Your plant ran last week. The data exists. It sits in your historian, your SCADA, and your DCS. So why does getting a straight answer still take two days, three people, and a spreadsheet?
Valak AI Team
July 6, 2026 — 7 min read
NERC CIP-015-2. EPA emissions tightening. ISO 50001. FDA 21 CFR Part 11. Every regulated plant is sitting on the same problem: a deadline is coming, a regulator wants specific metrics, and nobody knows which tags in the historian are the ones that matter.
Sound familiar?
“We have got regulatory changes coming within two years. We know we need to start reporting on certain metrics, but we do not even know where to start gathering the data.”
This is the compliance version of a plant floor problem we hear constantly. The requirement lands on a desk. The engineer gets asked which tags capture the relevant data. And the honest answer is: we are not sure.
The big picture
The data your regulator wants almost certainly already exists in your plant. The problem is finding it.
Every modern industrial facility generates thousands of signals per second. Temperature, pressure, flow rate, energy draw, emissions, cycle time, batch yield. The historian captures all of it. The SCADA records it. The DCS logs it. If a process is running, it is being measured somewhere.
When a new regulatory requirement lands, the first instinct is to assume you need new instrumentation, new data infrastructure, or a new system. In most cases, that instinct is wrong. The sensors already exist. The tags are already in the historian. The signal has been captured for years. What is missing is the map between the regulatory requirement and the specific tags that satisfy it.
Valak connects to your existing historian via OPC-UA, browses the complete tag tree, and answers in plain English. Tell it what the regulation requires. It finds the tags, validates the data is being captured at the required resolution, and starts lossless archiving from day one. You have your baseline before the compliance window opens.
Why it matters
Compliance deadlines are fixed. The time to find your data is before the auditor asks for it.
The regulatory landscape for industrial operations is moving faster in 2026 than at any point in the last decade. NERC CIP-003-9 hit its April 2026 deadline. CIP-015-2 expanding Internal Network Security Monitoring is expected to require broad compliance by late 2029. EPA emissions reporting requirements are tightening across manufacturing sectors. ISO 50001 energy management certification is becoming a procurement requirement for major supply chains. FDA 21 CFR Part 11 electronic records requirements are under increased audit scrutiny for pharmaceutical and food manufacturing.
Each of these creates the same operational problem. A requirement arrives. An engineer is asked to produce data for a metric they have never been asked to report before. They open the historian. They look at 340,000 tags. They do not know which ones the regulator wants. And the deadline is in 18 months.
The cost of getting this wrong is real. NERC CIP violations carry civil penalties that can reach into seven figures per violation per day for systemic failures. EPA non-compliance triggers enforcement actions that extend well beyond the initial penalty. FDA audit findings can pause production lines. The data problem becomes a business continuity problem.
What is happening: the deadlines already in motion
Four regulatory requirements are driving urgent data questions at industrial plants right now.
| Regulation | Who it covers | Key metric requirement | Valak maps to |
| NERC CIP-015-2 |
Electric utilities, grid operators, energy generation |
Internal Network Security Monitoring across BES Cyber Systems. Expanded logging and event retention. |
OPC-UA tag browse + lossless event capture from day one |
| EPA Emissions |
Manufacturing, chemical, energy, heavy industry |
Continuous emissions monitoring: NOx, SOx, CO2, particulates at defined intervals. |
Historian tag identification + automated interval verification |
| ISO 50001 |
Any energy-intensive manufacturer seeking certification |
Energy consumption baselines, performance indicators, improvement metrics by asset and line. |
Cross-system energy data aggregation in plain English queries |
| FDA 21 CFR Part 11 |
Pharmaceutical, food, medical device manufacturing |
Electronic records with audit trails: who changed what, when, with what authority. |
Read-only audit log capture from SCADA and DCS with timestamp verification |
The NERC CIP-015-2 timeline
CIP-003-9 enforcement began April 1, 2026. CIP-015-2 expanding Internal Network Security Monitoring for high-impact systems and control centers is expected to require broad compliance by late 2029. Entities that begin asset mapping and logging baseline now will have three years of defensible evidence when the audit arrives. Entities that wait until 2028 will not.
How Valak works: from requirement to data in one conversation
The gap between a regulatory requirement and the tag that satisfies it is an access problem. Valak closes it without touching your control systems.
The typical compliance data workflow without Valak involves five people and six weeks. A compliance officer receives a requirement. They pass it to an engineer. The engineer tries to map the regulatory language to historian tags. They find candidate tags but are not sure which is authoritative. They escalate to the original system integrator, who may no longer be available. Eventually a tag is selected, a report is built manually, and the process starts again next reporting period.
With Valak, that conversation happens in plain English directly with the system:
| Step | Without Valak | With Valak |
| 1 |
Compliance officer asks engineer which tags capture continuous emissions data for Line 3 |
Compliance officer asks Valak: “Which tags on Line 3 capture NOx and CO2 emissions at one-minute intervals?” |
| 2 |
Engineer opens historian, searches 340,000-tag tree, identifies candidates over several days |
Valak browses the complete OPC-UA tag tree, identifies candidate tags, returns matches with descriptions and current values |
| 3 |
Engineer validates candidate tags against physical instrumentation documentation |
Valak confirms data is being captured at the required resolution and shows a sample of historical values |
| 4 |
Report built manually in Excel for each reporting period |
Valak begins lossless archiving of the identified tags from that moment forward, building the compliance baseline automatically |
| 5 |
Process repeated from scratch next reporting period |
Historical data is queryable at any time: “Show me Line 3 NOx for Q2 2026” returns the answer in seconds |
The bottom line
The data is there. The tags are there. The historian has been running for years. The only missing piece is the connection between the regulatory language and the OPC-UA address that satisfies it.
Every compliance engagement we have seen starts the same way. A requirement arrives. An engineer opens the historian. They feel overwhelmed by the scale of the tag tree. They do not know which tags the regulator wants, and they do not have a reliable way to find out without weeks of manual investigation.
Valak replaces that investigation with a conversation. You describe what the regulation requires in plain English. Valak maps the requirement to the tag structure it has already learned from your OPC-UA connection. It confirms the data is there, validates the resolution and completeness, and starts capturing losslessly from that point forward.
The 18-month deadline is an asset, not a constraint. You have 18 months to build a complete, auditor-ready dataset from the data your plant is already generating. The plants that start that capture now will walk into the audit with years of verified, queryable records. The plants that start six months before the deadline will not.
What’s next
Compliance reporting is a solved problem once the data capture is automated. The harder question is what else becomes possible when your regulatory data is queryable in plain English.
The plants that approach compliance as a data infrastructure investment rather than a reporting burden end up with something more valuable than a passed audit. They end up with a complete, lossless archive of every process signal the regulator cared about, queryable by anyone in the organisation, for operational as well as compliance purposes.
An engineer who can ask “what was our average NOx emission on Line 3 during the last six months and how does it correlate with raw material lot?” is not just meeting a compliance requirement. They are doing process optimisation with the same dataset. The compliance investment pays twice.
The deadline is fixed. The data is already there. Valak connects the two.
Start building your compliance baseline today
Connect Valak to your historian or SCADA in under an hour. Describe your reporting requirement in plain English. Valak identifies the tags, validates the data, and begins lossless capture from day one. Read-only. Air-gapped. No changes to your existing systems.