Practical AI for rail and public transport operators, their suppliers, and the consultancies that serve them

Most organisations in rail and public transport have run an AI pilot that never left the demo. We help teams find where these tools genuinely help, run the first experiments properly, and take what works into production — on your own hardware, in a hardened European cloud or with a model provider of your choice, with privacy, security and verification settled first.

Book a 30-minute call How we can help →What we have built →

Light trails from a train and road traffic at dusk on a rail line and road in Stuttgart

Photo: Mohammad Ebesh, Unsplash

I work at —

a rail or public transport operator

Knowing where AI can actually help in a production environment is most of the work

We help operators find the places where AI would hold up in maintenance, operations, asset management or procurement, run the first experiments on their own material, and turn what they learn into a responsible AI strategy and its governance.

Example deployment

A simplified view of what the system does with your documents. Tap a row to see how.

MAINTENANCEWO-2841 · unit 407

Fault history, 14 entriessummarised · cited
Maintenance manual, §7.3check sequence
Release to serviceengineer signs

14 depot reports summarised; each line cites its report and date.

The check sequence quoted from the manual in its own wording, page cited.

The system drafts; the engineer decides and signs. Nothing is released automatically.

Which AI ideas would survive daily operations?
Data protection stops every pilot at the review
Confident answers with nothing behind them
Experiments everywhere, no AI strategy

Swipe for more, tap a step.

How we help

Which AI ideas would survive daily operations?

We start from your processes, not from the tools, and rank where AI holds up: fault histories, maintenance records, asset registers, procurement files.

How we help

Data protection stops every pilot at the review

Deployment is decided first: your own hardware, a hardened European cloud tenant or a provider under contract, so the security review can say yes before the pilot starts.

How we help

Confident answers with nothing behind them

Every claim is checked against its source and cited; assessments are labelled as assessments. Your engineers see what is fact and what is judgement.

How we help

Experiments everywhere, no AI strategy

What the first experiments teach becomes a responsible AI strategy and the governance that goes with it, written for your board and your works council.

a supplier or rail-adjacent SME

Most of the hours go into documents nobody enjoys producing

Bids, compliance matrices, technical documentation, conformity evidence. This is the work our systems were built for: reading, matching and drafting with every statement traced to its source, on infrastructure your customers' auditors will accept — and we can build around your processes, or train your team to do it themselves.

Example deployment

A simplified view of what the system does with your documents. Tap a row to see how.

COMPLIANCE MATRIX212 requirements

R-041Retrofit on all 14 vehiclescompliant
R-042First vehicle back within 14 monthspartial
R-044Availability ≥ 98.5 %, defined twiceAvailability, defined twiceopen

Compliant: matched to product specification §2.1; the source page is one click away.

Partial: first vehicle at month 15 in our plan; flagged for the bid manager.

Open: availability defined in Annex C §2 and ITT Vol. 2 §6.2, differently. Raised as a clarification question.

Bids eat weeks of engineering time
Compliance matrices, line by line
Your customers audit your cybersecurity
Conformity evidence for the Cyber Resilience Act

Swipe for more, tap a step.

How we help

Bids eat weeks of engineering time

Tender OS reads and qualifies the documents within a day of publication; the Agentic Bid Builder drafts the response with every statement sourced.

How we help

Compliance matrices, line by line

Requirements are extracted, matched to your product and cited to the page; contradictions between volumes are flagged as clarification questions.

How we help

Your customers audit your cybersecurity

A hardened European cloud tenant, or your own hardware, that stands up to their questions: inference, storage and compute where you can show them.

How we help

Conformity evidence for the Cyber Resilience Act

Documentation drafted by agents and reviewed by someone who has run OT-security roadmaps for the same kind of company.

a consultancy serving rail

Your rail clients will ask you about AI, if they haven't already

We work with rail-focused consultancies in two ways: directly, so that your own team uses these tools in its delivery and advises from experience; and jointly, on client engagements where the advice needs a production system behind it. Where client material cannot leave your premises, the system can run entirely on your own hardware.

Example deployment

A simplified view of what the system does with your documents. Tap a row to see how.

LOCAL-ONLY ASSISTANTnothing leaves the building

YOUR OFFICE:

client files
local model
cited answer

Client files stay on your servers; indexed locally, never uploaded.

An open-weight model running on your own hardware.

Every answer quotes the client file and the page it came from.

Clients ask about AI before you have used it
Client material cannot leave the building
Advice that needs a system behind it
A team that does not know what to trust

Swipe for more, tap a step.

How we help

Clients ask about AI before you have used it

Hands-on sessions on your own delivery first, on your own documents, so that you advise from experience rather than from reading.

How we help

Client material cannot leave the building

A local-only assistant on your own hardware: files are indexed on your servers, nothing is uploaded, nothing reaches a third party.

How we help

Advice that needs a system behind it

We work alongside you on the client engagement, building the system while you lead the advisory work — jointly, under whichever arrangement suits the client.

How we help

A team that does not know what to trust

Verification and labelling are built into the tools your consultants use, so every number and quote carries its source.

Systems in production in hardened European cloud; deployable on your own hardware
2,500+ pages of tender documentation processed
Tenders in six or more countries
Client documents are never used to train a model

LiveSystems in production in hardened European cloud; deployable on your own hardware
No trainingClient documents are never used to train a model
2,500+pages of tender documentation processed
6+countries in which tenders were processed

Three ways of working together

Which one fits depends less on the size of the organisation than on where it is with AI today. A short assessment usually settles it.

Enable

Hands-on sessions on your own documents: where your organisation stands with AI, where current models help with your kind of work and where they do not, how to check an output before acting on it, and how to build the first internal tools without a data-science team.

Training formats →

Build

Agentic systems designed and built around your existing processes, inside your team. Verification, access control, hardening and data residency are decided at the start; the deployment — local, hybrid or cloud — follows your constraints.

How we build →

Assess

The AI Readiness Assessment: one to two weeks. Where each department stands, which processes are worth automating or training for, where to run it, and what has to be true before go-live.

What you get →

Why pilots tend to stall, and what production requires

The model is rarely the problem. Pilots stall on questions that were reasonable to postpone during a demo and impossible to postpone afterwards.

Pilot
Where the documents go. Which model, running where, under whose contract, retaining what. Until this is written down, the security review cannot say yes.
Security review
What checks the answer. A confident answer is not evidence. Production needs a traceable source for every claim and a label on every judgement.
Verified
Who looks after it. Prompts drift and edge cases accumulate. Production needs a named owner and a small routine.
In daily use
Whether it fits the working day. If the new way is slower than the old way for a month, the old way wins. We build into the workflow, not beside it.

The pilot-to-production checklist →

The two questions we are asked most about AI in production

How do I know the model isn't making things up?

All language models will be wrong at some point; that is in their nature. So the checking is built into the system rather than left to the reader: every claim is checked back against the original document, adjacent text is re-read in the document's own language, and assessments are labelled as assessments rather than presented as facts.

How the verification layer works →

Extracted claimfact · verbatim

Series retrofit of the onboard signalling equipment shall be completed for all 14 vehicles within 26 months of contract award.

ITT Vol. 2 · §4.3.1 · p. 87 · R-043

Adjacent text, re-read in the original

„Das erste nachgerüstete Fahrzeug ist spätestens im 14. Monat nach Auftragsvergabe wieder in Betrieb zu nehmen; die Serien-Nachrüstung erfolgt in Losen von jeweils zwei Fahrzeugen.“

Assessmentassessment · not verbatim

Two vehicles out of service at any time between month 14 and month 26. Read the availability clause in Annex C §2 against this.

One requirement from a tender, as the verification layer returns it: the claim quoted, its source cited, the surrounding text re-read in German, and the assessment kept apart from the fact.

Is our data kept confidential?

It depends on what you are protecting. There are four ways to deploy, from nothing leaving your building to a frontier model outside Europe, and hybrids of them; we help you choose against the sensitivity of the material, and build to it.

Where your data goes →

Most sensitiveHow sensitive is the material?Least sensitive

Most organisations end up with a hybrid — sensitive material on the first two, everything else on the last two — and the same verification layer across all of them.

Client material cannot leave the building
On your own hardware
For organisations whose material may not leave the building, or that have a no-cloud policy.
Where the model runs
On servers you own, inside your network
What leaves your network
Nothing
Used to train a third-party model?
No; nothing reaches a third party
- Nothing leaves your network
- Full control of access, logging and retention
- Works without any internet connection
- You provide and run the hardware
- Smaller, local models only
Customers audit your cybersecurity
Hardened European cloud
For suppliers and operators whose customers or auditors check their security, and who need stronger models than local hardware allows.
Where the model runs
In a dedicated EU tenant, hardened and operated with you
What leaves your network
Encrypted documents, to your EU tenant only
Used to train a third-party model?
No; a private tenant, under a contract that excludes training
- Inference, storage and compute inside the EU, under your contract
- Stands up to a customer security audit
- Stronger models than local hardware
- Encrypted documents leave your network
- A tenant to harden and keep hardened
Lower-sensitivity drafting and research
European model provider
For teams working with lower-sensitivity material who want the strongest models with the least setup.
Where the model runs
At a European provider, under a no-training contract
What leaves your network
Prompts and the documents you choose to send
Used to train a third-party model?
No, excluded by contract
- Fastest to start; the strongest models
- No training on your data, by contract
- No infrastructure to run
- Prompts and documents go to a third party
- Only where sensitivity allows
Non-sensitive material; the strongest model wins
Non-European frontier model
For teams that need the strongest available models on non-sensitive material and can accept data leaving the EU.
Where the model runs
At a US or other non-EU provider, usually under a business agreement
What leaves your network
Prompts and documents, outside the EU
Used to train a third-party model?
Not on business tiers; depends on the contract and its jurisdiction
- The strongest models available
- The widest tooling and integrations
- Data leaves the EU, into another legal jurisdiction
- Confidentiality rests on the provider's terms

Why industry experience matters more than the model

General-purpose AI tools are easy to buy and hard to put to use. What makes a system usable is knowing the process it sits in — what a compliance matrix is for, why an availability clause defined twice is a warning sign, which document the engineer opens first. These systems were built with that knowledge.

FindTenderSourceFinding tenders
QualifyTender OSReading and qualifying them
DraftAgentic Bid BuilderDrafting responses
RememberTender WikipediaKeeping institutional knowledge answerable
ComplyCRA agentsProducing conformity documentation

FindTenderSourceFinding tenders
QualifyTender OSReading and qualifying them
DraftAgentic Bid BuilderDrafting responses
RememberTender WikipediaKeeping institutional knowledge answerable
ComplyCRA agentsProducing conformity documentation

Hover or tap a system to see an example.Tap a system to see an example.

TenderSourceFeed · new this week

3 matches

Onboard signalling retrofit, 14 light-rail vehiclesVerkehrsbetriebe Talmark · deadline 14 Nov 2026 · est. € 18.5 Mmatches your profile
Depot maintenance framework, four yearsStadtbahn Weidental · deadline 28 Oct 2026 · est. € 6.2 Mmatches your profile
Passenger information displays, 62 stopsRegionalbahn Lindmark · deadline 5 Dec 2026 · est. € 3.9 Mmatches your profile

Tender OSLight-rail onboard signalling retrofit — 14 vehicles

qualified

ID	Requirement · source	Status
R-041	Retrofit of onboard signalling on all 14 light-rail vehiclesITT Vol. 2 · §4.1	compliant
R-042	First retrofitted vehicle back in service within 14 months of awardITT Vol. 2 · §4.3	partial
R-043	Series retrofit completed for all vehicles within 26 months of awardITT Vol. 2 · §4.3.1 · p. 87	compliant
R-044	Fleet availability of at least 98.5 % during the retrofit periodAnnex C · §2 — also defined in ITT Vol. 2 · §6.2, differently	open

ID	Requirement · source	Status
R-042	First retrofitted vehicle back in service within 14 monthsITT Vol. 2 · §4.3	partial
R-043	Series retrofit completed within 26 months of awardITT Vol. 2 · §4.3.1 · p. 87	compliant
R-044	Fleet availability ≥ 98.5 % during the retrofitAnnex C · §2 — also in ITT Vol. 2 · §6.2, differently	open

Agentic Bid BuilderCriterion B.2 · Retrofit programme and fleet availability

draft · for review

Draft answer

The retrofit is delivered in lots of two vehicles, so that no more than two are out of service at any time [Method statement · §2.1]. The first vehicle returns to service in month 15 and the series is completed within 26 months of award [ITT Vol. 2 · §4.3]; availability against the timetabled requirement is held at 98.6 % throughout the programme.

2 sourcesBid manager to confirm month 15 against R-042 before release.

Tender WikipediaQuestion · bid team

answered · cited

QuestionWhat did we quote for depot tooling last time?

Answer

€ 412,000 in the Talmark light-rail bid and € 386,500 in the Weidental depot framework. Both included the wheel-lathe adapter set; neither included operator training.

Price schedule v3 · 12 Mar 2025
Commercial annex B · 30 Sep 2024

CRA agentsConformity evidence · OBU-400 onboard unit

3 of 5 evidenced

Secure-by-default configurationProduct security guide · §3.2	evidenced
Vulnerability handling processPSIRT policy v2.1 · §4	evidenced
SBOM availabilityBuild manifest, release 4.3 — export pending	open

The Agentic Bid Stack — five systems in production covering the rail bid lifecycle, from finding tenders to conformity documentation.

A bid managed with these tools, inside a client's team — a complete overview within a day of publication; a spare-parts calculator from five hundred pages in under an hour; penalty exposure across three regimes as something the managing director could adjust.

Local, hybrid or cloud — the same verification layer runs on your own hardware, in a hardened European cloud, with a European or non-European model provider, or in a hybrid of them, so the architecture follows the sensitivity of the material rather than the other way round.

The systems and the cases →

What stays with people

Much of what makes an organisation work is not written down anywhere: how decisions are really taken, which customer needs a call rather than an email, what the last incident taught the depot. A model has no access to that, and it does not know your pricing strategy or your safety case either.

Modern AI is also uneven — very strong at some tasks and unreliable at others that look similar. Part of using it well is building the reflex to test, to keep humans with domain expertise in the loop, and to decide, on evidence rather than instinct, where not to use it at all.

Organisations that treat AI as something that augments their people's intelligence and judgement get more out of it than those that try to replace either. Knowing where the limits are — and that some of them will not move — is where that starts.

Nova Mobility Consulting is led by Raphael Santos Cavalcanti from Mainz, Germany: fifteen years in rail and public transport across Europe, Asia and North America — project and bid management, strategy, engineering and product, business development — and, more recently, building the systems on this page.

About Nova Mobility →