In application
Ecodesign Regulation: Framework for the Digital Product Passport in force
Requirements per product follow in delegated acts.
Manufacturing & Industry
Plant-floor data that reaches the people who decide.
We work with pharma, medtech and electronics manufacturers and other industrial sites. We connect IT and OT without touching the control layer, turn operational data into quality and maintenance insight, put service know-how in front of the technician and prepare the product data that new EU rules ask for.
For manufacturers with sites in Ireland, from multinationals’ Irish operations to indigenous Irish companies scaling up, that need one view across plants and systems.
1 January 2026
CBAM moves to its definitive phase
Importers of goods in scope leave transitional reporting behind and enter the definitive regime.
12 September 2026
Connected products must open up their data
Data generated by new connected products has to be available to their users by design.
11 December 2027
Cyber Resilience Act in full application
To carry the CE mark, products with digital elements need secure design and a process for handling vulnerabilities.
What is shifting for manufacturers in Ireland
Data duties are now built into products
Product design is shaped by the Data Act, the Cyber Resilience Act, the Ecodesign Regulation and the battery passport. Access to data, security updates and product passports are now part of the product you deliver.
IT and OT are growing together
The business wants plant data in the cloud, while control systems have to remain safe and running. NIS2 covers several manufacturing sectors, medical devices and electronics among them, and IEC 62443 gives the terms for zones and conduits. In Ireland the National Cyber Security Bill is still at General Scheme stage, so S.I. No. 360 of 2018 applies for now.
SourceDirective (EU) 2022/2555
Know-how is retiring with the people
Seasoned technicians and process engineers know things that are in no manual. Getting that knowledge into a form people can search has become an operational priority.
Reporting and invoicing reach the site
CBAM and sustainability reporting ask for energy, emissions and material data per site and per product, captured once and reused. On Revenue’s published timeline, large corporates also issue EN 16931 e-invoices from 1 November 2028 (planned), which puts the ERP in scope.
SourceRegulation (EU) 2023/956
Where plants get stuck, and what we build
- The challenge
Each link between MES and ERP is built as a separate project.
What we doA unified namespace over MQTT and OPC UA, with an information model based on ISA-95, lets machines, MES and ERP publish and subscribe rather than being connected pair by pair.
- The challenge
Quality data and maintenance data live apart.
What we doOne operational data platform combines process, quality and maintenance data with its context, so engineers can trust the analysis. A prediction is shown with its measured accuracy, or not shown.
- The challenge
Technicians spend too long hunting through manuals and service records.
What we doA knowledge assistant across manuals, work instructions and earlier interventions that names the document and revision behind every answer.
- The challenge
Connected products have to satisfy the Cyber Resilience Act and the Data Act.
What we doWe build secure update pipelines, software bills of materials, vulnerability handling and documented APIs for data access into the product platform itself.
- The challenge
Compliance data for each product is spread over many suppliers.
What we doSupplier data comes in over EDI and APIs and lands in a single product data model, which can then feed Digital Product Passports, battery passports and CBAM reports.
- The challenge
Orders, delivery dockets and certificates are still typed in by hand.
What we doDocument intelligence reads and checks trade documents and certificates of conformity; staff confirm the exceptions before anything is posted to the ERP.
Reference landscape for IT and OT
The ISA-95 levels are left as they are. A unified namespace publishes plant data above the zone boundary, where analytics, knowledge and compliance services pick it up.
Illustrative example
Plant data passes the zone boundary a single time, via the namespace, and every service above it reuses it.
Read the diagram as text
Five ISA-95 levels are stacked from top to bottom. Level 4 is business planning and logistics in the ERP, SAP S/4HANA or Odoo. Level 3 is manufacturing operations: MES, quality and maintenance. Level 2 is supervisory control through SCADA and HMI. Level 1 is control by PLCs and drives. Level 0 is the process itself: sensors, machines and lines.
Between level 4 and the levels underneath runs a zone boundary designed to IEC 62443.
Levels 1 to 4 send their data to a unified namespace over MQTT and OPC UA. From there it flows into an operational data platform that serves quality and maintenance analytics, a knowledge assistant for service and engineering staff, and product compliance data such as the Digital Product Passport.
Mostly reading, rarely writing
Analytics and assistants only read from the namespace. Anything that would change production passes through the MES and needs an operator’s approval.
Zones and conduits
Networks are segmented along IEC 62443, with defined conduits between the control and enterprise sides.
Accuracy you can see
Each model reports how accurate and how uncertain it is. If the data cannot support a prediction, we tell you.
A single product data model
ERP, passports and reports all draw on the same product and material data, not on three separate spreadsheets.
Key dates for manufacturers
Rules on products, data and reporting follow one another quickly. Delegated acts under the Ecodesign Regulation will set dates for each product group.
In application
NIS2: EU deadline for national NIS2 laws
Machinery, electronics, medical devices and vehicles are among the sectors covered. Ireland’s Bill had not been enacted by autumn 2026.
In application
Data Act: Data Act in application
Users get rights to the data their connected products generate.
In application
CBAM: Definitive period begins
In application
CSRD: Omnibus amendment reduces who must report
Large companies that were in the second wave now report from financial year 2027.
In application
Cyber Resilience Act: Reporting of vulnerabilities and incidents begins
Vulnerabilities that are actively exploited, and severe incidents, have to be reported.
In application
Data Act: New connected products open their data by design
Position at 2 October 2026
Upcoming
Machinery Regulation: Machinery Regulation in application
With requirements for safety functions that depend on software and connectivity.
Upcoming
Batteries Regulation: Battery passport becomes mandatory
For industrial batteries, electric-vehicle batteries and batteries for light means of transport in scope.
Upcoming
Cyber Resilience Act: Bulk of the obligations in application
Rules and standards at a glance
The legal texts that shape most product, plant and data programmes, and what each one changes for your engineers.
Use this overview to prepare planning discussions; it is not legal advice, and duties for a given product depend on delegated acts and harmonised standards. Dates checked on 2 October 2026.
- Cyber Resilience ActScopeEU-wide
A product with digital elements sold in the EU has to be secure by design, receive security updates throughout its support period and come with a process for handling vulnerabilities. The reporting duties start on 11 September 2026, the bulk of the obligations on 11 December 2027.
What changes for your programmeSecure development, software bills of materials and update pipelines become features of the product. We build them into your platform and your release process.
SourceRegulation (EU) 2024/2847, EUR-Lex (opens external site)
- Data ActScopeEU-wide
People who use connected products and related services may access and share the data those products produce. For connected products placed on the market from 12 September 2026, that data has to be accessible by design.
What changes for your programmeA product platform needs documented interfaces for data access and contract terms for sharing data. We design both.
SourceRegulation (EU) 2023/2854, EUR-Lex (opens external site)
- Ecodesign Regulation and Digital Product PassportScopeEU-wide
The Ecodesign for Sustainable Products Regulation is the framework for product requirements and for the Digital Product Passport. The actual duties come product group by product group, through delegated acts.
What changes for your programmeIf your product data model already holds materials, origin and repair details, each new delegated act becomes a mapping exercise and not a new system.
SourceRegulation (EU) 2024/1781, EUR-Lex (opens external site)
- Machinery RegulationScopeEU-wide
From 20 January 2027 it takes over from the Machinery Directive. Its requirements extend to safety functions that run on software, to connected machines and to protecting safety-relevant software from corruption. Where AI is part of such a product, Irish law lists the Health and Safety Authority among the sector market surveillance authorities (S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026).
What changes for your programmeSoftware that affects safety functions needs traceable requirements and change control. We keep it clearly apart from analytics and assistance.
SourceRegulation (EU) 2023/1230, EUR-Lex (opens external site)
- NIS2 for manufacturingScopeEU-wide
The sectors in scope include makers of medical devices, computers and electronics, electrical equipment, machinery and vehicles, with duties on risk management, incident reporting and supply-chain security. As of autumn 2026 Ireland has not enacted its NIS2 law; the National Cyber Security Centre has published draft guidance on risk-management measures.
What changes for your programmeOT security, segmentation and incident handling become topics for the board. Our IT/OT integration is designed with them already in place.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- CBAM and sustainability reportingScopeEU-wide
Since 1 January 2026 the Carbon Border Adjustment Mechanism has been in its definitive period for imports of goods in scope. The 2026 Omnibus limited CSRD sustainability reporting to the largest companies and pushed back their first reporting years.
What changes for your programmeCapture emissions, energy and material data once, where it originates, with lineage an auditor can trace.
SourceRegulation (EU) 2023/956, EUR-Lex (opens external site)
Example use cases (illustrative)
Illustrative exampleMaintenance know-how on the line at a medtech plant
A technician asks a question and gets the matching manual section, work instruction and earlier fixes, each with its source.
Taking in supplier certificates at a pharma site
Certificates of conformity and material declarations are read, compared with the purchase order and filed with the batch record.
Processing orders and delivery dockets
Customer orders and delivery dockets are read and checked before posting; staff approve each exception.
An ageing MES replaced behind APIs
The legacy MES of an electronics manufacturer is wrapped in documented APIs and swapped out function by function while the lines keep running.
Help with spare parts
Customers and distributors find the right part and check stock; anything that needs technical judgement goes to the service team.
Platforms we use in manufacturing
SAP
Gold PartnerSAP S/4HANA for production and supply chain across the group, linked to MES and plant data through the namespace, with VAT modernisation e-invoicing in scope for Irish operations.
Odoo
Gold PartnerOdoo manufacturing for mid-sized plants and owner-managed businesses, often as the second tier under SAP at group level.
Salesforce
Summit PartnerSales agreements, distributor networks and field service, tied to the installed base and its service history.
The partner levels shown are FromNine’s own. Product names belong to their owners as trademarks.
Ireland
Irish sites, group systems, EU product rules
Many manufacturing sites in Ireland belong to international groups, with an MES on site and an ERP instance run by a group function abroad; others are indigenous Irish companies growing from a single plant. EU product rules such as the Cyber Resilience Act, the Data Act and the Ecodesign Regulation apply to each of them in the same way, while NIS2 still waits for Ireland’s National Cyber Security Bill.
Revenue’s VAT modernisation adds a further reason to look at the ERP: on its published timeline, large corporates issue EN 16931 e-invoices for domestic B2B from 1 November 2028 and every business must be able to receive them (planned).
We design one information model and integration pattern that each site can take up at its own pace, with service content its technicians can use on the line.
- Cyber Resilience ActCyber Resilience Act, Regulation (EU) 2024/2847 (opens external site)
- Data ActData Act, Regulation (EU) 2023/2854 (opens external site)
- Ecodesign Regulation (ESPR)Ecodesign for Sustainable Products Regulation (EU) 2024/1781 and the Digital Product Passport (opens external site)
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- National Cyber Security BillNational Cyber Security Bill 2024 (General Scheme published August 2024) to transpose NIS2; not enacted (opens external site)
- Irish VAT modernisation (B2B e-invoicing)VAT modernisation: domestic B2B e-invoicing (EN 16931) and reporting to Revenue, planned in phases on Revenue’s timeline; the legal basis, Finance Bill (No. 2) 2026, is not yet enacted (opens external site)
Questions we are often asked
Will your systems write to our control layer?
Not as a rule. Analytics and assistants read plant data via the namespace. A change to production goes through the MES or your control engineers, with an operator’s approval and under change control, which a GxP site needs anyway.
Can you forecast when a machine will fail?
In some cases. It comes down to the failure modes, the sensors fitted and how much history exists. We test first, show the measured accuracy and uncertainty, and suggest condition-based rules wherever a model would not hold up.
What protocols and standards do you use?
For plant data, OPC UA and MQTT; for the information model, ISA-95; for zones and conduits, IEC 62443; and EDI or APIs to connect suppliers and customers.
What do you do for Cyber Resilience Act compliance?
We build the product platform to support it: secure development, software bills of materials, a way to take in vulnerability reports, and update pipelines. The conformity assessment and the legal reading of the Act remain with you and, where one is required, your notified body.
Can SAP for the group and Odoo at a plant run side by side?
Yes, two-tier ERP is a familiar pattern, for example when a multinational’s Irish operation and its group run different systems. We agree which master data and transactions belong where and connect the two so group reporting, and the e-invoicing planned under VAT modernisation, stay consistent.
Talk through your plant or product programme
Linking plant data, getting connected products ready for the CRA or giving technicians better access to know-how? Begin with one line, one product or one site.