Buildings are no longer collections of independent systems. Lighting, HVAC, security, access control, fire alarm and audiovisual systems were the first ones pulled onto building networks. Today, sensors monitor structural performance in real time, connected plumbing tracks flow rates and detects leaks, and IoT platforms extend into facility operations at the fixture level. Irrigation, shading, elevators and life safety systems—once inspected and signed off in isolation—are being tied into building networks as a matter of course.

As connectivity reaches across more MasterFormat divisions, new trades are entering the limited-energy space without National Electrical Code familiarity, defined licensing boundaries or a clear understanding of where their scope ends and another trade’s begins. The regulatory structures that once governed each of those spaces separately have not caught up with the convergence.

This is where the electrical contractor’s role becomes critical—and where the MasterFormat Division 25 (Integrated Automation) and a structured risk management framework (RMF) need to enter the conversation. Not at closeout. Not during commissioning. At project inception.

Hidden risks: What’s actually in the field

Three converging problems define the current condition on connected building projects. The first is noncompliant and counterfeit equipment. Cabling that fails listed ratings for fire propagation or electrical performance does not announce itself at commissioning; it surfaces during a fire event or insurance investigation years after the project team has disbanded. Noncompliant network switches, unlisted IoT devices and counterfeit life safety equipment enter the supply chain through gray-market importers and online marketplaces. U.S. Customs and Border Patrol (CBP) data places counterfeit consumer electronics, including electrical items, at approximately 13% of all intellectual property rights seizures by volume—an estimated $300 million to $400 million annually. UL has issued formal notifications for counterfeit marks on fire doors, i.e., life safety assemblies whose failure is not a compliance abstraction but a potential mass-­casualty event.

The equipment problem extends beyond counterfeits and into quality and listings. NEC Section 700.27 (2023 edition, carried into 2026) requires that any device combining control signals with Class 2 emergency power on a single circuit be listed as an emergency lighting control device—naming PoE switches explicitly. NEC 700.12 requires emergency lighting to activate within 10 seconds of normal power failure. 

The next problem is unverified and unqualified installations. Trades entering the limited-­energy space frequently lack an NEC compliance background, structured cabling standards familiarity and any cybersecurity training for the connected devices they’re installing.

The last is fragmented accountability. When multiple trades touch the same connected system, no single party owns performance or safety outcomes. But the problem runs deeper than ownership: multiple trades working across Divisions 21–28 frequently produce multiple overlapping networks—redundant systems, parallel infrastructure and ungoverned devices that compound the attack surface and liability exposure with every addition. 

The RMF exists partly to prevent this. One of its core functions is to reduce IT/OT infrastructure complexity by eliminating unnecessary systems, components and services before they are specified, purchased and installed. Division 25 then provides the coordination framework that governs what remains. Both tools have to be invoked—and invoked early—or the default is a building with more connected systems than anyone designed, more exposure than anticipated and no clear record of who is responsible for it.

When infrastructure failure becomes a safety event

Consider a maternal/fetal monitor in a hospital’s labor and delivery unit. The medical professional using the device carries licensure and liability. The monitor itself is regularly calibrated and carries federal clearance and audit trails. But the data cable carrying the output often has no certification requirement and no mandatory inspection regime. Every byte of real-time clinical data it generates travels through network infrastructure that exists almost entirely outside the regulatory framework governing everything else in that ecosystem. 

Peer-reviewed literature documents healthcare IT failures as contributors to delayed care delivery and degraded system access at critical moments. Network infrastructure failure is a patient safety problem and the logical endpoint of connected systems installed without accountability for the infrastructure beneath them.

The 2026 NEC: What to know now

The 2026 NEC represents a structural inflection point for limited-­energy work. For more than 80 years, Chapter 8, covering communications systems, was not subject to chapters 1–7. The 2026 revision to Section 90.3 eliminated that independence: chapters 5–8 may now supplement or modify requirements across the full code structure. General installation requirements that had never applied to communications equipment now do.

Chapter 8 has been renamed “Communications Systems—Outside and Entering Buildings,” with most content absorbed into Chapter 7. New articles address fault-managed power (Article 726), overvoltage protection (Article 742), and grounding and bonding of limited-energy systems (Article 750). For inspectors, this is a meaningful shift. Telecommunications infrastructure that historically received minimal AHJ oversight is now subject to the integrated NEC framework.

These changes are also preparatory. Informative Annex L previews a 2029 expansion from nine chapters to as many as 30—the first fundamental NEC restructuring since 1937. Code proposals are being developed now. Public inputs can be submitted at nfpa.org/standards.

Cybersecurity and OT convergence

OT devices—building controls, sensors, meters and life safety systems—were designed for reliability in isolation. Networked, they become attack surfaces. The 2021 cyberattack on a Florida water treatment facility, where an attacker gained remote access through an unsecured OT connection and attempted to alter chemical dosing, illustrated what unprotected building infrastructure can enable.

Most trades installing connected devices have no training in network segmentation, access control or secure device onboarding. Default credentials go unchanged. Devices are placed on flat networks with no logical isolation. Hardware-level vulnerabilities introduced through unverified supply chains cannot be patched and are persistent liabilities embedded in the building. The construction contract rarely addresses any of this. That is a scope gap electrical contractors and systems integrators are positioned to close—and to be compensated for closing.

Under Presidential Policy Directive 21, the communications sector is designated as enabling critical infrastructure—underpinning energy, transportation, emergency services, financial services and healthcare. In practice, it is treated as commodity scope, value-­engineered freely and largely uninspected. That contradiction needs to be reconciled.

Control the process

The risks discussed in this article are manageable—but they require the right conversations at the right time. The foundation of systems integration is coordination. For ECs, systems integrators and project managers, that means driving two frameworks from the first preconstruction meeting: MasterFormat Division 25 and an RMF.

MasterFormat Division 25, Integrated Automation, is the specification structure built to consolidate accountability for connected systems across trades. It defines scope boundaries, establishes what contractor owns each connected system and sets the commissioning documentation standards that make performance verifiable. When Division 25 is brought into the game early, it prevents the fragmented accountability that allows risk to invisibly accumulate. When it is absent or invoked late, cross-trade systems operate without a single accountable party, and no one is positioned to catch the gaps.

An RMF applied at project onset gives the entire project team—contractor, systems integrator, PM, GC and owner—a structured basis for identifying which connected systems carry life safety, cybersecurity or critical infrastructure implications and for establishing the specification requirements, submittal standards and accountability boundaries that govern those systems before a single trade contract is written. In federal and defense construction, RMF is a mandated process governing information system authorization. In commercial building work, it has no equivalent mandate—but the logic applies directly.

The RMF questions that need answers at project inception are straightforward: What systems are being connected? What are the consequences of their failure? Who is responsible for each layer of performance? What documentation verifies compliance? These questions do not get easier to answer after the conduit is in the slab.

For inspectors, Division 25 scope and RMF deliverables should be visible in the contract documents before a permit is issued. Every connected device is a potential attack surface; there is no threshold below which governance is optional. If they are absent, the project lacks the governance structure to demonstrate compliance with the 2026 NEC’s integrated requirements, and the inspector’s field observations become the last line of defense on a project never properly set up.

What to require at each phase

The earlier these conversations start, the more they shape outcomes rather than document problems. Ideally, engagement begins at the conceptual planning phase—before design scope is set, before systems are selected and before any trade has committed to an approach the RMF might otherwise eliminate.

• Conceptual planning: RMF initiated, IT/OT infrastructure complexity assessed, unnecessary systems and components identified for elimination before they enter the design. Division 25 coordination scope established as a design requirement, not an afterthought.
• Preconstruction: Division 25 scope defined, RMF initiated and cross-trade accountability boundaries established in the contract documents before bid.
• Design and procurement: Product compliance specified by standard, not brand. Listing documentation, third-party testing certification and chain-of-custody records required as submittals. PoE switch listings verified against NEC 700.27 for any emergency power application.
• Installation: Cybersecurity requirements enforced in the field—network segmentation, prohibition on default credentials at commissioning, firmware version documentation and secure device onboarding. These are specifiable, inspectable requirements under current code.
• Commissioning closeout: Device inventory, as-built network diagrams, baseline performance data and credential management records delivered as contract.

The path forward

The 2029 NEC revision cycle is an opportunity. Clearer limited-energy installation requirements, defined accountability for cross-trade connected systems and alignment with NIST SP 800-82 (Guide to OT Security) are achievable outcomes. ECs, systems integrators and inspectors have standing to submit public inputs at nfpa.org/standards, and the firsthand field knowledge to make those inputs count.

Manufacturers must ensure that compliance documentation—listings, certifications and firmware records—travels with the product through the installation chain. Owners must resist treating connected building infrastructure as commodity scope subject to unrestricted substitution.

The frontier is expanding. New systems will connect, new trades will enter the space and vulnerabilities will emerge. The industry’s response begins at the first preconstruction meeting, with Division 25 on the agenda and an RMF in hand.

stock.adobe.com/Aoife | Stock.adobe.com/Kwangmoozaa