https://eucalex.com/news/ OT cybersecurity, data integrity, validation, industrial digital transformation and AI on industrial sites — articles by EUCALEX. en Thu, 08 Oct 2026 06:00:00 GMT https://eucalex.com/assets/eucalex-logo.pnghttps://eucalex.com/news/ https://eucalex.com/news/ethernet-apl-field-instruments/ https://eucalex.com/news/ethernet-apl-field-instruments/ Thu, 08 Oct 2026 06:00:00 GMT EUCALEX Automation & Technology Ethernet-APL puts a 10 Mbit/s Ethernet link and its power on one twisted pair, out to the transmitter in Zone 0. The data is real. So are the two consequences the brochures skip: every instrument becomes a network node, and every writable parameter becomes configuration a GMP site has to control. 13 https://eucalex.com/news/security-programme-62443-2-1/ https://eucalex.com/news/security-programme-62443-2-1/ Mon, 05 Oct 2026 06:00:00 GMT EUCALEX Cybersecurity The 2024 edition of IEC 62443-2-1 replaces the 2010 management-system text with eight security programme elements and a maturity scale. What changed, what it asks of an asset owner, and how a GMP site can run it through the records its quality system already keeps. 12 https://eucalex.com/news/ot-awareness-and-metrics/ https://eucalex.com/news/ot-awareness-and-metrics/ Thu, 01 Oct 2026 06:00:00 GMT EUCALEX Cybersecurity A single awareness campaign fades within months. What lasts is a recurring function with an owner, a calendar and a handful of indicators reviewed alongside the safety figures. 9 https://eucalex.com/news/ot-skills-bottleneck/ https://eucalex.com/news/ot-skills-bottleneck/ Tue, 29 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity Industrial cybersecurity programmes rarely stall for lack of technology or capital. They stall for lack of people who understand both security and the process they are protecting. 9 https://eucalex.com/news/ot-pha-lopa-cyber-risk/ https://eucalex.com/news/ot-pha-lopa-cyber-risk/ Mon, 28 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity A process site does not need to start its OT security risk assessment from a blank page. The consequence work is largely done. What is missing is one question the safety studies were never asked: what if someone does this on purpose? 10 https://eucalex.com/news/robots-on-a-gmp-line/ https://eucalex.com/news/robots-on-a-gmp-line/ Sun, 27 Sep 2026 06:00:00 GMT EUCALEX Automation & Technology The world now runs five million industrial robots. On a pharmaceutical site the robot is the easy part: the safety standard stops where hygiene starts, the program is a GMP record, and the controller sits on the OT network. What to specify, qualify and protect. 12 https://eucalex.com/news/ot-remediation-cycle/ https://eucalex.com/news/ot-remediation-cycle/ Sat, 26 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity Identify, prioritise, remediate, validate, maintain. The five steps look the same in IT and OT. The fourth is the one teams skip most often, and it is the one that makes remediation industrial. 11 https://eucalex.com/news/cra-annex-i-for-buyers/ https://eucalex.com/news/cra-annex-i-for-buyers/ Sat, 26 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity The Cyber Resilience Act binds the people who build your lines, not you. Its essential requirements still end up in your purchase order, your FAT and your change control. What Annex I really asks, what it leaves to the contract, and eight lines for the specification. 13 https://eucalex.com/news/ot-programme-functions/ https://eucalex.com/news/ot-programme-functions/ Fri, 25 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity A roadmap says when things happen. The functions say how the programme is organised. On an industrial site, the order in which they mature decides whether the money is well spent, and people are not a sixth box but the medium for all five. 9 https://eucalex.com/news/ot-three-horizon-roadmap/ https://eucalex.com/news/ot-three-horizon-roadmap/ Thu, 24 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity Industrial cybersecurity has no go-live date. Treat it as a trajectory over three overlapping horizons, planned around the site’s real shutdowns, budgets and people, and reviewed on the rhythm of process safety. 10 https://eucalex.com/news/ot-six-actions-six-months/ https://eucalex.com/news/ot-six-actions-six-months/ Tue, 22 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity The first goal of an OT security programme is not to secure everything. It is to bring risk down quickly, with measures that work and that nobody has to wait for: six actions, in order, with the effort, the effect and the pitfall of each. 9 https://eucalex.com/news/ot-roles-decide-execute-check/ https://eucalex.com/news/ot-roles-decide-execute-check/ Sat, 12 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity After vocabulary, the second reason OT security programmes stall is ownership. Every perimeter needs three answers written down: who decides, who executes, who checks. A reference split, the contract clauses that matter, and the decision chain for the bad day. 9 https://eucalex.com/news/cra-reporting-live/ https://eucalex.com/news/cra-reporting-live/ Fri, 11 Sep 2026 06:00:00 GMT EUCALEX Cybersecurity The Cyber Resilience Act has been in force since 10 December 2024. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents, including in products already installed; full application follows on 11 December 2027. 4 https://eucalex.com/news/automation-changes-the-job/ https://eucalex.com/news/automation-changes-the-job/ Fri, 21 Aug 2026 06:00:00 GMT EUCALEX Quality & System Qualification A new camera or a new HMI changes the work long before it changes a job title. What EU GMP, 21 CFR 211.25 and Annex 11 ask of personnel, why read-and-sign is not qualification, how access should follow evidence, and how change control carries the training. 12 https://eucalex.com/news/s7-plcs-active-threat/ https://eucalex.com/news/s7-plcs-active-threat/ Thu, 20 Aug 2026 06:00:00 GMT EUCALEX Cybersecurity The NSA and co-sealing agencies have issued an advisory on active exploitation of Siemens S7 series controllers, with exploitation scripts disguised as legitimate monitoring tools. 4 https://eucalex.com/news/five-ot-cybersecurity-myths/ https://eucalex.com/news/five-ot-cybersecurity-myths/ Wed, 19 Aug 2026 06:00:00 GMT EUCALEX Cybersecurity The air gap that is not one, the proprietary protocol nobody supposedly knows, the safety system believed to be immune: five beliefs we still meet on production sites, and what the field actually shows. 3 https://eucalex.com/news/ot-recommended-is-not-optional/ https://eucalex.com/news/ot-recommended-is-not-optional/ Sat, 08 Aug 2026 06:00:00 GMT EUCALEX Cybersecurity A site security standard that covers both IT and OT needs room for flexibility. Without a precise requirement scale and strict conditions on every exception, that flexibility quietly turns into a permanent exemption. Four levels, four fields, one review date. 10 https://eucalex.com/news/pid-drawings-stay-true/ https://eucalex.com/news/pid-drawings-stay-true/ Fri, 07 Aug 2026 06:00:00 GMT EUCALEX Quality & System Qualification On a qualified plant the P&ID and the loop diagrams are evidence: the IQ was signed against them. Where the drawings drift away from the field, why it matters for GMP, data integrity and security, and how to tie every revision to change control. 12 https://eucalex.com/news/plc-code-version-control/ https://eucalex.com/news/plc-code-version-control/ Wed, 29 Jul 2026 06:00:00 GMT EUCALEX Data Integrity A PLC program is part of the validated state, yet on most sites it lives in folders called final, final2 and integrator. What GMP already asks, what a Git repository proves to an inspector and what it does not, and the one comparison that tells you whether the line runs the code you approved. 12 https://eucalex.com/news/ai-assistant-plc-code/ https://eucalex.com/news/ai-assistant-plc-code/ Wed, 29 Jul 2026 06:00:00 GMT EUCALEX AI An assistant drafts a structured-text block, translates an alarm list or proposes a test list in minutes. On a GMP line that code is still custom software: what the tool can take on, what stays with a named engineer, and the evidence that keeps the logic validatable. 13 https://eucalex.com/news/agent-chained-intrusion/ https://eucalex.com/news/agent-chained-intrusion/ Tue, 28 Jul 2026 06:00:00 GMT EUCALEX Cybersecurity A July 2026 safety evaluation became a live intrusion across two companies. Nothing in the chain was novel except who assembled it, and how fast. 6 https://eucalex.com/news/ot-one-standard-two-regimes/ https://eucalex.com/news/ot-one-standard-two-regimes/ Wed, 08 Jul 2026 06:00:00 GMT EUCALEX Cybersecurity A single internal security standard closes the grey zone between office and plant. But the same rule cannot be enforced the same way on a mail server and on a controller running a reactor: one document, one glossary, and two regimes of application. 11 https://eucalex.com/news/hazardous-areas-pharma-plant/ https://eucalex.com/news/hazardous-areas-pharma-plant/ Wed, 01 Jul 2026 06:00:00 GMT EUCALEX Automation & Technology Ethanol in the granulation suite, powder in the mill, a panel PC on the wall. What the two ATEX directives split between supplier and site, how to read an Ex nameplate, what intrinsic safety really tolerates, and why the classic failure on a GMP site is a spare part that looked identical. 12 https://eucalex.com/news/reinforcement-learning-hvac-control/ https://eucalex.com/news/reinforcement-learning-hvac-control/ Tue, 30 Jun 2026 06:00:00 GMT EUCALEX AI A vendor has run a cleanroom air-handling system with a self-learning controller and reports a cut in fuel use. What the case shows, why a pharmaceutical HVAC does two jobs at once, what the draft EU GMP Annex 22 says about models that keep learning, and how to frame a pilot. 12 https://eucalex.com/news/building-management-systems/ https://eucalex.com/news/building-management-systems/ Tue, 30 Jun 2026 06:00:00 GMT EUCALEX Automation & Technology A building management system is now a legal obligation on most large non-residential buildings, and on an industrial site it holds conditions the process depends on. What a BMS actually controls, the six buses you will meet in a plant room, the four families of supervision software, and what to write in the specification. 13 https://eucalex.com/news/azurite-engineering-workstation/ https://eucalex.com/news/azurite-engineering-workstation/ Mon, 15 Jun 2026 06:00:00 GMT EUCALEX Cybersecurity According to Dragos, AZURITE enters through VPNs and firewalls and goes after the one PC that holds your PLC projects, alarm lists and HMI files. What public sources confirm, what rests on Dragos alone, and eight checks for a GMP site. 12 https://eucalex.com/news/datacentre-oversizing-cost/ https://eucalex.com/news/datacentre-oversizing-cost/ Mon, 25 May 2026 06:00:00 GMT EUCALEX Others Data centres and server rooms are routinely built with one and a half to three times the power and cooling capacity they will ever use. What that costs over ten years, why it keeps happening, and what the EU Code of Conduct asks instead: provision for eighteen months, not for a decade. 7 https://eucalex.com/news/ot-survey-says-field-finds/ https://eucalex.com/news/ot-survey-says-field-finds/ Thu, 21 May 2026 06:00:00 GMT EUCALEX Cybersecurity 330 practitioners told SANS where their OT security stands: faster detection, slow recovery, thin visibility near the controllers, remote access as the way in. Set beside field assessments, the self-portrait is mostly honest, and a GMP site can test each answer against its own records. 12 https://eucalex.com/news/what-ot-assessments-find/ https://eucalex.com/news/what-ot-assessments-find/ Wed, 20 May 2026 06:00:00 GMT EUCALEX Cybersecurity Dragos’s 2026 Year in Review includes a year of field work: incidents that began as process faults, flat networks, remote access, advisories with no fix. Read for a GMP site, each finding points to a record you already keep and a check you can run this month. 11 https://eucalex.com/news/control-loops-on-off-to-pid/ https://eucalex.com/news/control-loops-on-off-to-pid/ Tue, 12 May 2026 06:00:00 GMT EUCALEX Automation & Technology Every temperature, level, pressure and speed on a plant is held by a control loop. What a loop is made of, what precision, speed and stability mean, the four types of controller, why the process decides which one you need, and what a PLC adds to the theory. 12 https://eucalex.com/news/ai-as-a-working-partner/ https://eucalex.com/news/ai-as-a-working-partner/ Thu, 30 Apr 2026 06:00:00 GMT EUCALEX AI IT, OT, networking, automation, electronics, cybersecurity, data integrity, quality, standards. The answer almost always exists somewhere already; finding it is the bottleneck. What we have learned building retrieval on a technical library, and what a regulated site should require before it trusts one. 4 https://eucalex.com/news/softplc-virtual-controller-gmp/ https://eucalex.com/news/softplc-virtual-controller-gmp/ Wed, 29 Apr 2026 06:00:00 GMT EUCALEX Automation & Technology Once the controller is a runtime on a server, the IQ has five layers to record instead of one, an operating system patch can touch a qualified control function, and a host failure stops more than one machine. What to specify, test and govern before a GMP site says yes. 12 https://eucalex.com/news/rag-chunking-first/ https://eucalex.com/news/rag-chunking-first/ Sun, 26 Apr 2026 06:00:00 GMT EUCALEX AI The chunk is the unit of evidence your retrieval system works with. If that unit is incoherent, retrieval quality collapses quietly, and every component downstream spends its time compensating. 3 https://eucalex.com/news/mqtt-sparkplug-plant-data/ https://eucalex.com/news/mqtt-sparkplug-plant-data/ Sat, 11 Apr 2026 06:00:00 GMT EUCALEX Digital Transformation MQTT moves plant data cheaply and Sparkplug gives it a shape, but neither keeps a record. What the three QoS levels really promise, what birth and death certificates tell an operator, where the timestamp is taken, and why the broker is a system to qualify, not plumbing. 12 https://eucalex.com/news/oee-on-a-gmp-line/ https://eucalex.com/news/oee-on-a-gmp-line/ Fri, 03 Apr 2026 06:00:00 GMT EUCALEX Pharmaceutical Industry Line clearance, changeovers, challenge tests and reconciliation all sit inside the OEE clock of a pharmaceutical packaging line, and where you book them decides the number. How to define the losses honestly, why a reject is not scrap, and why the OEE count must agree with the batch record. 13 https://eucalex.com/news/tech-transfer-recipe-handoff/ https://eucalex.com/news/tech-transfer-recipe-handoff/ Thu, 26 Mar 2026 07:00:00 GMT EUCALEX Pharmaceutical Industry Between the development report and the first engineering batch, a process is still copied by hand more often than anyone admits. What ICH Q10, ICH Q12, EU GMP and the ISA-88 recipe levels expect from the handoff, where parameters get lost, and a check to run before the first batch. 12 https://eucalex.com/news/enisa-guidance-read-it-anyway/ https://eucalex.com/news/enisa-guidance-read-it-anyway/ Mon, 23 Mar 2026 07:00:00 GMT EUCALEX Cybersecurity It is written for cloud and digital providers, and it is not binding. It is also the clearest published answer to the question every NIS2 programme eventually hits: what will they actually ask to see? 7 https://eucalex.com/news/digital-twin-what-it-proves/ https://eucalex.com/news/digital-twin-what-it-proves/ Mon, 23 Mar 2026 07:00:00 GMT EUCALEX Digital Transformation A model, a simulation, a dashboard and a digital twin are four different things sold under one name. What the standards actually define, the three things a twin needs, where it earns its place on a GMP site, and how much evidence a model needs before it is allowed to decide anything. 13 https://eucalex.com/news/challenge-testing-detectors/ https://eucalex.com/news/challenge-testing-detectors/ Sun, 22 Mar 2026 07:00:00 GMT EUCALEX Quality & System Qualification A detector that has failed looks exactly like a detector with nothing to detect. The only proof is to make it fail on purpose: which defects to provoke, how often, what must happen next, and how to make sure the test unit never escapes into the batch. 12 https://eucalex.com/news/siemens-networks-ppi-to-profinet/ https://eucalex.com/news/siemens-networks-ppi-to-profinet/ Fri, 20 Mar 2026 07:00:00 GMT EUCALEX Automation & Technology An older plant often runs four Siemens networks at once: a PPI or MPI programming link, PROFIBUS to drives and remote I/O, a Modbus device behind a gateway, and PROFINET on the newest machine. What each one is, its real limits, and what to document before it fails. 9 https://eucalex.com/news/blockchain-data-integrity-pharma/ https://eucalex.com/news/blockchain-data-integrity-pharma/ Fri, 20 Mar 2026 07:00:00 GMT EUCALEX Data Integrity Anchoring batch records in a blockchain was sold as the end of altered data. The mechanism is sound; the promise was too big. What a ledger proves, what it never could, the two use cases that survive, cheaper routes to the same evidence, and seven questions before you buy. 13 https://eucalex.com/news/biologics-process-automation/ https://eucalex.com/news/biologics-process-automation/ Thu, 19 Mar 2026 07:00:00 GMT EUCALEX Pharmaceutical Industry Biologics plants are moving from vendor skids that each keep their own recipe and their own clock to connected, partly continuous trains. What ISA-88, PAT, ICH Q13 and single-use change for a GMP site, and eight lines to write into the specification before the first run. 13 https://eucalex.com/news/plc-signal-recording/ https://eucalex.com/news/plc-signal-recording/ Wed, 18 Mar 2026 07:00:00 GMT EUCALEX Automation & Technology A PC-based signal analyser can show the fault nobody sees on the HMI. It can also write into the controller, open a remote path into the cell and produce records nobody validated. The four ways to watch a running PLC, the numbers that limit them, and what to settle first. 11 https://eucalex.com/news/v-model-computerised-system/ https://eucalex.com/news/v-model-computerised-system/ Wed, 04 Mar 2026 07:00:00 GMT EUCALEX Quality & System Qualification IT runs SIT and UAT. Quality runs IQ, OQ and PQ. The supplier runs FAT and SAT. One redrawn V shows that all three describe the same proof, and where the risk assessment, the three environments and the traceability links belong. 13 https://eucalex.com/news/famous-attacks-are-not-the-number/ https://eucalex.com/news/famous-attacks-are-not-the-number/ Mon, 02 Mar 2026 07:00:00 GMT EUCALEX Cybersecurity Every awareness deck shows the same two dozen incidents across twenty-five years. In 2025 alone, ransomware hit 3,300 industrial organisations. 6 https://eucalex.com/news/risk-analysis-to-test-plan/ https://eucalex.com/news/risk-analysis-to-test-plan/ Sat, 28 Feb 2026 07:00:00 GMT EUCALEX Quality & System Qualification A risk analysis earns its place only when every line ends in a named control, and, where the equipment carries that control, in a named qualification test that blocks the next step. How to build the chain, score without fooling yourself, and see why most risks are controlled outside qualification. 12 https://eucalex.com/news/change-control-requalification/ https://eucalex.com/news/change-control-requalification/ Wed, 25 Feb 2026 07:00:00 GMT EUCALEX Quality & System Qualification A qualification report describes a machine on the day it was signed. Every repair, spare part and program edit after that day either keeps the description true or quietly breaks it. Four questions tell you which, before the work order is released. 10 https://eucalex.com/news/one-line-forty-regulations/ https://eucalex.com/news/one-line-forty-regulations/ Sun, 22 Feb 2026 07:00:00 GMT EUCALEX Pharmaceutical Industry More than forty countries legislated track and trace, and they did not agree on what it means. That divergence is a line design decision, not a paperwork problem. 4 https://eucalex.com/news/mes-when-it-goes-down/ https://eucalex.com/news/mes-when-it-goes-down/ Sat, 14 Feb 2026 07:00:00 GMT EUCALEX Automation & Technology The controllers keep running when the MES stops; the batch record does not. How to size an MES for failure on a GMP site: three numbers to fix first, the architectures that survive what, store-and-forward at the line, a controlled paper fallback, and the tests that prove all of it. 13 https://eucalex.com/news/packaging-line-pq/ https://eucalex.com/news/packaging-line-pq/ Fri, 06 Feb 2026 07:00:00 GMT EUCALEX Quality & System Qualification Installation and operational qualification prove each machine. The performance qualification proves the whole line, with real product and real components. How to build the reinforced sampling plan, classify defects, react to a critical one, and read a failed run correctly. 12 https://eucalex.com/news/gamp5-second-edition/ https://eucalex.com/news/gamp5-second-edition/ Tue, 03 Feb 2026 07:00:00 GMT EUCALEX Quality & System Qualification What GAMP 5 is and is not, what a computerised system is made of, how the software and hardware categories scale the effort, and what the 2022 second edition changed: critical thinking, suppliers and cloud, iterative delivery, tools and AI. 13 https://eucalex.com/news/historian-data-in-the-cloud/ https://eucalex.com/news/historian-data-in-the-cloud/ Tue, 13 Jan 2026 07:00:00 GMT EUCALEX Data Integrity Sending historian data to cloud analytics is now an ordinary project. On a GMP site it is also a data integrity question: which copy is the original, which is a true copy, and which decisions may rest on a curve drawn in the cloud. 12 https://eucalex.com/news/data-integrity-by-design/ https://eucalex.com/news/data-integrity-by-design/ Mon, 29 Dec 2025 07:00:00 GMT EUCALEX Data Integrity Many data integrity gaps are designed in: a transcription step, a local folder, a shared login, a clock nobody synchronised. How to map the data flow, classify what matters, remove risks with technical controls first and plan the data’s whole life, before the system is bought. 11 https://eucalex.com/news/part-11-scope-predicate-rules/ https://eucalex.com/news/part-11-scope-predicate-rules/ Sun, 28 Dec 2025 07:00:00 GMT EUCALEX Data Integrity “Is this system Part 11?” is the wrong question. Part 11 follows the record, not the system. Four questions, starting from the Part 211 requirement, tell you which records in your MES, LIMS, historian or maintenance system it covers, and where Part 211 already speaks about computers. 12 https://eucalex.com/news/nis2-what-it-actually-demands/ https://eucalex.com/news/nis2-what-it-actually-demands/ Sat, 27 Dec 2025 07:00:00 GMT EUCALEX Cybersecurity Not a checklist. A demonstrable risk-management programme, owned by management, with a reporting deadline that runs at night and during shutdowns. 10 https://eucalex.com/news/security-protection-scheme/ https://eucalex.com/news/security-protection-scheme/ Wed, 24 Dec 2025 07:00:00 GMT EUCALEX Cybersecurity The newest part of the 62443 series asks a question most periodic reviews skip: the zone was designed to a security level, but what level does it actually hold today? What the security protection scheme is, and how a GMP site can use it. 11 https://eucalex.com/news/stakes-of-pharma-digitalisation/ https://eucalex.com/news/stakes-of-pharma-digitalisation/ Tue, 23 Dec 2025 07:00:00 GMT EUCALEX Digital Transformation Forty years from laboratory databases to AI-assisted discovery, and the four stakes that decide whether a digitalisation programme in this sector pays for itself: cost, patient outcome, regulatory defensibility and the integrity of the data underneath all three. 10 https://eucalex.com/news/ot-safety-or-security/ https://eucalex.com/news/ot-safety-or-security/ Thu, 18 Dec 2025 07:00:00 GMT EUCALEX Cybersecurity Safety protects against what fails by accident. Security protects against what is done on purpose. On an industrial site the two meet in one place, the safety instrumented system, and that is exactly where mixing them up does the most damage. 11 https://eucalex.com/news/opc-servers-classic-to-ua/ https://eucalex.com/news/opc-servers-classic-to-ua/ Fri, 28 Nov 2025 07:00:00 GMT EUCALEX Digital Transformation Most plant data reaches SCADA, historians and spreadsheets through an OPC server. What that server does, why OPC Classic broke when Windows hardened DCOM, what OPC UA changes, what an S7 CPU must open to be read, and where the chain stops being trustworthy. 8 https://eucalex.com/news/breaking-down-data-silos/ https://eucalex.com/news/breaking-down-data-silos/ Sun, 23 Nov 2025 07:00:00 GMT EUCALEX Digital Transformation ERP, MES, LIMS, historian and quality systems each hold part of the truth about a batch. The five things data integration must deliver on an industrial site (access, one picture, decisions, security and shared ownership) with the patterns, checks and pitfalls for each. 14 https://eucalex.com/news/inside-the-data-matrix/ https://eucalex.com/news/inside-the-data-matrix/ Sat, 01 Nov 2025 07:00:00 GMT EUCALEX Pharmaceutical Industry Four fields, one separator character, and a print-quality grade that quietly decides your reject rate. 5 https://eucalex.com/news/serialisation-and-aggregation/ https://eucalex.com/news/serialisation-and-aggregation/ Thu, 23 Oct 2025 06:00:00 GMT EUCALEX Pharmaceutical Industry Plain barcode, then Data Matrix, then serialisation, then aggregation. The words get used interchangeably on site, and they are not the same thing at all. 4 https://eucalex.com/news/cybersecurity-becoming-legal-obligation/ https://eucalex.com/news/cybersecurity-becoming-legal-obligation/ Sun, 12 Oct 2025 06:00:00 GMT EUCALEX Cybersecurity NIS2 in Europe, tightening rules in Switzerland, China and Japan, a revised Annex 11 on the way. The point is not the list. It is the direction. 6 https://eucalex.com/news/ai-in-pharma-what-it-must-prove/ https://eucalex.com/news/ai-in-pharma-what-it-must-prove/ Sat, 11 Oct 2025 06:00:00 GMT EUCALEX AI Six places AI sits on a pharmaceutical chain, with an honest maturity marker for each; six examples that circulate, checked; what the clinical evidence says about models meeting new data; the proof a model needs before it touches a GMP decision; and which text applies first. 14 https://eucalex.com/news/open-source-inside-the-hmi/ https://eucalex.com/news/open-source-inside-the-hmi/ Wed, 08 Oct 2025 06:00:00 GMT EUCALEX Cybersecurity Operator panels, gateways and SCADA packages are built from open-source components the site never chose. The ten OWASP open-source risks read for a regulated plant: what an SBOM is worth, what the CRA will require of suppliers, and why a patch is a change like any other. 13 https://eucalex.com/news/ot-network-architecture-levels/ https://eucalex.com/news/ot-network-architecture-levels/ Mon, 06 Oct 2025 06:00:00 GMT EUCALEX Automation & Technology Three network architecture levels for industrial sites: what each one doubles, what it survives, how it is secured, what it costs, and when to choose it. 15 https://eucalex.com/news/industrial-switches-ot-network/ https://eucalex.com/news/industrial-switches-ot-network/ Wed, 01 Oct 2025 06:00:00 GMT EUCALEX Automation & Technology Not every switch on a plant needs to be industrial, and an industrial switch does not make a network reliable on its own. What the hardware actually buys, what ring redundancy really gives you, what each industrial protocol needs, and eight lines to put in the specification. 10 https://eucalex.com/news/physical-and-logical-segregation/ https://eucalex.com/news/physical-and-logical-segregation/ Sun, 28 Sep 2025 06:00:00 GMT EUCALEX Cybersecurity Which switch an asset plugs into and which security zone it belongs to are two different decisions, taken for two different reasons. One decides what stops when the infrastructure fails or has to be maintained; the other decides how far a compromise can spread. Maintenance boundaries, twelve criteria for drawing the zones, and why more zones is not more security. 13 https://eucalex.com/news/right-words-vlan-zone/ https://eucalex.com/news/right-words-vlan-zone/ Sat, 27 Sep 2025 06:00:00 GMT EUCALEX Cybersecurity Four words that get used as synonyms in meetings. The actual protection level of an industrial network depends on which one you really have. 19 https://eucalex.com/news/purdue-isa95-iec62443-framework/ https://eucalex.com/news/purdue-isa95-iec62443-framework/ Sat, 27 Sep 2025 06:00:00 GMT EUCALEX Cybersecurity The final article in the series. Three standards that do three different jobs (a structure for the plant, a grammar for integration, a method for security) plus the zone and VLAN configuration rules, and an honest note on where level 1 and level 2 actually merge. 9 https://eucalex.com/news/ot-terminology-before-technology/ https://eucalex.com/news/ot-terminology-before-technology/ Fri, 26 Sep 2025 06:00:00 GMT EUCALEX Cybersecurity A word used loosely does not stay a language problem: under NIS 2 it can start a 24-hour clock, under the GDPR a 72-hour one. How to build a terminology reference on the definitions that already exist, what to do when none of them covers your term, and how to make every other document point back to it instead of redefining it. 15 https://eucalex.com/news/digital-environmental-account/ https://eucalex.com/news/digital-environmental-account/ Fri, 26 Sep 2025 06:00:00 GMT EUCALEX Others E-waste, greenhouse gases, rare minerals and server rooms built three times larger than they needed to be. Most headline figures in the original text have moved since it was written, and almost all of them in the wrong direction. 7 https://eucalex.com/news/wireless-instruments-gateway/ https://eucalex.com/news/wireless-instruments-gateway/ Tue, 16 Sep 2025 06:00:00 GMT EUCALEX Automation & Technology Wireless transmitters are mature. The real decision is which readings may depend on a radio, and how the gateway, the join keys and the GMP record are kept under control. 13 https://eucalex.com/news/human-at-the-centre/ https://eucalex.com/news/human-at-the-centre/ Fri, 22 Aug 2025 06:00:00 GMT EUCALEX Digital Transformation Industrial digitalisation looks like the opposite of human interaction and is entirely dependent on it. Why a human-centred strategy has to start at design rather than at deployment, and why cross-training IT on OT and OT on IT is the cheapest intervention available. 5 https://eucalex.com/news/cybersecurity-is-part-of-safety/ https://eucalex.com/news/cybersecurity-is-part-of-safety/ Mon, 18 Aug 2025 06:00:00 GMT EUCALEX Cybersecurity A relief valve has no password. A safety PLC does. Once a computer holds the safety limit, security stops being an IT topic. 4 https://eucalex.com/news/electronic-signatures-inspector/ https://eucalex.com/news/electronic-signatures-inspector/ Wed, 30 Jul 2025 06:00:00 GMT EUCALEX Data Integrity Three elements on the screen and on every printout, a link that cannot be cut, two components, and a session rule that most systems get wrong by default. What to configure in an MES, a LIMS or an eQMS, and the OQ tests that catch the real failures. 12 https://eucalex.com/news/legacy-plc-shielding/ https://eucalex.com/news/legacy-plc-shielding/ Mon, 14 Jul 2025 06:00:00 GMT EUCALEX Cybersecurity The controller cannot authenticate, cannot be patched and runs a process worth more than the project that would replace it. That is not a dead end. It is a documented compensating control. 3 https://eucalex.com/news/one-usb-key-instead-of-fifteen/ https://eucalex.com/news/one-usb-key-instead-of-fifteen/ Fri, 04 Jul 2025 06:00:00 GMT EUCALEX Cybersecurity A multiboot key replaces the whole case of bootable drives. It is also the single most dangerous object in your bag once it goes near production. 4 https://eucalex.com/news/organisational-models-convergence/ https://eucalex.com/news/organisational-models-convergence/ Wed, 02 Jul 2025 06:00:00 GMT EUCALEX Digital Transformation Incremental reorganisation along four axes, or strategic transformation against organisational inertia. Two academic models that are more useful on an industrial site than they sound, plus nine things IT and OT managers have to get right between them. 6 https://eucalex.com/news/pharma-why-it-is-strategic/ https://eucalex.com/news/pharma-why-it-is-strategic/ Tue, 01 Jul 2025 06:00:00 GMT EUCALEX Pharmaceutical Industry From Watson and Crick to COVID-19 and the post-pandemic scramble for supply-chain control: what the history of the pharmaceutical industry tells us about why its factories are now treated as critical infrastructure. 5 https://eucalex.com/news/convergence-expected-benefits/ https://eucalex.com/news/convergence-expected-benefits/ Tue, 01 Jul 2025 06:00:00 GMT EUCALEX Digital Transformation Compliance, profitability, digital continuity, security, business development and attractiveness. The Cigref list is sound, but each benefit has a precondition, and the projects that disappoint are the ones that skipped it. 4 https://eucalex.com/news/digital-maturity-assessment/ https://eucalex.com/news/digital-maturity-assessment/ Mon, 30 Jun 2025 06:00:00 GMT EUCALEX Digital Transformation Five levels from the BioPhorum Digital Plant Maturity Model, seven phases of assessment, and the reason level 1 and 2 plants cannot skip straight to predictive analytics however good the business case looks. 5 https://eucalex.com/news/convergence-implementation-steps/ https://eucalex.com/news/convergence-implementation-steps/ Sun, 29 Jun 2025 06:00:00 GMT EUCALEX Digital Transformation The Cigref working group's conclusion was that no single organisational model exists. That is not an excuse to improvise: the eleven steps it identified are a sequence, and the order in which you take them decides whether the programme survives its first year. 4 https://eucalex.com/news/convergence-challenges/ https://eucalex.com/news/convergence-challenges/ Mon, 23 Jun 2025 06:00:00 GMT EUCALEX Digital Transformation Governance and culture, incompatible technology, and a regulatory landscape that overlaps in some places and has gaps in others. A survey of what actually goes wrong, including why Active Directory integration for OT so often ends in two separate domains. 6 https://eucalex.com/news/vendor-remote-access/ https://eucalex.com/news/vendor-remote-access/ Sun, 22 Jun 2025 06:00:00 GMT EUCALEX Cybersecurity The machine builder needs to see the PLC on Tuesday. The choice is not between “VPN straight in” and “fly someone over”: the middle path is unexciting, documented and reusable. 2 https://eucalex.com/news/air-gap-is-over/ https://eucalex.com/news/air-gap-is-over/ Fri, 13 Jun 2025 06:00:00 GMT EUCALEX Cybersecurity The assumption that OT is safe because it is separate has not been true for years. What replaces it is not a better wall but a different discipline, and shadow OT is the evidence that the old model already failed. 5 https://eucalex.com/news/words-have-consequences/ https://eucalex.com/news/words-have-consequences/ Fri, 06 Jun 2025 06:00:00 GMT EUCALEX Cybersecurity It looks like a vocabulary slide. It is a liability slide. Escalating a word is easy; walking it back is not. 6 https://eucalex.com/news/mtp-modular-skids-gmp/ https://eucalex.com/news/mtp-modular-skids-gmp/ Tue, 27 May 2025 06:00:00 GMT EUCALEX Pharmaceutical Industry A Module Type Package lets a skid describe its services, data and screens to the plant’s control layer. What that saves a GMP site, and what it must still test. 10 https://eucalex.com/news/backup-restore-test/ https://eucalex.com/news/backup-restore-test/ Fri, 23 May 2025 06:00:00 GMT EUCALEX Cybersecurity A NAS, an office PC, a critical workstation and a database do not need the same backup, and neither does a system being built, running or modified. The backup types, what each copies and restores, and how to choose them system by system and stage by stage. 20 https://eucalex.com/news/ai-that-survives-quality/ https://eucalex.com/news/ai-that-survives-quality/ Fri, 23 May 2025 06:00:00 GMT EUCALEX AI Most industrial AI pilots die in the quality department, not in the model. The ones that live share one trait: they inform a human decision instead of replacing a controlled one. 1 https://eucalex.com/news/mes-shop-floor-interface/ https://eucalex.com/news/mes-shop-floor-interface/ Sun, 18 May 2025 06:00:00 GMT EUCALEX Automation & Technology The software was selected in nine months. The integration with twelve machines from six vendors was scoped in an afternoon. Guess which one the schedule slips on. 2 https://eucalex.com/news/ups-signal-nobody-wires/ https://eucalex.com/news/ups-signal-nobody-wires/ Mon, 12 May 2025 06:00:00 GMT EUCALEX Automation & Technology On a lot of sites (including brand-new ones) the UPS is present, wired and green. And it still does not do half of what it was bought for. 5 https://eucalex.com/news/ot-incident-response-plan/ https://eucalex.com/news/ot-incident-response-plan/ Wed, 07 May 2025 06:00:00 GMT EUCALEX Cybersecurity An OT incident plan is mostly decisions taken in advance: which response each area allows, who may order it at night, and how the batch is judged afterwards. 12 https://eucalex.com/news/serialisation-six-levels/ https://eucalex.com/news/serialisation-six-levels/ Fri, 02 May 2025 06:00:00 GMT EUCALEX Pharmaceutical Industry Everyone talks about the printer and the camera. The project succeeds or fails two levels above them, at an interface nobody owns. 5 https://eucalex.com/news/securing-ot-five-steps/ https://eucalex.com/news/securing-ot-five-steps/ Sun, 27 Apr 2025 06:00:00 GMT EUCALEX Cybersecurity Five steps, a common vocabulary, and one property that decides everything: it never finishes. 6 https://eucalex.com/news/sans-five-critical-controls/ https://eucalex.com/news/sans-five-critical-controls/ Mon, 21 Apr 2025 06:00:00 GMT EUCALEX Cybersecurity Not another framework to comply with. A prioritisation, derived from analysing actual industrial attacks, in which the first control decides what the other four have to do. 9 https://eucalex.com/news/reliable-data-smarter-ai/ https://eucalex.com/news/reliable-data-smarter-ai/ Mon, 21 Apr 2025 06:00:00 GMT EUCALEX AI In cybersecurity and industrial digital transformation, accuracy is not a preference. Retrieval-augmented generation is how you keep an assistant on reliable, controlled ground. 3 https://eucalex.com/news/fat-sat-supplier-evidence/ https://eucalex.com/news/fat-sat-supplier-evidence/ Fri, 18 Apr 2025 06:00:00 GMT EUCALEX Quality & System Qualification Factory and site acceptance tests are the supplier’s tests, on the supplier’s terms, unless you shape them first. When Annex 15 lets you reuse them in IQ and OQ, what a supplier qualification package is really worth, and the clauses to put in the order. 12 https://eucalex.com/news/removable-media-under-control/ https://eucalex.com/news/removable-media-under-control/ Wed, 16 Apr 2025 06:00:00 GMT EUCALEX Cybersecurity A removable drive is the fastest route into an OT system, because it goes around every control you installed. Banning it produces workarounds; controlling it produces a record. 4 https://eucalex.com/news/control-charts-ongoing-verification/ https://eucalex.com/news/control-charts-ongoing-verification/ Fri, 11 Apr 2025 06:00:00 GMT EUCALEX Quality & System Qualification Every batch passed, and the process still drifted. What FDA Stage 3 and EU GMP Annex 15 actually ask of continued process verification, which chart fits which data, why control limits are not specifications, and how to keep the charted data trustworthy. 13 https://eucalex.com/news/it-and-ot-two-worlds/ https://eucalex.com/news/it-and-ot-two-worlds/ Wed, 09 Apr 2025 06:00:00 GMT EUCALEX Cybersecurity IT security recipes cannot simply be copied onto production. OT people are not being difficult: the priorities, the patch cycles and the lifetimes on a plant are genuinely different, and the security has to follow. 4 https://eucalex.com/news/article-21-measure-by-measure/ https://eucalex.com/news/article-21-measure-by-measure/ Fri, 04 Apr 2025 06:00:00 GMT EUCALEX Cybersecurity Ten measures, written for every sector at once. Here is what each one turns into on an industrial site, and the evidence that survives an inspection. 10 https://eucalex.com/news/nis2-iec62443/ https://eucalex.com/news/nis2-iec62443/ Mon, 31 Mar 2025 06:00:00 GMT EUCALEX Cybersecurity One is a directive written by lawyers for boards. The other is a standard written by engineers for control systems. Mapping one onto the other is most of the compliance work. 2 https://eucalex.com/news/alarm-load-gmp-operator/ https://eucalex.com/news/alarm-load-gmp-operator/ Sun, 30 Mar 2025 07:00:00 GMT EUCALEX Automation & Technology An alarm system is judged by one person, at night, in the first minutes of an upset. What counts as an alarm on a GMP site, what ISA-18.2, IEC 62682 and EEMUA 191 expect, how to rationalise with senior operators, train the response and measure the load. 12 https://eucalex.com/news/one-programme-many-sites/ https://eucalex.com/news/one-programme-many-sites/ Sat, 29 Mar 2025 07:00:00 GMT EUCALEX Data Integrity The same SOP, the same system and the same training deck produce different records in different plants. What PIC/S, MHRA, WHO and EU GMP say about open and closed cultures, why a quiet site is not a clean one, and how to adapt a group rollout without weakening the requirement. 13 https://eucalex.com/news/when-the-workaround-becomes-normal/ https://eucalex.com/news/when-the-workaround-becomes-normal/ Fri, 28 Mar 2025 07:00:00 GMT EUCALEX Quality & System Qualification Nobody decides to accept a bypassed interlock or a deviation that keeps coming back; teams drift there one reasonable step at a time. How it shows up on a GMP site, what EU GMP and ICH Q10 ask about human error and CAPA, and how to see it first. 13 https://eucalex.com/news/when-a-standard-lands/ https://eucalex.com/news/when-a-standard-lands/ Fri, 28 Mar 2025 07:00:00 GMT EUCALEX Cybersecurity A group directive arrives, aligned with ISA/IEC 62443, and the site team reacts the way people react to bad news. The five reactions you will hear, what lies behind each one, and what a site lead can do to move an automation team from “we are different” to “show us how”. 12 https://eucalex.com/news/why-industrial-sites/ https://eucalex.com/news/why-industrial-sites/ Wed, 26 Mar 2025 07:00:00 GMT EUCALEX Cybersecurity Two reasons, and they call for different defences. One attacker wants your money this week. The other wants to be inside when it matters. 4 https://eucalex.com/news/review-by-exception-people/ https://eucalex.com/news/review-by-exception-people/ Tue, 25 Mar 2025 07:00:00 GMT EUCALEX Pharmaceutical Industry Review by exception turns batch review from reading hundreds of pages into judging a short list. What changes for operators, QA reviewers and the Qualified Person, why EU GMP has no auto-release, and what must be validated before an empty exception list can be trusted. 12 https://eucalex.com/news/what-serialisation-can-reach/ https://eucalex.com/news/what-serialisation-can-reach/ Mon, 24 Mar 2025 07:00:00 GMT EUCALEX Pharmaceutical Industry The unique identifier protects the legal supply chain. A large share of the falsified medicine problem has never been inside it. 3 https://eucalex.com/news/from-molecule-to-batch-release/ https://eucalex.com/news/from-molecule-to-batch-release/ Fri, 14 Mar 2025 07:00:00 GMT EUCALEX Pharmaceutical Industry A walk through drug development and manufacture (preclinical, three clinical phases, marketing authorisation, then granulation, compression, sterile fill and packaging) with the computerised system that sits on each step and the record it has to produce. 6 https://eucalex.com/news/metadata-makes-the-number/ https://eucalex.com/news/metadata-makes-the-number/ Mon, 10 Mar 2025 07:00:00 GMT EUCALEX Data Integrity A value of 23 means nothing until you know its unit, its source, its time and who produced it. Where metadata is lost between instrument and report, why ALCOA+ is really a list of metadata requirements, and the tests that catch the gaps. 13 https://eucalex.com/news/bsi-cs-108-remote-maintenance/ https://eucalex.com/news/bsi-cs-108-remote-maintenance/ Wed, 05 Mar 2025 07:00:00 GMT EUCALEX Cybersecurity Three pages from the German federal office, and they are more specific than most vendor architectures. Outbound only, one machine at a time, a window the operator opens, and logs the maintainer cannot touch. 9 https://eucalex.com/news/remote-access-legitimate-tool/ https://eucalex.com/news/remote-access-legitimate-tool/ Sun, 23 Feb 2025 07:00:00 GMT EUCALEX Cybersecurity Signed, expected, often excluded from inspection, and encrypted past the firewall. Five agencies wrote the guide; the part industry needs is what it means for the integrator’s tool on your line. 8 https://eucalex.com/news/emvs-nmvs-how-it-works/ https://eucalex.com/news/emvs-nmvs-how-it-works/ Mon, 17 Feb 2025 07:00:00 GMT EUCALEX Pharmaceutical Industry The European system is not a track and trace system. Knowing the difference changes what you should expect it to tell you. 4 https://eucalex.com/news/data-integrity-inspections/ https://eucalex.com/news/data-integrity-inspections/ Sun, 09 Feb 2025 07:00:00 GMT EUCALEX Data Integrity Shared logins, audit trails switched off, failing results quietly deleted. Year after year, inspectors keep writing the same observations, and almost none of them describe a bug. 4 https://eucalex.com/news/degraded-mode-oq-power-air/ https://eucalex.com/news/degraded-mode-oq-power-air/ Fri, 07 Feb 2025 07:00:00 GMT EUCALEX Quality & System Qualification Operational qualifications test the normal path well and the failure path badly. What to observe when electrical power and compressed air are lost (and when they come back) with the acceptance criteria that most protocol templates leave blank. 11 https://eucalex.com/news/backup-is-a-hypothesis/ https://eucalex.com/news/backup-is-a-hypothesis/ Sat, 25 Jan 2025 07:00:00 GMT EUCALEX Cybersecurity “We have backups” is not an answer. The question is when you last restored one, how long it took, and whether the line ran afterwards. 7 https://eucalex.com/news/two-firewall-vendors-ot/ https://eucalex.com/news/two-firewall-vendors-ot/ Sat, 11 Jan 2025 07:00:00 GMT EUCALEX Cybersecurity A second firewall brand between the office and the plant protects against one vendor’s flaw. It also doubles the rule bases, the patches and the skills. When it pays, where it must sit, and how a GMP site keeps both sides consistent and documented. 13 https://eucalex.com/news/zones-conduits-start/ https://eucalex.com/news/zones-conduits-start/ Thu, 09 Jan 2025 07:00:00 GMT EUCALEX Cybersecurity The most common segmentation mistake is to design the network first and reverse-engineer the justification. It produces a beautiful diagram that protects nothing in particular. 3 https://eucalex.com/news/part-11-on-one-page/ https://eucalex.com/news/part-11-on-one-page/ Mon, 06 Jan 2025 07:00:00 GMT EUCALEX Data Integrity Three subparts, ten sections, one page. What the rule actually says (trustworthy, reliable, equivalent; authenticity, integrity, confidentiality only when appropriate), and eight claims about it that circulate widely and do not survive the text. 11 https://eucalex.com/news/urs-that-drives-qualification/ https://eucalex.com/news/urs-that-drives-qualification/ Fri, 03 Jan 2025 07:00:00 GMT EUCALEX Quality & System Qualification A user requirements specification is either the root of every test that follows or a wish list nobody can test. How to write it one line at a time (ID, class, GxP flag, how it will be verified), and how to decide whether a purchase needs a full, a light or no separate design qualification. 12 https://eucalex.com/news/air-gap-decays/ https://eucalex.com/news/air-gap-decays/ Thu, 02 Jan 2025 07:00:00 GMT EUCALEX Cybersecurity Isolated does not mean safe. Four things cross the gap on every site, and none of them requires sophisticated malware. 4 https://eucalex.com/news/test-depth-traceability-matrix/ https://eucalex.com/news/test-depth-traceability-matrix/ Wed, 01 Jan 2025 07:00:00 GMT EUCALEX Quality & System Qualification Test scripts multiply until nobody can say what they prove. Three rules bring them back under control: qualify only the functions you use, set the depth of each test by what happens if that function fails, and keep a matrix that shows (requirement by requirement) where every risk was tested and by whom. 11 https://eucalex.com/news/dq-iq-oq-pq-what-each-proves/ https://eucalex.com/news/dq-iq-oq-pq-what-each-proves/ Wed, 01 Jan 2025 07:00:00 GMT EUCALEX Quality & System Qualification From the quality concept and the URS to the PQ, one question per stage. A plain reference for the engineers and technicians who sign qualification documents: what each stage must prove, the evidence that counts, where the supplier’s FAT and SAT fit, and the gate that opens the next stage. 14