The Polish amendment to the National Cybersecurity Act (KSC2), transposing the EU NIS2 Directive, enters real enforcement in the second half of 2026. Factories producing chemicals, food, machinery, automotive, electronics or medical devices — if they employ more than 50 people — are classified as "important entities" and fall under the full obligations package. This article walks through the ten Article 21 NIS2 requirements from an MES perspective: which functions already produce compliance evidence, what is missing, how every external API (OpenAI, cloud LLM, SaaS MES) grows your audit surface, and what to do concretely in the remaining months of 2026.

On 18 February 2027 the battery passport becomes mandatory for EV batteries, industrial batteries above 2 kWh, and LMT batteries — the first concrete moment when the Digital Product Passport (DPP) turns from EU concept into a hard production requirement. For an MES, this means exposing roughly seventeen attributes per unit: material origin, carbon footprint, recycled content, batch ID, durability, cell health data. This article walks through ESPR (2024/1781) and the Battery Regulation (2023/1542) without fluff: which MES functions already produce the data, what is missing, how to wire it up architecturally with GS1 Digital Link, and what to do in the nine months left before the deadline.

On 2 August 2026, the EU AI Act high-risk rules become fully enforceable. A subset of MES functions — predictive maintenance tied to machine safety, operator performance monitoring, AI in medical-grade quality control, and AI-assisted workforce decisions — may be classified as high-risk, with fines up to €15M for breaches. This article maps concrete MES modules to Annex I and Annex III, lists the seven obligations of high-risk operators, and gives a 3-month action checklist for plant owners.

Nvidia and the data problem at a broader scale