is possible to systematically adapt the regulatory framework to market needs, particularly when implementing innovative technologies for which regulatory practices or legal standards have not yet been established, and the teams responsible for developing these practices and standards do not possess sufficient knowledge regarding the specific operational characteristics of certain technologies [86].

For example, at the technical level, these sandboxes are crucial for testing the integrated functions of ADMS (Advanced Distribution Management System) and DERMS (Distributed Energy Resources Management System) at the medium- and low-voltage (MV/LV) grid level [64]. For instance, a digital twin allows for testing the dynamic optimization of network topology (real-time reconfiguration), combined with dynamic line rating (DLR) systems, to maximize throughput for wind generation. Equally important is testing autonomous control from the OPF (Optimal Power Flow) module, implemented immediately following advanced grid state estimation. In the sandbox, these systems can be tested for compliance with safety criteria and data resilience. The digital twin must demonstrate that it can algorithmically identify, filter out, and compensate for noisy or lost sensor signals before erroneous information triggers a physical, undesirable response from the protection automation system.

At the same time, it should be noted that a digital twin can serve as a tool within a regulatory sandbox, functioning as an environment that corresponds to the entire network or specific network components. The use of a digital twin as an integral part of a regulatory sandbox creates a so-called virtual laboratory or virtual sandbox. This ensures the isolation of experiments from physical critical infrastructure, eliminating the risk of disruptions to energy supply continuity (blackouts). In such a virtual environment, market participants can safely conduct “what-if” analyses, testing, for example, the grid’s response to sudden spikes in renewable energy generation, cyberattacks, or demand-side response (DSR) algorithms. Furthermore, the use of methodologies such as Hardware-in-the-Loop (HIL) allows for the physical connection of prototype controllers or devices (e.g., inverters) to a real-time virtual grid model, ensuring high test fidelity [64].

Given the outlined possibilities, it must be concluded that the regulation concerning the regulatory sandbox (exemptions), established under Polish energy law, creates a very limited and closed system. The legislator has provided for only four scopes of exemption and introduced numerous preconditions. Given the scope of this paper, it suffices to note that the very practice of exhaustively listing possible areas of exemption contradicts the idea of a regulatory sandbox, which involves creating an environment for technologies with not fully understood characteristics—and thus also with not fully understood impacts on the regulated environment and the power system.

7.6. Summary of Recommended Regulatory Actions

Table 5 translates the above discussion into actionable recommendation for policy regulators, and entities in the energy sector.

Table 5. Selected EU regulatory instruments and standards relevant to digital twins in the energy sector.

Instrument/Standard	Scope	Significance for Digital Twins	Implementation Implications
Digitalizing the Energy System—EU Action Plan [3]	EU Strategic and Policy Agenda for the Digitalization of the Energy Sector	Identifies secure data spaces, interoperability, cybersecurity, and the development of a digital twin of the power system as elements of the “twin transition”	Strategic alignment of DT projects; expectations regarding interoperability, data exchange, and security
NIS2 Directive [7]	Cybersecurity of critical/important entities	Relevant to DT used by energy sector entities as part of the ICT/OT environment supporting critical services	Risk, incident, and business continuity management, supply chain security, and oversight
Network Cybersecurity Code [39]	Sector-specific cybersecurity rules for cross-border electricity flows	Relevant to DT in the TSO/DSO environment, especially when supporting operational coordination, planning, and monitoring	Implementation of common minimum requirements, planning, monitoring, reporting, and crisis management procedures
Data Governance Act [10]	Institutional and procedural frameworks for the reuse of public sector data, data brokerage, and data altruism	Supports the creation of a trusted data-sharing ecosystem, but does not establish sector-specific semantic models for energy and planning	Data access governance, data intermediaries, reuse conditions, protection of sensitive data
Data Act [11]	Harmonized rules for data access and use	Is directly relevant to DT/EDT based on data from connected products and related services, including energy devices	User access to data, sharing with third parties, interoperability, limiting vendor lock-in, contractual requirements
GDPR [35]	Protection of personal data	Relevant when DT/EDT process smart metering data, prosumer data, or other data linked to an identifiable consumer or space user	Data minimization, legal basis for processing, DPIA, security of processing, accountability
AI Act [9]	Principles for AI systems, including high-risk systems	Relevant when AI components in DT/EDT support decisions related to security, critical infrastructure management, or the assessment of spatial scenarios	Risk classification, technical documentation, logging, human oversight, post-deployment monitoring
Cyber Resilience Act [8]	Horizontal cybersecurity requirements for products with digital components	Affects hardware and software components used in DT/EDT architecture and their supply chain	Secure-by-design, vulnerability management, security updates, declaration of conformity, market surveillance
IEC 62443 [53] and NIST SP 800-82r3 [76]	OT/IACS security guidelines and best practices	Provide a set of controls relevant to DT/EDT operating at the IT/OT interface, although they are not EU legal acts	Network segmentation, secure remote access, privileged account management, hardening, audits, and secure SDLC
INSPIRE Directive [78]	European Spatial Information Infrastructure	Key to integrating geospatial data with DT/EDT and LDT models; enhances the interoperability of spatial data used in planning the location of energy infrastructure	Standardization of spatial datasets and services, easier integration with GIS, improved quality of spatial analyses

Note: The table presents relevance at a general level; specific obligations depend on national transposition and the classification of the entity.

Table 6 summarizes the recommended legal and regulatory actions needed to enable the safe scaling of digital twins in the energy sector.

Table 6. Recommended legal and regulatory actions to enable the safe scaling of digital twins in the energy sector.

Recommendation	Rationale	Responsible Entity/Entities
Introduce a taxonomy of energy digital twins for regulatory reporting	Enables benchmarking, comparison of maturity levels, and clarification of the criticality level of individual EDT classes	National regulators; DSOs/TSOs; ministries
Establish minimum data quality requirements for datasets related to assets, network topology, and measurement data	Network twins require accurate input data; reduces model errors and improves operational and planning decisions	DSOs/TSOs; regulators; data operators
Standardize interoperability requirements in EDT procurements and projects (APIs, semantic models, data profiles)	Reduces vendor lock-in and enables federation of solutions across organizations and data domains	Energy sector entities; regulators; standardization bodies; system vendors
Embed cybersecurity-by-design and secure-by-default requirements in EDT procurement (in accordance with IEC 62443)	Reduces risks of OT/IT convergence, supply chain vulnerabilities, and security degradation throughout the system lifecycle	Energy sector entities; regulators; certification bodies; suppliers
Develop regulatory sandboxes for operational twins and resilience with cyber testing	Supports controlled experimentation, model validation, cybersecurity testing, and evidence-based scaling	Regulators; TSOs/DSOs; cybersecurity agencies; infrastructure operators
Clarify the lawful processing of smart metering and prosumer data for operational analytics	Reduces compliance uncertainty, protects consumers, and enables the use of data in EDT without violating data protection rules	Data protection authorities; energy regulators; legislators; system operators
Formalize the process of maintaining network models (e.g., CIM) and quality gates for measurement data in network twins	In practice, the effectiveness of state estimation and simulation depends on keeping the model up to date and identifying measurement errors; formalizing roles and procedures reduces the risk of the twin degrading over time	DSOs/TSOs; system providers; regulators (minimum requirements)
Develop a sector-specific interoperability profile for integrating energy and geospatial data	EDT with planning functions require a coherent linkage of network, environmental, and planning data	Ministries; GUGiK; municipalities; OSD/OSP
Ensure interoperability of EDT/LDT with digital spatial planning records, including the municipality’s general plan and GML data	Enables automation of location compliance analyses, improves procedural transparency, and shortens the investment process	Municipalities; ministries; system operators; GIS/DT solution providers
Develop guidelines for the use of EDT/LDT simulations in public consultations and siting procedures	High-fidelity visualizations and scenarios can mitigate NIMBY conflicts, but require minimum standards for reliability, timeliness, and accountability	Ministries; municipalities; environmental authorities; sector regulators

Note: Recommendations should be adapted to national conditions and aligned with EU instruments to avoid regulatory fragmentation. With regard to EDTs with spatial functions, it is crucial that cybersecurity, data quality, and interoperability requirements be designed jointly, rather than as separate regimes.

From the perspective of DSO implementations, the Enea Operator case suggests that the regulatory minimum for network twins should include not only cybersecurity requirements but also verifiable data quality and model maintenance requirements (e.g., CIM) as well as procedures for validating state estimation results. For decision automation functions (MV network reconfiguration, OPF-based control), it is reasonable to phase implementations through controlled pilots and regulatory sandboxes, underpinned by the ex-ante-defined KPI frameworks, strict exit rules, and human oversight in the loop, thereby ensuring that sandbox outcomes serve as objective instruments of evidence-based governance rather than perpetual isolated experiments.

8. Conclusions

The article indicates that DT in the Polish energy sector should be understood not as individual IT tools, but as a complex “stack of capabilities” combining data, models, analytics, and decision-making processes, effectively transforming digital twins from isolated IT tools into an integrated system of operational capabilities that bridges physical network assets with advanced decision models [15,54]. An analysis of multiple case studies of four Polish energy groups indicates that these implementations are currently developing in at least four archetypes: as operational network twins, asset performance twins, flexibility twins, and competency-training twins. Each of these archetypes addresses a different transformation challenge—from increasing grid observability and connection capacity for renewable energy sources, through improving asset availability and reducing downtime, to supporting system balancing and competency development in high-risk environments. In this sense, the answer to research question Q1 is affirmative: Polish energy groups are implementing diverse DT models that address the technical and regulatory requirements of the energy transition to varying degrees.

The study’s findings indicate that the actual value of DT does not stem solely from its technical sophistication, but from the quality of its integration into data governance, interoperability, and security architecture. In further research and pilot projects, it would be prudent to supplement the assessment of DT implementations with a perspective on the life cycle, circularity, resilience, and the EU’s technological autonomy and just transition safeguards [57,87]. The most mature initiatives—especially network twins developed by operators—demonstrate that the effectiveness of DT depends on consistent semantic models, ongoing updates to network models, high-quality measurement data, and the ability to integrate with existing SCADA/ADMS/EMS/DMS environments. At the same time, the analysis confirms that it is data governance, rather than a lack of analytical tools, that remains the primary constraint on scaling these solutions today. The answer to research question Q3 thus leads to the conclusion that without sector-specific rules on interoperability, data quality, cyber resilience, and model accountability, the development of EDT will be piecemeal rather than systemic.

The study confirms that the significance of EDT extends beyond infrastructure operation and increasingly encompasses planning and socio-spatial dimensions. The integration of energy data with GIS, local digital twins, and digital spatial planning records can improve the accuracy of siting decisions, reduce information asymmetry, and enhance the quality of public consultations. Thus, the answer to research question Q2 is affirmative: the integration of GIS and EDT systems can enhance the efficiency of investment processes, and location procedures, which proves particularly crucial in light of the 2023 spatial planning reform [77], but simultaneously reveals new challenges related to the interoperability of spatial data, model validation, algorithmic transparency, and the social legitimization of decisions. In this context, EDT becomes not only a tool for technical optimization but also a tool for supporting spatial decision-making and communication with stakeholders. Due to methodological limitations inherent in relying primarily on disclosed public information, comprehensive, bi-directional, real-time integration of energy digital twins with municipal spatial planning systems currently represents a strategic target rather than an established operational reality within Polish energy groups. The potential efficiency benefits of GIS-DT/LDT synergy should therefore be treated as a prospective development pathway requiring further regulatory harmonization, data interoperability, model validation, and institutional integration.

On the regulatory front, the analysis concludes that the European and national legal ecosystem already provides many essential elements for the development of EDT but remains fragmented. Data governance instruments, cybersecurity regulations, rules governing products with digital components and AI systems, and spatial planning reform form a significant but not fully synchronized implementation framework. From a practical perspective, this implies the need to build a more coherent “regulatory hub” for EDT in the energy sector, encompassing a common taxonomy of solutions, minimum data quality requirements, interoperability profiles for energy and geospatial data, and sector-specific guidelines on cyber resilience and model accountability. It seems particularly important to develop controlled pilot projects and regulatory sandboxes for solutions that fall within the scope of decision automation or are strongly integrated with critical infrastructure. Ultimately, constructing such a defined capability stack requires coordinated regulatory actions, including the harmonization of cybersecurity standards (in alignment with the IEC 62443 series [53] and the CRA requirements [8]) and the establishment of dedicated, sector-specific energy data spaces [54]. Only a systemic approach will allow for the transformation of technological innovations into an enduring tool for managing space and national energy security [37,58].

However, the limitations of the study should be clearly noted. First, the analysis was based on publicly available company disclosures, project documents, and the literature (disclosed claims); therefore, it does not allow for independent technical validation of the full maturity of the implementations or their operational outcomes. Second, the assignment of maturity levels is heuristic and comparative in nature, not certifying. Third, due to the nature of desk research, it was not possible to verify internal model management practices, data quality, security mechanisms, and the actual scale of integration with operational processes. The results obtained should therefore be interpreted as a mapping of development patterns and implementation barriers, rather than as a technical audit of the solutions examined.

Future research should supplement the mapping based on public sources with interviews and a quantitative assessment of operational effects (loss reduction, renewable energy connection capacity, outage rates, maintenance costs, and emissions), as well as analyze the organizational changes and staff competencies necessary for the sustainable operation of digital twins in critical infrastructure.