Table of content
Energy industry
20 May 2026

The hidden cost of legacy RTU systems in modern grids

Quick summary

Most European grid operators still rely on remote terminal units installed decades ago. The line-item cost looks low because the hardware was paid for years ago, but the real cost shows up elsewhere: in operational inefficiency, cybersecurity exposure, integration debt, and missed value from renewables and flexibility markets. The IEA estimates EU grid investment needs to reach EUR 584 billion by 2030, with EUR 170 billion of that earmarked for digitalisation alone.

Introduction

Walk into almost any European substation and a familiar picture emerges. Modern fibre links and SCADA dashboards sit alongside RTUs that were commissioned in the 1990s, still relaying telemetry, still executing control logic, still doing what they were designed to do. From a budget perspective, they look almost free. The hardware was paid for years ago, replacement is expensive, and operations have learned to work around the limitations.

The problem is that the line-item cost of a legacy RTU bears almost no relationship to its total cost in a modern grid. This article looks at where the real costs of legacy RTU systems actually accumulate, why they matter more in 2026 than they did even three years ago, and what modernisation actually requires for a European TSO, DSO, or system integrator operating under tightening regulatory and operational pressure.

The scale of the European grid investment gap

European grid modernisation has become one of the largest infrastructure programmes of the decade. The European Commission expects about EUR 584 billion of investments in the European electricity grid by 2030, with EUR 170 billion specifically allocated to digitalisation, including smart meters, automated grid management, and digital field operations (IEA, 2023).

According to the European Investment Bank, Europe's annual grid spending is on track to exceed USD 70 billion by 2025, double the level of a decade ago, yet grid investments still lag renewable deployment by a wide margin (EIB, 2025). The IEA estimates that global transmission investment grew 10 percent in 2023 to USD 140 billion, but needs to exceed USD 200 billion per year by the mid-2030s, and USD 250 to 300 billion under net-zero scenarios (IEA, 2025).

The headline number behind all this investment is straightforward: Europe is electrifying faster than its grid was designed to support. Legacy RTU systems were specified for a world of unidirectional flows, predictable load patterns, and isolated networks. None of those assumptions hold any longer. That mismatch is where the hidden cost of legacy RTUs begins.

In Nordic, DACH, and Benelux markets, the investment pressure is amplified by aggressive renewable targets, accelerating EV adoption, and growing demand from data centres. The IEA highlights that data centre electricity demand will require sustained grid investment alongside generation, with smart grid technologies central to maximising available capacity (IEA, 2025).

Takeaway: European grid modernisation is no longer optional, and legacy RTU systems sit at the centre of the gap between today's grid and tomorrow's requirements.

Where the hidden cost actually lives

The capital cost of replacing an RTU is visible. The hidden costs sit in places that rarely show up on a procurement spreadsheet.

The categories that consistently emerge include:

  • Operational inefficiency: limited telemetry resolution, manual intervention, and slow fault diagnosis that increase outage duration and operations cost

  • Cybersecurity exposure: protocols and devices designed for isolated networks, now connected, often without authentication or encryption

  • Integration debt: each new system added to the grid requires custom adapters or middleware to talk to the legacy RTU layer

  • Skills scarcity: engineers trained on legacy SCADA and RTU platforms are retiring faster than they can be replaced

  • Vendor dependency: many legacy RTUs depend on specific vendors for spare parts, firmware updates, and configuration tools, with limited or no support remaining

  • Reporting gaps: regulatory and operational reporting requirements increasingly outstrip what legacy telemetry can deliver

  • Missed market value: participation in flexibility markets, demand response, and ancillary services often requires data rates and control capabilities legacy RTUs cannot support

Each of these costs is invisible on a single budget line but visible across the operating expense, regulatory risk, and missed revenue lines of the same organisation. The total often exceeds the cost of modernisation within a few years, particularly once cybersecurity incidents or renewable integration delays are accounted for.

Takeaway: The real cost of legacy RTUs is distributed across operations, security, compliance, and missed market opportunity, rather than concentrated in any single line item.

The cybersecurity dimension is no longer theoretical

Legacy RTU systems were designed for an era when industrial networks were physically isolated. That assumption ended quietly years ago and is now contradicted explicitly by EU regulation.

The NIS2 Directive, applicable since October 2024, imposes cybersecurity and operational resilience obligations on essential entities, with the energy sector classified as a Tier 1 critical sector. The EU Cyber Resilience Act, Regulation (EU) 2024/2847, adds product-level cybersecurity requirements for connected devices, with full obligations applying from 11 December 2027 and vulnerability reporting starting on 11 September 2026 (European Commission, 2024).

IEC 62443, the international standard for industrial automation and control system security, sets explicit requirements for protocols, authentication, network segmentation, and incident response. IEC 62351 extends those requirements specifically to the IEC 60870-5-104 and IEC 61850 protocols that dominate European grid communication.

The implication for legacy RTU systems is clear. Protocols that transmit control commands without authentication, devices that cannot be patched, and systems that produce no audit trail are not just operationally risky; they are increasingly inconsistent with the regulatory baseline. Continuing to operate them is now a documented compliance exposure, not just an engineering concern.

For TSOs and DSOs, the practical effect is that cybersecurity has become part of the business case for RTU modernisation, not just an additional consideration during it.

Takeaway: EU cybersecurity regulation has made the operational risk of legacy RTUs a documented compliance exposure, raising the real cost of inaction.

Why legacy RTUs hold back renewable integration

The energy transition is not only a generation problem. It is also a grid intelligence problem, and that is where legacy RTUs become a structural constraint.

Renewable integration depends on capabilities most legacy RTUs were not designed to provide:

  • Higher resolution telemetry to manage variable generation

  • Bidirectional flow monitoring for distributed generation and storage

  • Fast, automated control loops for grid stability under fluctuating conditions

  • Granular visibility for distribution-level distributed energy resources (DERs)

  • Reliable communication paths for participation in flexibility and ancillary services markets

  • Standards-based protocols that allow new equipment to interoperate without custom adapters

Eurelectric, the European federation representing the electricity industry, has been explicit on this point. Europe's grid infrastructure is ageing, and the bottleneck is no longer primarily a copper-and-steel problem. The constraint is increasingly digital, driven by lengthy permitting processes, a lack of digital tools, and insufficient anticipatory investments at the distribution level (Eurelectric, 2025).

The European Commission's Grid Action Plan, published in November 2023, and the 2025 European Grids Package legislative proposal both reflect the same recognition: meeting Europe's electrification, decarbonisation, and resilience goals requires upgrading the grid's intelligence layer, not just adding more capacity.

For DSOs in particular, legacy RTU constraints often translate directly into stalled renewable connections. Connection queues lengthen, flexibility markets stay theoretical, and the value of distributed energy is captured by no one.

Takeaway: Legacy RTUs constrain renewable integration as directly as legacy lines and transformers, but the constraint is harder to see because it lives in the digital layer.

What modernisation actually looks like (without disruption)

The strongest objection to RTU modernisation is operational. Grid systems cannot be taken offline for a rip-and-replace project, maintenance windows are limited, and the cost of disruption is high. The good news is that successful modernisation rarely follows a rip-and-replace pattern.

The approaches that consistently work include:

  • Phased modernisation: replacing RTUs in tranches, prioritising the highest-risk and highest-value sites first

  • Protocol gateway strategy: deploying gateways that translate between legacy and modern protocols, allowing modern SCADA to operate over a mixed RTU fleet during transition

  • Edge intelligence: pushing logic to new RTUs or substation gateways so the central SCADA layer can be upgraded independently

  • Standards-based replacements: choosing RTUs that support IEC 61850, IEC 60870-5-104, DNP3, and modern security extensions (IEC 62351) to avoid recreating vendor lock-in

  • Certification-led integration: validating new equipment against the relevant international standards before deployment, not after

  • Cybersecurity built into the rollout: encryption, authentication, and network segmentation deployed as part of modernisation, not bolted on afterwards

  • Comprehensive testing: protocol conformance testing and interoperability validation that prevents integration surprises in the field

PG&E's 2025 substation modernisation programme illustrates the approach in practice. The utility describes its strategy around four principles: system performance, usability, cost-effectiveness, and future-proofing for emerging technologies (TD World, 2025). The pattern that emerges from successful modernisation programmes is consistent: the goal is not to install new RTUs but to install a foundation that absorbs the next 15 to 20 years of grid evolution without further disruption.

Takeaway: Successful RTU modernisation is phased, standards-led, and designed for operational continuity, not big-bang replacement.

Building a modernisation business case that holds up

Justifying RTU modernisation requires combining the visible capital cost with the hidden operational, security, and opportunity costs of continued legacy operation. The strongest business cases share a few common features.

Practical elements include:

  • Quantifying outage cost reduction from improved telemetry and faster fault isolation

  • Mapping cybersecurity exposure against NIS2, CRA, and IEC 62443 requirements

  • Identifying revenue opportunities in flexibility markets, demand response, and DER integration

  • Estimating skills cost as legacy expertise becomes scarcer

  • Including the cost of integration debt across future capital projects

  • Demonstrating phased risk reduction rather than one-off cost

  • Aligning the business case with EU and national grid modernisation funding programmes

The European Investment Bank and the European Commission's 2025 grid package both signal sustained financing availability for grid modernisation, with the explicit aim of reducing the digital bottleneck that legacy systems have become (EIB, 2025).

The strongest modernisation cases are not built on technology arguments. They are built on the financial reality that the hidden cost of legacy RTUs has been growing every year, while modernisation has become both cheaper and better-supported by EU funding.

Takeaway: A credible RTU modernisation business case combines hidden operational, security, and opportunity costs into a number large enough to make continued inaction the more expensive choice.

Conclusion

Legacy RTU systems were engineered for a grid that no longer exists. They were designed for unidirectional flows, isolated networks, and predictable load patterns, in an era when grid digitalisation, distributed renewables, EU cybersecurity regulation, and flexibility markets were not yet operational realities.

The hidden cost of keeping those systems in place is not a single number. It is the cumulative weight of cybersecurity exposure under NIS2 and the CRA, missed renewable integration opportunities, integration debt across every new project, vanishing engineering skills, and operational inefficiency that compounds with every additional year of service.

For European TSOs, DSOs, and system integrators, the decision is no longer about whether to modernise. It is about how to do it without disrupting operations, how to align with EU funding, and how to ensure that the modernisation done in 2026 delivers value for the next two decades. That is the work that defines competitive grid operators today, and the financial gap between those who do it well and those who delay it is widening.

FAQ

Why are legacy RTUs still in operation if they are so problematic?

RTUs are reliable hardware, often with 20 to 30 year service lives, and replacing them across a grid is operationally complex and capital intensive. The visible cost of a legacy RTU is low because the hardware has long since been depreciated, which masks the hidden costs in operations, security, integration, and missed market value.

What EU regulations affect legacy RTU systems?

The NIS2 Directive imposes cybersecurity and resilience obligations on energy operators since October 2024, and the EU Cyber Resilience Act adds product-level security requirements with full obligations from 11 December 2027. IEC 62443 and IEC 62351 set technical baselines for industrial control system and protocol-level security respectively.

Can legacy RTUs be made compliant without replacement?

In some cases yes, particularly through protocol gateways, network segmentation, and added security extensions such as IEC 62351. However, the more critical or exposed the RTU, the more difficult retrofit compliance becomes, and replacement is often the more cost-effective long-term path.

How does RTU modernisation affect renewable integration?

Modern RTUs provide the telemetry resolution, bidirectional flow monitoring, and standards-based protocols required for distributed generation, storage integration, and flexibility market participation. Legacy RTUs frequently constrain these capabilities, slowing renewable connections and limiting DSO and TSO ability to monetise grid flexibility.

What does a phased RTU modernisation programme look like?

A typical phased approach prioritises the highest-risk and highest-value sites first, deploys protocol gateways to maintain interoperability during transition, validates new equipment against IEC 61850 and IEC 60870-5-104 standards, and integrates cybersecurity as part of the rollout. The objective is operational continuity throughout the modernisation, not big-bang replacement.

Sources
About Author Wirtek is a Danish tech company with 25 years of experience, specialising in three core domains: energy, connectivity & automation and digital engineering. We build, connect and operate digital solutions through software development, Internet of Things (IoT), quality assurance and ready-made products. Founded as a Nokia spin-off, we combine deep know-how with EU compliance to partner with companies on their journey to modernise systems and extend capabilities while reducing risk. Since 2022, we have focused strongly on shaping solutions that power the sustainability transition.

Got a project in mind?

Talk to an expert