EU Packaging and Cybersecurity Rules: A Data Problem, Not Just Compliance

On 12 October 2026, IIoT World published a short article based on a video interview with Neil Smith, Segment President Consumer Packaged Goods at Schneider Electric. The theme: the new European rules on packaging and cybersecurity should be read as a question of data management rather than simple regulatory compliance. This is a vendor's perspective, not independent research or a new regulation, and should be treated as context.

What the interview argues

Smith cites a projection that, by 2030, food and beverage manufacturers could lose 36% of potential revenue to inefficiencies; for life sciences the estimate is around 33%. The article does not name the source of these figures, so they should be treated with caution.

According to Smith, life sciences digitalized earlier, driven by FDA requirements for drug release and approval and by greater cash availability. Food and beverage has maintained high standards of quality control and brand protection, but has adopted technology more cautiously.

The new European pressure

The two areas identified in the interview are:

• packaging obligations, which would require "molecular"-level information on packaging materials, not only on the food product;
• new cybersecurity requirements for connected production systems.

The article does not cite the specific regulations or their application dates, and the description of the packaging rules is the interviewee's own. The rules originate in the EU but also affect non-EU companies that export to Europe.

"It looks like a regulatory problem. It is actually a data management problem."

Why data is the bottleneck

Smith's argument is that the required information sits in disconnected systems: work orders, planning, scheduling, inventory control and supplier order fulfilment. Material traceability from the supplier, through production, to the final packaging is a perimeter that no single-plant system covers on its own. Companies that build a connected operating model, he adds, could meet the obligations and also gain the structured data foundation needed for AI at scale.

What it means for those running a plant

The interview reinforces an already widespread idea: shop-floor data collected by an MES has regulatory value only when linked to ERP, planning and supplier data. This is how you obtain lot and material genealogy and traceability that stands up in an audit. The security of connected OT systems also falls within the same picture: the more data is integrated, the more it matters to protect the networks that produce it.

Some practical steps, which are our own reading and not recommendations from the article:

• map where data on materials, lots and suppliers currently resides and which systems do not talk to each other;
• check whether a lot's genealogy can be reconstructed down to the packaging materials;
• involve IT, OT and quality together in assessing cybersecurity requirements;
• read the EU legal texts and their deadlines directly, before basing decisions on third-party summaries.

Limits of the source

The article is short and general, with no concrete cases and no figures beyond the two estimates cited, and it comes from a technology vendor. Its underlying message, however, is sound: compliance rests on integrated, reliable data, and those who organize it today will be better placed when the requirements become operational.