Six frameworks that matter for plating shops

The EU sorts AI systems into four risk classes. The anomaly detection is designed as an advisory system: unusual patterns are flagged, and a trained specialist always decides how to respond. Based on our own assessment, it is not a high-risk use case under Annex III; the classification should be confirmed case by case with your compliance team. For every flagged anomaly you can trace which sensors and which data patterns caused it (explainable AI). No automatic intervention in the line.

The NIS2 Directive requires larger industrial companies to carry out cybersecurity risk analysis, incident reporting and supply chain security. Smaller shops are not covered directly — but major customers subject to NIS2 pass the requirements on to their suppliers. The methodology is documented so that it can serve as evidence for customers who audit you: patch processes, logging, procedures for security incidents.

The Cyber Resilience Act focuses on secure development processes and supply chain security. Every code change goes through seven automated checks (including static code analysis, dependency checks and a license check), releases are cryptographically signed with a hardware token, and every change can be traced with author and time across the entire history. The response time for critical security updates is agreed in the maintenance contract.

Only machine data is processed — sensor values, process parameters, complaint statistics. Personal data goes neither into the analysis nor into the model. The security requirements of Article 32 are implemented anyway: encryption in transit, access control, documented deletion after the project ends, on request. If data exports accidentally contain personal data (for example, operator names in shift logs), it is removed before the analysis and the procedure is recorded in writing.

IEC 62443 is the central standard for cybersecurity in industrial control systems. A key principle is one-way data flow: data may flow from the line to the analysis, never back. That way, a compromised analysis system cannot use this path to interfere with the production process. This separation is built firmly into the architecture — the analysis runs on an isolated local system with read-only access. No write access to PLCs, bath controls or line equipment. This is not just a technical measure but also a contractual commitment.

TÜV AUSTRIA offers a voluntary model audit for AI systems used in industry. The review covers, among other things, statistical validation, reproducibility, how model drift is handled and the separation of training and validation data. The inspection took place from late April to late May 2026, based on the submitted documentation and an audit meeting with a live demonstration of the model, and was completed in June 2026. The inspection report confirms that the system meets the expected requirements for its risk class and shows an advanced level of maturity in development and documentation. An excerpt from the management summary is available under Credentials.