In application
Ecodesign Regulation: Passport framework in force
Requirements for products follow delegated act by delegated act.
Manufacturing & Industry
Plant signals that reach the people who decide.
For pharmaceutical and other export manufacturers with plants in Malta, our work covers four things: IT/OT links that leave the control layer alone, line data turned into quality and maintenance insight, service know-how in the technician’s hands, and the product data new EU rules call for.
For manufacturers with a plant in Malta that sells into the wider EU and reports to a European group, with several languages spoken on the floor.
1 January 2026
CBAM moves to its definitive phase
Importers of goods within scope leave transitional reporting behind and enter the definitive regime.
12 September 2026
Connected products open their data
Connected products placed on the market from this date have to let users reach the data they produce.
11 December 2027
Full application of the CRA
No CE mark for products with digital elements unless they are designed securely and their vulnerabilities are handled.
What is shifting for manufacturers in Malta
Data duties travel with the product
Four EU texts now shape product design: the Data Act, the Cyber Resilience Act, the Ecodesign Regulation and the Batteries Regulation. A Maltese plant shipping to customers elsewhere in the EU therefore delivers data access, security patches and passports along with the goods.
Office systems and the line grow closer
The business wants plant data in the cloud, while control systems have to remain safe and running. Malta’s NIS2 Order brings several manufacturing sectors under the CIP Department, and IEC 62443 provides the language of zones and conduits.
SourceDirective (EU) 2022/2555
Know-how retires with people
Long-serving technicians and process engineers know things that no manual records. Turning that knowledge into something searchable, in the languages your staff use, has become an operational concern.
Reporting lands on the plant floor
CBAM and sustainability reports ask for energy, emissions and material figures per site and per product, which should be captured a single time and reused in every report.
SourceRegulation (EU) 2023/956
Where plants get stuck, and what we build
- The challenge
Linking the MES to the ERP means a fresh point-to-point project every time.
Our responseWe set up a unified namespace over MQTT and OPC UA, modelled on ISA-95, so machines, MES and ERP publish and subscribe rather than being cabled to each other pair by pair.
- The challenge
Quality data and maintenance data live apart.
Our responseOne operational data platform brings process, quality and maintenance records together with their context, so engineers believe the analysis. A prediction is shown only together with its measured accuracy.
- The challenge
Technicians spend too long hunting through manuals and service records.
Our responseA service assistant that searches manuals, work instructions and earlier interventions in the language the technician uses and names the document and revision behind each answer.
- The challenge
Connected products have to satisfy both the CRA and the Data Act.
Our responseUpdate pipelines that are secure, software bills of materials, a vulnerability process and documented data-access APIs, all designed into the product platform itself.
- The challenge
Suppliers each hold a piece of the compliance data for a product.
Our responseEDI and API links bring supplier data into a single product data model, which can then supply Digital Product Passports, battery passports and CBAM declarations.
- The challenge
Staff retype orders, delivery notes and certificates.
Our responseDocument intelligence reads and checks trade documents and certificates of conformity, and staff confirm any exception before it is posted in the ERP.
A reference landscape for IT and OT
The ISA-95 levels remain untouched. Above the zone boundary, a unified namespace publishes plant data for analytics, knowledge and compliance services to consume.
Illustrative example
Data from the plant crosses the zone boundary a single time, via the namespace, and every service above it reuses that data.
Read the diagram as text
Picture the ISA-95 stack as five levels. At the top, level 4 is the ERP (SAP S/4HANA or Odoo) for planning and logistics. Beneath it, level 3 holds the MES with quality and maintenance; level 2 is SCADA and HMI supervision; level 1 is PLCs and drives; and at the bottom, level 0 is the physical line with its machines and sensors.
An IEC 62443 zone boundary sits between level 4 and the levels under it.
Every level from 1 up to 4 publishes into one namespace using MQTT or OPC UA. An operational data platform subscribes to it, and three services draw on that platform: analytics for quality and upkeep, an assistant holding service and engineering know-how, and the compliance records behind each Digital Product Passport.
Mostly reading, seldom writing
Analytics and assistants take their data from the namespace. Anything that alters production passes through the MES and needs an operator’s approval.
Zones and conduits
Network segmentation follows IEC 62443, with defined conduits between the control network and the office network.
Accuracy shown, not assumed
Models state their measured accuracy and uncertainty, and where the data cannot carry a prediction we tell you plainly.
A single product data model
ERP, passports and reports draw on the same product and material data rather than on three separate spreadsheets.
Key dates for manufacturers
Rules on products, data and reporting follow one another closely, and delegated acts under the Ecodesign Regulation will add dates for specific product groups.
In application
NIS2: Transposition deadline
Machinery, electronics, vehicles and other manufacturing sectors are covered; Malta’s NIS2 Order has applied since 23 January 2026.
In application
Data Act: Data Act in application
Users obtain rights over data their connected products generate.
In application
CBAM: Definitive phase begins
In application
CSRD: Omnibus narrows who reports
Large companies that were in the second wave start with financial year 2027.
In application
Cyber Resilience Act: Reporting duties begin
Severe incidents and vulnerabilities that are actively exploited have to be notified.
In application
Data Act: New connected products must open their data
Status on 2 October 2026
Upcoming
Machinery Regulation: Machinery Regulation in application
Covers safety functions that depend on software and on connectivity.
Upcoming
Batteries Regulation: Battery passports mandatory
For batteries in scope used in industry, electric vehicles and light means of transport.
Upcoming
Cyber Resilience Act: Core obligations in application
Laws and standards at a glance
The EU instruments that most often define product, plant and data work at a Maltese manufacturing site, and their consequence for engineering.
This summary is meant for planning and is not legal advice; duties for a given product depend on delegated acts and harmonised standards. EU dates were reviewed on 2 October 2026 and the Maltese references on 4 November 2026.
- Cyber Resilience ActScopeEU-wide
Hardware or software with digital elements on the EU market must be built securely, kept patched for as long as the manufacturer supports it and covered by a process for handling vulnerabilities. Reporting obligations begin on 11 September 2026; most other requirements apply from 11 December 2027.
What it means for your plantSecure development, SBOMs and update pipelines become features of the product, and we fit them into your platform and your release routine.
SourceRegulation (EU) 2024/2847, EUR-Lex (opens external site)
- Data ActScopeEU-wide
Whoever uses a connected product or related service may access and pass on the data it creates. From 12 September 2026, newly marketed connected products must be built so that this data is reachable.
What it means for your plantYou need documented interfaces for data access and contract terms for sharing, and we design both of them.
SourceRegulation (EU) 2023/2854, EUR-Lex (opens external site)
- Ecodesign Regulation and Digital Product PassportScopeEU-wide
The Ecodesign for Sustainable Products Regulation is the framework for product requirements and for the Digital Product Passport. Delegated acts then set the actual duties one product group at a time.
What it means for your plantIf your product data model already records materials, origin and repair details, each new delegated act becomes a mapping exercise instead of a new system.
SourceRegulation (EU) 2024/1781, EUR-Lex (opens external site)
- Machinery RegulationScopeEU-wide
Takes over from the Machinery Directive on 20 January 2027 and addresses safety functions that rely on software, connected machines and protection against tampering with safety-related software.
What it means for your plantSoftware that touches a safety function needs traceable requirements and strict change control, so we keep it well apart from analytics and assistants.
SourceRegulation (EU) 2023/1230, EUR-Lex (opens external site)
- NIS2 for manufacturingScopeEU-wide
The directive lists manufacturers of medical devices, computers and electronics, electrical equipment, machinery and vehicles, and expects them to manage risk, report incidents and secure their suppliers. Malta implements it through the NIS2 Order (S.L. 460.41), and operators within scope register with the CIP Department.
What it means for your plantOT security, network segmentation and incident handling reach the board agenda, and our IT/OT integration is designed with them already in place.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- CBAM and sustainability reportingScopeEU-wide
Imports of goods covered by the Carbon Border Adjustment Mechanism moved into its definitive regime on 1 January 2026. On sustainability reporting, the 2026 Omnibus confined the CSRD to the largest firms and delayed when they first report.
What it means for your plantCapture emissions, energy and material data once, where it originates, with lineage an auditor can retrace.
SourceRegulation (EU) 2023/956, EUR-Lex (opens external site)
Illustrative use cases for Maltese plants
Illustrative exampleMaintenance answers beside the machine
A technician asks a question in their own words and receives the relevant manual section, work instruction and earlier repairs, each with its source.
Supplier certificates at goods receipt
Certificates of conformity and material declarations at a pharmaceutical plant are read, compared with the purchase order and filed with the batch record.
Customer orders and delivery notes
Orders and delivery notes are read and validated before posting, and staff settle every exception.
An ageing MES modernised behind APIs
The old MES gets documented APIs and is then replaced one function at a time while the line keeps running.
Spare parts enquiries
Customers and distributors find the right part and check stock, and the assistant hands technical questions to service engineers.
Platforms in manufacturing
SAP
Gold PartnerSAP S/4HANA for production and supply chain across a European group, with the Maltese plant’s MES and line data linked in through the namespace.
Odoo
Gold PartnerOdoo manufacturing for a mid-sized plant or a local subsidiary, frequently run as a second tier under SAP at group level.
Salesforce
Summit PartnerSales contracts, distributor networks and field service, tied to the installed base and its service history.
The partner levels shown are FromNine’s own. Product names are trademarks of the companies that own them.
Malta
A Maltese plant inside a European group
A pharmaceutical or other export plant in Malta may belong to a group based elsewhere in the EU, with its own MES, a local or group ERP instance and customers across the Union. EU product rules such as the Cyber Resilience Act, the Data Act and the Ecodesign Regulation reach it exactly as they reach the parent, while cybersecurity duties come through Malta’s NIS2 Order and the CIP Department.
We design one information model and integration pattern that the Maltese site and its sister plants can adopt at their own speed, with service content in the languages of the people on the floor.
- Cyber Resilience ActCyber Resilience Act, Regulation (EU) 2024/2847 (opens external site)
- Data ActData Act, Regulation (EU) 2023/2854 (opens external site)
- Ecodesign Regulation (ESPR)Ecodesign for Sustainable Products Regulation (EU) 2024/1781 and the Digital Product Passport (opens external site)
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- Malta NIS2 OrderMeasures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025, with the Critical Infrastructure Protection Department as competent authority (opens external site)
Questions from manufacturers
Do your systems write to our PLCs or SCADA?
Not unless you ask for it. Analytics and assistants only read plant data from the namespace, and any change to production goes through the MES or your control engineers, with an operator’s approval and formal change control.
Is predicting machine breakdowns realistic?
In some cases. Much depends on how the machine fails, which sensors exist and how much history is available. We run a test first, publish the measured accuracy and uncertainty, and advise simple condition-based rules wherever a model would not be dependable.
What protocols and standards do you use?
Plant data travels over OPC UA and MQTT; ISA-95 shapes the information model; IEC 62443 defines zones and conduits; suppliers and customers connect through EDI or APIs.
What part do you play under the Cyber Resilience Act?
We prepare the product platform: secure development, SBOMs, a route for receiving vulnerability reports and update pipelines. You keep responsibility for conformity assessment and legal interpretation, together with your notified body where one is involved.
Our group runs SAP and the Maltese plant runs Odoo. Can they work together?
Yes. A two-tier ERP landscape is a familiar pattern: we agree which master data and transactions belong in each system and integrate them so that group reporting stays consistent.
Talk to us about your plant or product
Linking line data to the ERP, getting connected products ready for the CRA or giving technicians faster answers? Begin with a single line, product or site.