Where each of these conversations belongs in the procurement timeline
The series closer — fifteen substantive topics mapped against eight procurement gates, with the dependencies that determine where each conversation belongs
10 min read
Oem-Eu-Readiness
── 2026
When the money comes from Europe, the rulebook travels with it
A North African plant, an EU sponsor, a non-EU bidder, and the EU rulebook that travels down the financing chain — opening an 18-part series for suppliers
4 min read
What is in your firmware: the bill of materials nobody asked for before
What an SBOM is under the CRA — why the lender's risk team reads it before the security team does, and what catches non-EU OEMs out
12 min read
What 'system integrator for L0/L1' actually means under 62443
What an OEM-as-system-integrator inherits under IEC 62443 — zone-and-conduit risk assessment, Target Security Levels, component capability mapping
12 min read
The substation is a foreign country
Where the wind or solar plant ends and the substation begins is where the manufacturer's design authority ends absolutely — and why
8 min read
The regulatory stack, in fifteen minutes
A 15-minute walk through five EU regulations and one framework that show up in every EU-financed renewable project — CRA, NIS2, GDPR, sustainable finance, Equator Principles
16 min read
The people, the certifications, the insurance
The vetted, certified engineers and the cyber insurance schedule the lender actually reads — the human and commercial layer alongside the technical architecture
13 min read
The five-year service contract and the twenty-five-year support commitment
The service contract runs five years, the asset twenty-five — and the CRA's declared support period must reflect operational lifetime, not commercial cycle
12 min read
The data lands somewhere. The lender wants to know where
Where the OEM's analytics telemetry actually terminates — GDPR Articles 44-49, Schrems II, and the data flow diagram the lender's DPO will read
11 min read
The cryptographic baseline assumed in every European bid
TLS 1.3, no SHA-1, AEAD ciphers, asset-owner PKI, hardware root of trust, secure boot, post-quantum agility — the European bid cryptographic baseline
11 min read
The communication network is not yours to design
The plant network — its segmentation, addressing, redundancy and firewall rules — belongs to the operator, not the manufacturer. What to specify, what not to
9 min read
The bill of materials the sanctions desk will read
Sanctions and provenance disclosure for non-EU OEMs — what the lender's compliance pack contains, why a failed check has no negotiating room
11 min read
Remove the cellular modem. Not disable — remove
Cellular modems, Bluetooth, hidden USB ports — disabling them in firmware is not adequate. The hardware must be physically absent
8 min read
Remote access, but not the kind you remember
Persistent VPN tunnels are a 2015 architecture. What replaces them in EU-financed projects — unidirectional telemetry out, brokered just-in-time access in
10 min read
Patches arrive on the owner's schedule, not yours
Patches arrive as signed artefacts to the asset owner's repo with documentation and rollback. The owner schedules deployment. No auto-update, no silent installs
11 min read
Logs ship in formats someone else's SOC can read
The asset owner's SIEM is the system of record. Devices emit standard-format logs with documented taxonomy and tamper-evident audit logs
12 min read
Email is not a vulnerability disclosure programme
The CRA requires a public coordinated vulnerability disclosure programme. A customer email list is not one. The minimum-viable PSIRT, in 4-6 weeks
11 min read
Bring your engineers, not your accounts
Manufacturer engineers receive named identities in the asset owner's IAM with time-bound credentials. No shared accounts, no federation at the OT boundary
11 min read