Applies now
Ecodesign Regulation: Digital Product Passport framework in force
Requirements follow in delegated acts per product group.
Manufacturing & Industry
From the production line to the boardroom.
What we would build for manufacturers in electrical and electronics, semiconductor assembly and test, chemicals, steel and aluminium products and packaging: IT/OT integration that leaves the control layer alone, operational data for quality and maintenance, service knowledge at the machine, and the product data that EU rules ask of exported goods.
For Malaysian manufacturers and exporters with plants at home, customers in the EU and, often, subsidiaries in Europe.
1 January 2026
CBAM definitive period begins
EU importers of covered goods such as steel and aluminium move to the definitive regime and need embedded emissions data from producers.
1 January 2026
e-Invoice phase four
The fourth phase of mandatory e-Invoice validated through MyInvois, the system of the Inland Revenue Board of Malaysia (IRBM).
SourceIRBM e-Invoice implementation timeline (opens external site)
11 December 2027
EU Cyber Resilience Act applies in full
To keep the CE mark in the EU, a connected product needs security built into its design and a process for handling vulnerabilities.
What is changing for Malaysian manufacturers
Exports now carry data obligations
A product shipped to an EU customer now carries more than its specification: EU rules on cyber resilience, data access, ecodesign and battery passports reach into how it is designed. Security updates, user access to product data and passport records travel with the goods.
Plant data has to leave the plant safely
The business needs plant data in the cloud while control systems stay safe and available. IEC 62443 gives engineers the vocabulary of zones and conduits, and EU customers covered by NIS2 pass supply-chain security requirements on to their suppliers.
SourceDirective (EU) 2022/2555
Know-how leaves with experienced staff
Senior technicians and process engineers hold knowledge that no manual captures. Making it searchable, in the languages spoken on the floor, is now an operational priority.
Reporting reaches the factory floor
For goods covered by CBAM, EU importers ask producers for embedded emissions, and EU customers want energy and material figures per site and per product. Captured once at the source, the same figures can answer every request.
SourceRegulation (EU) 2023/956
Problems and how we would respond
- The problem
Each connection between MES and ERP is its own project.
How we would respondMachines, MES and ERP exchange data through a shared publish-and-subscribe layer (MQTT and OPC UA, structured on ISA-95), instead of a custom link for every pair of systems.
- The problem
Quality and maintenance data are kept apart.
How we would respondOne platform brings process, quality and maintenance records together, with context attached, so engineers trust the analysis. Each prediction is offered with its measured accuracy, or not offered.
- The problem
Technicians spend time hunting through manuals and service history.
How we would respondAn assistant that searches manuals, work instructions and repair history, answers in the language the technician uses and names the document and revision behind each answer.
- The problem
Connected products sold in the EU face new cyber and data rules.
How we would respondWe engineer the product platform with secure update pipelines, a software bill of materials per release, a vulnerability process and APIs that give users documented access to their data.
- The problem
Compliance data sits with dozens of suppliers.
How we would respondSupplier data arriving by EDI or API lands in one product data model, from which product and battery passports, and the emissions figures an EU importer asks for under CBAM, can be produced.
- The problem
Orders, delivery notes and certificates are retyped by hand.
How we would respondDocument intelligence reads and checks trade documents and certificates of conformity, staff confirm exceptions before ERP posting, and the same ERP data produces the e-Invoices sent to MyInvois.
IT/OT reference landscape for a plant
The ISA-95 levels are left as they are. Plant data reaches the analytics, knowledge and compliance services through one unified namespace above the zone boundary.
Illustrative example
Plant data crosses the zone boundary once, via the namespace, and every service above it reuses that data.
Read the diagram as text
From the top: the ERP for planning and logistics (SAP S/4HANA or Odoo) at level 4; MES, quality and maintenance at level 3; SCADA and HMI for supervision at level 2; PLCs and drives for control at level 1; and sensors, machines and lines in the process at level 0.
An IEC 62443 zone boundary separates level 4 from the levels beneath it.
A unified namespace collects data from levels 1 to 4 over MQTT and OPC UA and passes it to an operational data platform. That platform supports analytics on quality and maintenance, an assistant for service and engineering staff, and product compliance records including the Digital Product Passport.
Read often, write rarely
The namespace is read by analytics and assistants. A change to production only happens through the MES, approved by an operator.
Zones and conduits
Segmentation follows IEC 62443, with defined conduits between the control and enterprise networks.
Accuracy stated with each prediction
Each model states how accurate and how uncertain it is, measured on your data. If the data cannot carry a prediction, you hear that from us.
One model for product data
The same product and material data feeds the ERP, the passports and the reports, in place of three spreadsheets.
EU dates that reach Malaysian exporters
Product, data and reporting rules follow each other quickly. Delegated acts under the Ecodesign Regulation will add dates per product group.
Applies now
NIS2: National NIS2 laws take effect
Machinery, electronics and vehicle manufacturing are among the EU sectors in scope.
Applies now
Data Act: Data Act in application
Users gain rights to the data their connected products generate.
Applies now
CBAM: Definitive period begins
Applies now
CSRD: Omnibus narrows reporting scope
Large companies from the former second wave report from financial year 2027.
Applies now
Cyber Resilience Act: Vulnerability and incident reporting begins
Actively exploited vulnerabilities and severe incidents have to be reported.
Applies now
Data Act: Access by design for new connected products
Status on 2 October 2026
Coming
Machinery Regulation: Machinery Regulation in application
Including requirements for safety functions that depend on software and connectivity.
Coming
Batteries Regulation: Battery passport becomes mandatory
Applies to batteries in scope for industry, electric vehicles and light means of transport.
Coming
Cyber Resilience Act: Main obligations in application
Rules and standards in brief
For Malaysian exporters, these EU instruments shape product, plant and data engineering most often. Each entry ends with what it means in practice.
For planning discussions, not legal advice. Product-specific duties depend on delegated acts and harmonised standards. EU dates checked on 2 October 2026; Malaysian dates on 6 November 2026.
- Cyber Resilience ActScopeEU law
Any product with digital elements placed on the EU market falls under it, wherever it was made. It has to be designed securely, kept updated for its support period and backed by vulnerability handling. Reporting starts on 11 September 2026; the main obligations follow on 11 December 2027.
What it means in practiceYour release process gains a software bill of materials, secure development practice and an update pipeline, and we engineer those into the platform.
SourceRegulation (EU) 2024/2847, EUR-Lex (opens external site)
- Data ActScopeEU law
A person or business using a connected product, or a service linked to it, is entitled to the data it generates and may pass that data on. For connected products placed on the EU market from 12 September 2026, that access has to be designed in.
What it means in practiceProduct platforms need documented interfaces for data access and contract terms for sharing it. We design both.
SourceRegulation (EU) 2023/2854, EUR-Lex (opens external site)
- Ecodesign Regulation and Digital Product PassportScopeEU law
Under the Ecodesign for Sustainable Products Regulation, the EU sets product requirements and the framework for the Digital Product Passport; delegated acts then define the duties for each product group.
What it means in practiceIf your product data model already holds material, origin and repair information, each new delegated act becomes a mapping exercise rather than a new system.
SourceRegulation (EU) 2024/1781, EUR-Lex (opens external site)
- Machinery RegulationScopeEU law
From 20 January 2027 it replaces the Machinery Directive, with requirements covering software-based safety functions, connected machinery and protection of safety-relevant software against corruption.
What it means in practiceSoftware that touches a safety function needs traceable requirements and change control, so we keep it clearly apart from analytics and assistance.
SourceRegulation (EU) 2023/1230, EUR-Lex (opens external site)
- NIS2 for manufacturingScopeEU law
NIS2 covers several EU manufacturing sectors, among them medical devices, electronic and electrical products, machinery and motor vehicles. Those manufacturers manage risk, report incidents and secure their supply chain, which reaches Malaysian suppliers through contract requirements.
What it means in practiceOT security, segmentation and incident processes reach board level. Our IT/OT integration is designed with them in place.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- CBAM and sustainability reportingScopeEU law
Since 1 January 2026, CBAM has been in its definitive period for covered imports, steel and aluminium among them, and EU importers need the emissions embedded in those goods, often from producers abroad. Separately, the 2026 Omnibus limited CSRD reporting to the largest companies and pushed back their first reporting years.
What it means in practiceCapture emissions, energy and material data once, at the source, with lineage an auditor can follow, so an EU importer’s request is answered from measured data rather than estimates.
SourceRegulation (EU) 2023/956, EUR-Lex (opens external site)
Illustrative scenarios
Illustrative exampleMaintenance knowledge at the line
Technicians would ask in their own language and receive the relevant manual section, work instruction and earlier fixes, with sources.
Supplier certificate intake
Certificates of conformity and material declarations would be read, checked against the purchase order and filed with the batch.
Orders and delivery notes
Customer orders and delivery notes would be extracted and validated before posting; staff confirm each exception.
MES replacement in stages
A legacy MES would sit behind documented APIs while its functions move to new components one at a time; no line has to stop.
Spare-parts enquiries
Customers and distributors would identify parts and check stock; the assistant hands over to service staff where technical judgement is needed.
Platforms for manufacturers
SAP
Gold PartnerSAP S/4HANA for production and supply chain across a Malaysian parent and its EU subsidiaries, linked to MES and plant data through the namespace.
Odoo
Gold PartnerOdoo for mid-sized plants and subsidiaries, frequently as the second tier under a group-level SAP system.
Salesforce
Summit PartnerSales agreements, distributor networks and field service, linked to the installed base and its service history.
FromNine holds the partner levels shown. Product names belong to their respective owners.
Malaysia
Plants in Malaysia, customers in the EU
At home, mandatory e-Invoice reached its fourth phase on 1 January 2026, so an in-scope company’s ERP must issue invoices that the IRBM validates through MyInvois. For goods placed on the EU market, CBAM has applied since 1 January 2026, connected products face the Cyber Resilience Act and the Data Act, and the Ecodesign Regulation and battery passport follow as their dates arrive.
Each plant can adopt one shared information model and integration pattern when it is ready, with service content in the languages its staff use. The same product data then answers the MyInvois invoice, the EU importer’s CBAM request and the product passport.
- Malaysian e-Invoice (MyInvois)Mandatory e-Invoice validated through MyInvois (IRBM), phased by annual turnover or revenue; businesses below RM3 million annual turnover or revenue are exempt (opens external site)
- CBAMCarbon Border Adjustment Mechanism, Regulation (EU) 2023/956 (opens external site)
- Cyber Resilience ActCyber Resilience Act, Regulation (EU) 2024/2847 (opens external site)
- Data ActData Act, Regulation (EU) 2023/2854 (opens external site)
- Ecodesign Regulation (ESPR)Ecodesign for Sustainable Products Regulation (EU) 2024/1781 and the Digital Product Passport (opens external site)
- Batteries RegulationBatteries Regulation (EU) 2023/1542 (opens external site)
Frequently asked questions
Would you write to our control systems?
Not by default. Plant data is read through the namespace. Production changes stay with the MES or your control engineers, under operator approval and change control.
Can machine failures be predicted?
In some cases. Whether it works depends on failure modes, sensor coverage and how much history exists. We run a test first, share the accuracy and uncertainty we measured, and advise condition-based rules where a model would be unreliable.
Which protocols and standards do you use?
For plant data, OPC UA and MQTT; for the information model, ISA-95; for zones and conduits, IEC 62443; and for suppliers and customers, EDI or APIs.
How do you help with the EU Cyber Resilience Act?
We engineer the product platform for it: secure development practice, a software bill of materials, intake of vulnerability reports and update pipelines. You keep the conformity assessment and the legal reading, with a notified body where the rules require one.
Can group SAP and plant-level Odoo run side by side?
Yes, and the pattern is common. We decide which master data and transactions belong in each system and integrate them, so group figures agree and e-Invoices for MyInvois come from whichever ERP holds the transaction.
Where should your plant programme start?
Connecting plant data, preparing connected products for EU rules or putting service knowledge in technicians’ hands? Begin with a single line, product or plant.