The EU date for the first energy audit of firms above 10 TJ passed on 11 October 2026, and Poland's bill UC77 is still with the government. What binds a plant today, what the bill changes, and what fresh Eurostat prices say about the cost of waiting.

Since 11 September 2026, software manufacturers, MES vendors included, must send an early warning of an actively exploited vulnerability within 24 hours and a full notification within 72 hours to the CSIRT and ENISA. Who Article 14 of the CRA covers and what factories should ask of their vendor.

From 18 February 2027 the product passport becomes mandatory for industrial batteries above 2 kWh, EV and LMT batteries. A passport cannot be assembled from a spreadsheet after the fact — it needs product genealogy captured by the MES while the goods are being made. Here is which data has to be linked, which standards now govern it (EN 18219, EN 18220), and what a mid-sized factory can realistically finish in five months.

From 18 February 2027 every LMT battery, every industrial battery above 2 kWh and every EV battery placed on the EU market must have a battery passport (Article 77 of Regulation 2023/1542). Based on the European Commission guidance of August 2026 we explain which data points are mandatory from February, which are not yet filled in (carbon footprint, recycled content, due diligence), what the Battery Pass, Volvo and GBA pilots showed, and what data your MES should prepare.

The 2 August 2026 date did not start enforcement of high-risk AI obligations. The Digital Omnibus (Regulation (EU) 2026/1744) moved them to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I. What a factory running an MES must comply with today (the workplace emotion-recognition ban, transparency duties, GDPR and DPIAs for operator monitoring), who supervises the AI Act in Poland, and how to use the time until December 2027.

The CBAM definitive period started on 1 January 2026, and 1 August 2026 is the deadline for the first periodic report under the new regime. European companies in steel, aluminium, cement, fertilisers, hydrogen and electricity — whether importing into the EU or exporting to carbon-aware markets — need to start computing embedded emissions per tonne of product. This article walks through what data MES + EMS must produce, how to map it to PCF (ISO 14067), which tools actually work, what it costs and what the penalties are. Plus a six-week roadmap to the deadline.

The Polish amendment to the National Cybersecurity Act (KSC2), transposing the EU NIS2 Directive, enters real enforcement in the second half of 2026. Factories producing chemicals, food, machinery, automotive, electronics or medical devices — if they employ more than 50 people — are classified as "important entities" and fall under the full obligations package. This article walks through the ten Article 21 NIS2 requirements from an MES perspective: which functions already produce compliance evidence, what is missing, how every external API (OpenAI, cloud LLM, SaaS MES) grows your audit surface, and what to do concretely in the remaining months of 2026.

On 18 February 2027 the battery passport becomes mandatory for EV batteries, industrial batteries above 2 kWh, and LMT batteries — the first concrete moment when the Digital Product Passport (DPP) turns from EU concept into a hard production requirement. For an MES, this means exposing roughly seventeen attributes per unit: material origin, carbon footprint, recycled content, batch ID, durability, cell health data. This article walks through ESPR (2024/1781) and the Battery Regulation (2023/1542) without fluff: which MES functions already produce the data, what is missing, how to wire it up architecturally with GS1 Digital Link, and what to do in the nine months left before the deadline.

On 2 August 2026, the EU AI Act high-risk rules become fully enforceable. A subset of MES functions — predictive maintenance tied to machine safety, operator performance monitoring, AI in medical-grade quality control, and AI-assisted workforce decisions — may be classified as high-risk, with fines up to €15M for breaches. This article maps concrete MES modules to Annex I and Annex III, lists the seven obligations of high-risk operators, and gives a 3-month action checklist for plant owners.

Nvidia and the data problem at a broader scale