AI for German manufacturing.

What we see in manufacturing

German manufacturers are under simultaneous pressure from NIS2 (network and information security), the Cyber Resilience Act (product security with mandatory SBOM and vulnerability handling), the EU AI Act where AI sits inside the product, and customers who increasingly expect AI-assisted productivity. The convenient framing — "let’s do an AI project" — rarely survives contact with regulators or the production floor. We focus on engagements that combine both.

Compliance work we do here

• NIS2 readiness — Directive (EU) 2022/2555. National transposition deadline was 17 October 2024; Germany’s NIS2UmsuCG is in force as of 23 September 2025. Penalties up to €10M or 2% of global turnover. We deliver gap analysis, governance review, incident-management, supplier risk via our Cyber Compliance Package.
• Cyber Resilience Act (CRA) — Regulation (EU) 2024/2847. Full enforcement begins 11 September 2027. Manufacturers must ship products with security-by-design, vulnerability handling, and SBOM disclosure. Penalties up to €15M or 2.5% of global turnover. We deliver product compliance review, SBOM guidance, secure software lifecycle, and security documentation.
• EU AI Act for embedded AI in industrial products — Annex IV documentation, risk classification under Annex III when applicable. See the live EU AI Act timeline (the May 2026 Digital Omnibus may defer some Annex III deadlines).
• ISO 27001 alignment for organisations targeting certification later.

Private AI use cases that pay back

• Technical-documentation RAG — engineers find answers in 20-year-old machine manuals, SOPs, and supplier specs in seconds rather than hours. Works particularly well with Private AI given the IP sensitivity.
• Supplier correspondence assistant — summarise multi-thread email chains, classify supplier-quality issues, draft responses in three languages.
• Maintenance log analysis — pattern-detect failure modes across years of free-text maintenance notes that humans never had time to read.
• Quality-deviation triage — classify deviation reports against historical patterns; route to the right engineer.
• Sales-engineering offer support — pull configuration logic, pricing rules, and prior offers when responding to RFQs.

Infrastructure considerations

Manufacturing data sovereignty is real: shop-floor data, customer drawings, supplier pricing, and process know-how are all genuinely sensitive. We typically recommend an on-prem inference server with an Llama 3 or Mistral model serving the RAG layer, sitting in the same network segment as your ERP and PLM systems. The footprint is smaller than most IT teams expect — often a single GPU server is enough for several hundred technical users.

Where to start

For manufacturing engagements we typically suggest one of:

• AI Readiness Assessment — if you’re still figuring out what AI even means for your operation.
• Cyber Compliance Package — if NIS2 or CRA is the immediate deadline.
• Private AI & Infrastructure Package — if you’re ready to design an on-prem AI server room.