In force
Ecodesign Regulation: Digital Product Passport framework in force
Product requirements follow, one delegated act at a time.
Manufacturing & Industry
From the shop floor to the export file.
What we would build for auto component makers, engineering goods and electronics manufacturers, specialty chemical producers and steel and aluminium exporters: MES-ERP integration that leaves the control layer alone, plant data for quality and maintenance, GST e-invoicing straight from the ERP, and the product data EU rules now ask of Indian suppliers.
For Indian manufacturers and exporters, from MSME plants to business groups with factories in India and subsidiaries in Europe.
1 April 2025
30-day limit on the IRP
Larger taxpayers can no longer report invoices older than 30 days to the Invoice Registration Portal.
1 January 2026
CBAM definitive period for EU imports
EU importers of covered goods such as steel and aluminium move to the definitive regime and need embedded-emissions data from their suppliers.
11 December 2027
EU Cyber Resilience Act applies in full
Connected products sold in the EU must be secure by design, with vulnerability handling, before they can bear the CE mark.
What is changing for Indian manufacturers
EU buyers now ask for product data
Indian exporters of electronics, machinery and connected products meet the EU Cyber Resilience Act, the Data Act and the Ecodesign Regulation through their buyers: security updates, data access and digital product passports become part of the delivery.
Plant data has to leave the plant safely
Quality, maintenance and planning teams want plant data in the cloud, yet control systems must remain safe and available. CERT-In expects listed cyber incidents to be reported within six hours, and IEC 62443 gives engineers a common vocabulary for zones and conduits.
Shop-floor expertise is retiring
Senior technicians and process engineers hold knowledge that no manual records. Capturing it in a searchable form, usable by the next shift and the next plant, has become an operational priority.
Emissions data reaches the plant
Since 1 January 2026, EU importers of covered goods such as steel and aluminium need embedded-emissions data in the definitive CBAM period. For an Indian exporter that means energy, emissions and material data captured per site and per product, once, and reused for every customer request.
SourceRegulation (EU) 2023/956
Problems we are asked to solve
- The problem
Each link between MES and ERP is a project of its own.
What we would doMachines, MES and ERP publish to and read from a unified namespace (MQTT, OPC UA) structured on the ISA-95 model, instead of being wired together pair by pair.
- The problem
Quality and maintenance data live in separate silos.
What we would doAn operational data platform joins process, quality and maintenance data with their context, so engineers can trust the analysis. A prediction is shown with its measured accuracy, or not shown.
- The problem
Technicians lose time hunting through manuals and service history.
What we would doA knowledge assistant for service staff over manuals, work instructions and previous repairs, naming the document and revision behind every answer.
- The problem
Connected products for EU buyers must meet the Cyber Resilience Act and the Data Act.
What we would doSecure update pipelines, a software bill of materials, vulnerability intake and documented interfaces for data access, built into the product platform rather than added for a single customer.
- The problem
Product compliance data is spread across suppliers.
What we would doSupplier data gathered over EDI and APIs into a single product data model, ready to feed digital product passports, battery passports and CBAM requests from EU importers.
- The problem
Orders, invoices and certificates are typed in by hand.
What we would doDocument intelligence reads purchase orders, GST invoices with their IRN and certificates of conformity; staff confirm the exceptions before anything is posted to the ERP.
Plant-to-ERP reference design
The ISA-95 levels are left as they are. Plant data reaches the services above the zone boundary through a unified namespace, and analytics, knowledge and export compliance services use it there.
Illustrative example
Data leaves the control zone at a single point, the namespace, and each service above draws on that one feed.
Read the diagram as text
The diagram stacks five ISA-95 levels. At the top, level 4 covers planning, logistics and finance in the ERP, SAP S/4HANA or Odoo. Level 3 holds plant operations with MES, quality and maintenance; level 2 supervision through SCADA and HMI; level 1 control through PLCs and drives; and level 0 the process itself, its sensors, machines and lines.
An IEC 62443 zone boundary lies between level 4 and the four levels beneath it.
Levels 1 to 4 publish into a unified namespace over MQTT and OPC UA. From there a plant data platform takes the data and serves quality and maintenance analytics, a knowledge assistant for service and engineering staff, and export compliance data such as the Digital Product Passport and CBAM emissions figures.
Read widely, write rarely
Analytics and assistants only consume the namespace. Anything that changes production goes through the MES, with an operator approving it.
Segmented networks
Networks are segmented on IEC 62443, with conduits defined between the control network and the enterprise network.
Measured predictions
Each model reports its measured error and uncertainty; where the data cannot support a prediction, we tell you.
One product record
The same product and material data feeds the ERP, the GST e-invoice, product passports and CBAM answers, instead of separate spreadsheets.
EU dates Indian exporters plan against
Product, data and reporting rules for the EU market follow one another closely, and further Ecodesign delegated acts will set dates for each product group.
In force
NIS2: Member State NIS2 laws take effect
In the EU, makers of machinery, electronics and vehicles fall within its scope.
In force
Data Act: Data Act takes effect
Users gain rights to the data their connected products generate.
In force
CBAM: Definitive period begins
In force
CSRD: Omnibus narrows reporting scope
Large companies from the former second wave report from financial year 2027.
In force
Cyber Resilience Act: Vulnerability and incident reporting begins
Severe incidents and vulnerabilities under active exploitation must be notified.
In force
Data Act: Data access by design for newly marketed products
Position on 2 October 2026
Ahead
Machinery Regulation: Machinery Regulation takes effect
Covers safety functions that depend on software and connectivity.
Ahead
Batteries Regulation: Battery passport becomes mandatory
Applies to industrial, EV and light transport batteries in scope.
Ahead
Cyber Resilience Act: Main obligations take effect
EU product rules for Indian exporters
None of these instruments is Indian law. They reach an Indian manufacturer through the EU market and through EU buyers; each entry states how, and what engineering it calls for.
Planning orientation only, not legal advice; duties per product depend on delegated acts and harmonised standards still to come. Indian rules as they stood on 6 November 2026; EU dates checked on 2 October 2026.
- Cyber Resilience ActScopeEU instrument
Any connected product or software sold in the EU, including one made in India, needs secure design, security updates through its support period and a process for handling vulnerabilities. Reporting obligations start on 11 September 2026; the rest applies from 11 December 2027.
How it affects youSecure coding practice, a software bill of materials and an update pipeline ship with the product. We engineer them into your platform and your release routine.
SourceRegulation (EU) 2024/2847, EUR-Lex (opens external site)
- Data ActScopeEU instrument
Gives EU users of connected products and related services a right to the data their use produces, and to share it. From 12 September 2026, products newly placed on the EU market must expose that data by design.
How it affects youAn exporter’s product platform needs documented interfaces for data access and contract clauses for sharing it, and we design both together.
SourceRegulation (EU) 2023/2854, EUR-Lex (opens external site)
- Ecodesign Regulation and Digital Product PassportScopeEU instrument
Sets the EU framework for product sustainability requirements and the Digital Product Passport. Concrete duties arrive product group by product group, in delegated acts.
How it affects youWhen your product data model already carries material, origin and repair information, each new delegated act is a mapping task, not another system.
SourceRegulation (EU) 2024/1781, EUR-Lex (opens external site)
- Machinery RegulationScopeEU instrument
Replaces the EU Machinery Directive from 20 January 2027, covering safety functions that rely on software, connected machinery and protection of safety-relevant software against corruption. Indian machine builders exporting to the EU fall under it.
How it affects youSoftware that touches a safety function needs traceable requirements and change control, kept clearly apart from analytics and assistance.
SourceRegulation (EU) 2023/1230, EUR-Lex (opens external site)
- NIS2 for manufacturingScopeEU instrument
In the EU the sectors in scope include makers of medical devices, of computers, electronic and electrical equipment, and of machinery and vehicles. An Indian supplier meets it through the supply-chain clauses of its European customers.
How it affects youAt home, CERT-In’s six-hour reporting applies to listed incidents. We design plant-to-cloud integration with segmentation and incident processes in place from the first release.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- CBAM and sustainability reportingScopeEU instrument
Since 1 January 2026 the Carbon Border Adjustment Mechanism has been in its definitive period for EU imports of covered goods, steel and aluminium among them. The 2026 Omnibus confined CSRD sustainability reporting to the largest companies and pushed back first reporting years.
How it affects youCapture energy, emissions and material figures once, where they arise, with lineage an auditor can trace, and answer every importer’s request from that same record.
SourceRegulation (EU) 2023/956, EUR-Lex (opens external site)
Illustrative use cases
Illustrative exampleRepair knowledge at the machine
Technicians receive the right manual section, work instruction and earlier fixes for the fault in front of them, each with its source.
Mill test certificate intake
Supplier certificates and material declarations read, matched to the purchase order and stored with the heat or batch number.
Order and GST invoice processing
Customer orders and GST invoices extracted and validated, IRN included, before posting; staff confirm each exception.
Ageing MES replaced behind APIs
An older MES placed behind documented APIs and replaced one function at a time while the lines keep running.
Dealer and spare-parts assistant
Dealers of a two-wheeler component maker identify parts and check stock; technical questions pass to service staff.
Platforms in manufacturing
SAP
Gold PartnerSAP S/4HANA for production and supply chain across a group’s Indian and European companies, linked to MES and plant data through the namespace and to the IRP for GST e-invoices.
Odoo
Gold PartnerOdoo for MSME plants and smaller subsidiaries, often beside SAP at group level, with GST e-invoicing at home and invoices to EU customers.
Salesforce
Summit PartnerDealer networks, sales agreements and field service, linked to the installed base and its service history.
Partner tiers shown are FromNine’s own. Product names belong to their respective owners.
India
Plants in India, buyers in Europe, one data model
Once they cross the turnover threshold, Indian businesses report B2B and export invoices under GST to the Invoice Registration Portal (IRP) and receive an Invoice Reference Number (IRN) for each. Listed cyber incidents go to CERT-In within six hours.
Exports to the EU add product rules from the European side: CBAM emissions data for steel and aluminium, the Cyber Resilience Act and Data Act for connected products, and digital product passports under the Ecodesign Regulation. We design one information model that serves the GST invoice and the EU product file alike.
- GST e-invoicingGST e-invoicing: B2B and export invoices registered on the Invoice Registration Portal (IRP) to obtain an IRN (opens external site)
- CERT-In Directions 2022CERT-In Directions of 28 April 2022 under s. 70B(6) of the IT Act: reporting of listed cyber incidents within 6 hours, log retention, time synchronisation (opens external site)
- CBAMCarbon Border Adjustment Mechanism, Regulation (EU) 2023/956 (opens external site)
- Cyber Resilience ActCyber Resilience Act, Regulation (EU) 2024/2847 (opens external site)
- Data ActData Act, Regulation (EU) 2023/2854 (opens external site)
- Ecodesign Regulation (ESPR)Ecodesign for Sustainable Products Regulation (EU) 2024/1781 and the Digital Product Passport (opens external site)
Frequently asked questions
Does your software write to PLCs or SCADA?
Not by default. Analytics and assistants take plant data from the namespace and change nothing. Changes to production go through the MES or your control engineers, with an operator’s approval and under change control.
Can you predict machine breakdowns?
Only where the data allows. It depends on how machines fail, which sensors exist and how much history there is. We run a test first, publish the measured error, and propose simple condition-based rules where a model would be unreliable.
Which protocols and standards do you use?
For plant data, OPC UA and MQTT; as the information model, ISA-95; for segmentation, IEC 62443; with suppliers and customers, EDI or APIs; and for GST e-invoices, integration with the IRP.
We export connected products to the EU. How do you help with the Cyber Resilience Act?
We engineer the product platform for it: secure development, software bills of materials, vulnerability intake and update pipelines. Conformity assessment and the legal reading stay with you and, where one is needed, your notified body.
Can SAP for the group and Odoo at an MSME plant work together?
Yes, two-tier ERP is common. We settle which master data and transactions belong in each system and connect the two so that group reporting and GST compliance stay consistent.
Discuss your plant or export programme
Connecting plant data, readying connected products for EU buyers or answering CBAM data requests? Begin with a single line, product or site.