Manufacturing Software Development

Since 1 January 2026 the Carbon Border Adjustment Mechanism applies under its definitive regime, covering imports of cement, iron and steel, aluminum, fertilizers, electricity, and hydrogen. The obligations that come with it are authorization, reporting, and the purchase and surrender of CBAM certificates matched to the embedded emissions of each import.

The engineering consequence is that Commission default values stop being a comfortable fallback. Every in-scope shipment needs a traceable chain from declaration line to supplier production batch to verifier opinion, plus a monthly reconciliation between the ERP item master, the customs broker classifications, and the import documents. If you produce steel or aluminum outside the EU, the same pressure reaches you as a data request from your EU customer.

The EU Data Act has applied since 12 September 2025. Users of connected products, including the plants that buy your machines, can access the data those machines generate and pass it to third-party providers for repair and maintenance. The regulation also requires that connected devices placed on the EU market be designed to allow that sharing.

The harder deadline is design, not disclosure: the access-by-design obligation covers connected products made available on the EU market after 12 September 2026. A machine generation that ships without a documented data model, an access API, and a permissioning path turns into a retrofit for the same firmware team that is already behind.

Regulation (EU) 2023/1230 applies on a mandatory basis from 20 January 2027. It brings safety functions delivered in software, including AI-powered ones, inside the machinery safety regime, adds cyber-safety provisions for compliance-relevant software and safety control systems, and sets the conditions for digital instructions and digital declarations of conformity.

The Cyber Resilience Act stacks on top of it for any product with digital elements: vulnerability and incident reporting obligations apply from 11 September 2026, the main obligations from 11 December 2027. In build terms that means a software bill of materials, a signed and resumable update path with rollback, and a reporting runbook you can execute in hours, for equipment you will support for the next decade and a half.

The Ecodesign for Sustainable Products Regulation entered into force on 18 July 2024 and introduces the Digital Product Passport, a digital identity card carrying technical performance, materials and their origins, repair activity, and recyclability. The 2025 to 2030 working plan adopted in April 2025 names steel and aluminum, textiles, furniture, tires, and mattresses among the first priority groups.

For a manufacturer this is a PLM and product master problem before it is a compliance problem. Passport fields have to be captured at the point of production, versioned per batch, and resolvable from a QR, NFC, or RFID carrier for years after the unit leaves the yard. Teams that treat it as one more label print end up rebuilding the data model twice.