When the money comes from Europe, the rulebook travels with it
A North African plant, an EU sponsor, a non-EU bidder, and the EU rulebook that travels down the financing chain — opening an 18-part series for suppliers
4 min read
OEM EU Readiness
An eighteen-part series for manufacturers bidding into EU-financed renewable energy projects — what the lender's term sheet contains and why, translated into engineering, commercial and operational decisions
This series is written for non-European manufacturers bidding equipment into renewable energy projects whose financing chain reaches back into Europe — directly through EU lenders, indirectly through EU-headquartered project sponsors, or through international syndicates that adopt EU expectations as the operational baseline. The European regulatory stack on cybersecurity, supply chain transparency, data protection and product support travels down that chain as contractual requirement, regardless of where the plant is physically located.
The series is offered as an editorial translation rather than a legal brief. The substance is technical and procedural; the framing is procurement-stage decision-making; the perspective is that of a manufacturer who has not yet encountered these requirements in their home market and is meeting them for the first time on an EU-linked project.
Download the pack
The eighteen articles are available as a single downloadable pack in PDF and EPUB, in both languages. The PDF is the canonical artefact for printed or pinned reference; the EPUB is sized for phones and e-readers.
| Format | Language | Version | Size |
|---|---|---|---|
| English | 1.0.0 | 421 KB | |
| EPUB | English | 1.0.0 | 192 KB |
| Norsk (Bokmål) | 1.0.0 | 418 KB | |
| EPUB | Norsk (Bokmål) | 1.0.0 | 198 KB |
This release is citable in two ways: the concept DOI 10.5281/zenodo.20268559 always resolves to the latest version of the pack; the v1.0.0 version DOI 10.5281/zenodo.20268560 is frozen to this specific release. The pack is licensed CC BY 4.0 — attribute as: Khanikar, R. (2026). OEM EU Readiness (v1.0.0). https://doi.org/10.5281/zenodo.20268559
How to read this series
The seventeen substantive articles divide naturally into two arcs.
Parts 2 through 9 are about what to produce. They walk through the regulatory framework, the architectural decisions that follow from it (network ownership, substation boundary, remote access, out-of-band components), the L0/L1 system integrator role under IEC 62443, and the documentary artefacts the manufacturer must generate (vulnerability disclosure programme, software bill of materials).
Parts 10 through 18 are about how to operate. They address the continuous disciplines — cryptographic baseline, identity and access, patch delivery, logging and SIEM integration, cross-border data flow, sanctions and provenance, lifecycle support, personnel and insurance — and close with a procurement timeline matrix that maps every topic to the procurement gate at which the conversation belongs.
Most readers will dip in by topic. The matrix in the closing piece is the one artefact worth printing.
A note on jurisdictional handling
The series describes legal and operational frameworks rather than naming specific countries or specific manufacturers. The frameworks apply to non-EU equipment supply broadly — the procurement disciplines that work in a North African wind project work equally in a Middle Eastern solar project, a Central Asian battery project, or a Latin American hybrid renewable. Where particular non-EU jurisdictions affect the analysis — sanctions regimes, data-residency law, export-control thresholds — the analysis treats them by structure rather than by name.
Disclaimer
This series is offered as editorial guidance for technical and procurement audiences. It does not constitute legal, financial, regulatory, or professional advice; the author is not a lawyer, an auditor, or a financial adviser. The content is provided without warranty of any kind, express or implied — no guarantee of accuracy, completeness, currency, or fitness for any particular procurement, project, or jurisdiction. Readers must verify against the primary sources and consult qualified professionals before acting on anything in this series. EU regulations referenced are linked to their EUR-Lex ELI URLs, which are the canonical permalinks; texts may have been amended since the publication date of each article. The author accepts no responsibility or liability for any decision, action, or omission made in reliance on this content.
Companion reading
The series sits alongside a companion corpus on this site:
- The IEC 62443 cluster — six articles working through the standard from foundations through system design, management system, OEM-specific obligations under 62443-4-1/-4-2, NIS2 mapping, and a one-page evidence pack
- CRA applicability — a walk-through of whether and how the Cyber Resilience Act applies to a given product line
- NIS2 applicability — the entity-side equivalent for operators
The OEM EU Readiness series assumes a working familiarity with these frameworks but does not require it. Each substantive article cross-links to the relevant companion piece where the reader may want depth on the underlying regulation.
The series in order
The regulatory stack, in fifteen minutes
A 15-minute walk through five EU regulations and one framework that show up in every EU-financed renewable project — CRA, NIS2, GDPR, sustainable finance, Equator Principles
16 min read
The communication network is not yours to design
The plant network — its segmentation, addressing, redundancy and firewall rules — belongs to the operator, not the manufacturer. What to specify, what not to
9 min read
The substation is a foreign country
Where the wind or solar plant ends and the substation begins is where the manufacturer's design authority ends absolutely — and why
8 min read
Remote access, but not the kind you remember
Persistent VPN tunnels are a 2015 architecture. What replaces them in EU-financed projects — unidirectional telemetry out, brokered just-in-time access in
10 min read
Remove the cellular modem. Not disable — remove
Cellular modems, Bluetooth, hidden USB ports — disabling them in firmware is not adequate. The hardware must be physically absent
8 min read
What 'system integrator for L0/L1' actually means under 62443
What an OEM-as-system-integrator inherits under IEC 62443 — zone-and-conduit risk assessment, Target Security Levels, component capability mapping
12 min read
Email is not a vulnerability disclosure programme
The CRA requires a public coordinated vulnerability disclosure programme. A customer email list is not one. The minimum-viable PSIRT, in 4-6 weeks
11 min read
What is in your firmware: the bill of materials nobody asked for before
What an SBOM is under the CRA — why the lender's risk team reads it before the security team does, and what catches non-EU OEMs out
12 min read
The cryptographic baseline assumed in every European bid
TLS 1.3, no SHA-1, AEAD ciphers, asset-owner PKI, hardware root of trust, secure boot, post-quantum agility — the European bid cryptographic baseline
11 min read
Bring your engineers, not your accounts
Manufacturer engineers receive named identities in the asset owner's IAM with time-bound credentials. No shared accounts, no federation at the OT boundary
11 min read
Patches arrive on the owner's schedule, not yours
Patches arrive as signed artefacts to the asset owner's repo with documentation and rollback. The owner schedules deployment. No auto-update, no silent installs
11 min read
Logs ship in formats someone else's SOC can read
The asset owner's SIEM is the system of record. Devices emit standard-format logs with documented taxonomy and tamper-evident audit logs
12 min read
The data lands somewhere. The lender wants to know where
Where the OEM's analytics telemetry actually terminates — GDPR Articles 44-49, Schrems II, and the data flow diagram the lender's DPO will read
11 min read
The bill of materials the sanctions desk will read
Sanctions and provenance disclosure for non-EU OEMs — what the lender's compliance pack contains, why a failed check has no negotiating room
11 min read
The five-year service contract and the twenty-five-year support commitment
The service contract runs five years, the asset twenty-five — and the CRA's declared support period must reflect operational lifetime, not commercial cycle
12 min read
The people, the certifications, the insurance
The vetted, certified engineers and the cyber insurance schedule the lender actually reads — the human and commercial layer alongside the technical architecture
13 min read
Where each of these conversations belongs in the procurement timeline
The series closer — fifteen substantive topics mapped against eight procurement gates, with the dependencies that determine where each conversation belongs
10 min read