Data That Exists but Can't Travel
This autumn, manufacturers selling into Europe and the United States are learning how poorly their data travels. In mid-September two EU rules began requiring connected-product makers to flag exploited security flaws within 24 hours and to design new products so users can reach their data by default. Washington's tariffs now turn partly on where a machine's steel was melted. An operations director asked where that information sits today will probably point at two or three systems and a spreadsheet on somebody's desktop.
Put through a standard PESTLE review, these demands would land in six separate boxes, each owned by a different department. Filed that way, the overlap vanishes from view. Under each letter sits the same job of moving one fact (a melt location, say, or a fault log) out of the system that holds it and over to whoever needs it, usually by yesterday.
Even a plain customer order changes shape several times before it ships. On the line it's just a target count on a screen. By the end of the shift it has turned into output and scrap numbers, and somebody has to square them with the ERP schedule, often by hand, before the shift report can go out. Each of those handoffs is a place where the fact can stall.
The order below is a judgment call about how long a plant can safely put each pressure off. Law goes first, since two of its deadlines have already passed.
Brussels Wants Machine Data to Move
Since September 2025, Europe's Data Act has given any business that owns or leases connected equipment a right to the data its industrial machinery generates, at no charge. A second phase began on September 12 this year.
Any connected product put on the EU market after that date has to be designed so whoever uses it can get at its data by default. The data has to come in a structured, machine-readable format, and straight off the device where that's technically feasible.
Released data still has to land somewhere useful inside the plant. If a press brake starts logging rising vibration on its hydraulic pump, the maintenance planner learns nothing until those readings get into the work-order system. Plenty of plants still move that data on a technician's laptop, sometimes via a USB stick.
Seen from the shop floor, the Data Act is really an argument about manufacturing system integrations, the connections that carry a machine's readings into ERP and maintenance software. With those connections in place, a plant can put the new right to work the week a machine arrives. Others may get only a download link.
Users can also direct the data holder to send machine data straight to a third party, such as an independent maintenance contractor. That option only pays off for a plant that's already decided which data it wants and where it should end up.
Before the next purchase order goes out, a plant can write data access into its equipment specifications, down to the file format and the system the readings should feed. That leaves a vendor far less room to argue after installation. For machines already on the floor, the first job is listing which ones count as connected products and which plant system should receive each one's data.
A 24-Hour Clock for Machine Builders
Machine builders got the harder deadline. The Cyber Resilience Act's 24-hour clock, running since September 11, starts when a maker learns that a flaw in one of its products is being actively exploited. Meeting that clock means knowing within hours which shipped machines run the affected firmware and who owns them, facts usually kept in engineering and service records nobody ever joined.
Only exploitation first spotted on or after September 11 has to be reported. Faegre Drinker's rundown of the September deadlines puts the maximum fine at €15 million or 2.5% of worldwide annual turnover, whichever is higher.
From December 2027 the regulation will also expect makers to keep a machine-readable software bill of materials covering at least each product's top-level components. That list becomes far more useful once it's joined to installed-base records showing which customer runs which version. A dry run of the 24-hour notice, built around a made-up flaw in a real component, tends to expose a missing join faster than most audits.
When the Office Network Stops the Line
Jaguar Land Rover showed last year what the second pressure, technology, can cost. After a cyberattack in late August 2025 forced the carmaker to shut its IT systems down, vehicle production at its major UK plants stopped for about five weeks. Limited production restarted on October 8. The Cyber Monitoring Centre later put the damage to the UK economy at about £1.9 billion, with more than 5,000 British organizations affected.
The damage spread down a supply base of nearly 1,000 tier-one suppliers, which faced canceled or delayed orders while JLR's systems stayed offline. Inside the plant gate, a line that waits for its schedule from ERP, or needs a label printed by an office server, will usually stop when the office network stops, however healthy its controllers are. The Centre's analysis drew the same lesson from Colonial Pipeline's 2021 shutdown.
Dependencies like these are cheap to map ahead of time. CISA and eight partner agencies already did some of the groundwork in 2025, when they published joint guidance on building an OT asset inventory. With one extra column, naming the office system each line can't run without, the inventory doubles as a dependency map.
A one-page version of that map would probably tell a plant manager more than most security dashboards do. Paper fallbacks belong on it too. A fallback for schedules and shipping labels that nobody has tested in a year may not work on the day the office network goes down.
Reviews of technological factors affecting business tend to treat cybersecurity as a way of keeping sensitive data safe. For a manufacturer, the bigger exposure is arguably data that stops moving.
Tariffs That Read the Bill of Materials
Politics supplies the third pressure, mostly through Washington's metals tariffs. Since April 6, Section 232 duties on many steel, aluminum and copper products have applied to an import's full customs value, with rates of up to 50% set by the annex that lists each product. A June proclamation added a 10% rate for capital equipment containing at least 85% US-origin steel or aluminum by weight, through the end of 2027.
Facts that many ERP setups were never asked to hold now decide those rates. A product's metal content by weight usually lives in engineering's bill of materials, while the melt location sits on a mill certificate somewhere in a supplier's files. Neither reaches the customs broker by itself. For many mid-sized plants the broker is an outside firm working from a commercial invoice that doesn't say where any metal was melted.
If customs later asks for proof of a low-metal or favorable-origin claim, the answer has to come from bills of materials and supplier certificates, assembled long after the goods have cleared. Foley & Lardner's analysis of the new derivative rules adds engineering specifications and test data to the records worth keeping ready. Errors caught after entry can often go through a post-summary correction, which tends to be less painful than defending them in an audit.
Trade policy has long sat among the political factors a PESTLE review tracks. Between April and August, the federal government took at least four separate actions on these metals. Any one of them could change which field in a bill of materials decides the duty.
In August the Commerce Department proposed adding 14 more derivative products to the list, fire extinguishers and several kinds of trailer among them. Recording each purchased part's metal share and melt-and-pour country in the item master, when the supplier certificate arrives, can turn the next proclamation into a database query.
The Spreadsheet Only One Person Understands
The fourth pressure clocks out at the end of every shift. In a lot of plants the most important integration is a person, typically a supervisor with fifteen or twenty years on site.
That supervisor types the line counts into a spreadsheet by hand and somehow knows which of several schedule versions floating around is the live one. Even when that works, the planner sees the numbers hours late, long after anyone could have done much about a bad run.
Then the supervisor retires. A new planner inherits the spreadsheet without the years of judgment that told the old one which columns to trust.
Hiring a replacement is its own problem. ManpowerGroup's 2026 survey of more than 6,000 US employers found that 75% of manufacturing firms had trouble finding the talent they need. A plant that short of skilled people can't afford to spend their hours carrying numbers between screens.
Shadowing the supervisor for a week and writing down every number copied by hand usually produces a short list of integrations nobody ever budgeted for. Capturing counts at the machine, instead of at the end of the shift, also gives the planner numbers while there's still time to use them.
Under PESTLE this counts as a social factor, yet the fix is mostly a matter of moving the supervisor's routine into software, where it survives the next retirement.
Carbon Data Arrives at the Customs Desk
Customs is also where the fifth pressure, environmental policy, catches up with manufacturers through Europe's Carbon Border Adjustment Mechanism. Its definitive phase began on January 1. Importers bringing in more than 50 metric tons a year of goods such as steel and aluminum now need authorized declarant status before they cross that line. From February 2027 they'll buy certificates for the emissions embedded in this year's imports.
An importer's certificate bill depends on emissions data from the foreign plant that made the steel. Without that plant's verified figures, the importer has to use default values, which can sit well above what a cleaner mill actually emits.
The verified emissions figure now has to travel alongside each shipment's paperwork, which many procurement systems were never built to carry. Outside Europe, mills and foundries see the problem from the other end, because the installation-level figures their EU customers now ask for often sit with an environmental manager, out of the sales team's reach.
Importers that request installation-level data now, with a named contact at each mill and a fixed format, are likely to have most of this year's numbers in hand before certificate sales open. Actual figures must also pass an accredited verifier, which takes time.
Buffer Stock Was Covering for Bad Data
The economic pressure ranks last because it works slowly. For years, buffer stock covered for bad data. A plant with three weeks of spare parts could absorb a late tariff ruling or a missing supplier certificate without anyone noticing, because the extra stock bought time for the paperwork to catch up.
September brought the first Fed rate increase since 2023. The central bank raised its benchmark rate by a quarter point, to a target range of 3.75% to 4%.
Since then, every pallet of safety stock has tied up cash that costs more to borrow, and imported metal parts sitting in a warehouse already carry duty paid on their full value. Finance teams will be tempted to trim that stock, and doing so before the data is fixed mostly moves the risk onto the production line.
Many buffers trace back to one specific data problem, like a supplier whose certificates always arrive a week late or a cycle counter nobody trusts. Once that problem is fixed, the pallets can go without the line feeling it.
An Afternoon With a Whiteboard
In the usual template for PESTLE analysis in strategic management, each factor gets a column of its own, so these six end up looking like six unrelated projects. A customs auditor and a ransomware crew don't care about the columns, though, and both tend to arrive with little warning.
A better version of that exercise takes an afternoon and a whiteboard. Since each owns a different stretch of the chain, operations, IT, finance and compliance all need to be in the room. Someone then writes up, factor by factor, the fact that has to move and the system it sits in now. Next to it goes a name, the person who actually carries that fact across.
Rows that end in a person's name, instead of a system connection, mark the likeliest places for the next fine or outage to begin. Those rows are probably where the first fixes belong.
There's probably a spreadsheet in most plants that would halt a line within days if the laptop it lives on died tonight. Could anyone in the building name that file? And which of the six pressures gets to it first?
