A Governance Framework for Digital Water Infrastructure

## Purpose As water utilities deploy smart meters, SCADA systems and AI-driven optimisation, questions of governance — who owns the data, who bears liability, how decisions are audited — have moved from academic to operational. ## Key Findings **Data ownership**: Water consumption data is personal data under GDPR and equivalents. Utilities must implement data-minimisation principles and retention schedules. Third-party analytics providers must be contracted as data processors. **Cybersecurity obligations**: The EU NIS2 Directive (2023) classifies large water utilities as essential entities with mandatory incident reporting within 24 hours and minimum security measures for OT systems. **AI-assisted decisions**: Where AI influences dosing, pressure management, or supply curtailment, utilities must maintain an audit trail capable of reconstructing the inputs and model version behind each decision. ## Recommendations 1. Adopt a data governance policy before procuring smart metering systems 2. Conduct annual OT security assessments aligned to IEC 62443 3. Require model version control in AI procurement specifications 4. Establish a cross-functional data governance committee with legal, engineering and IT representation