Whitepaper · ar security manufacturing
IT and security dossier: AR and AI on the shop floor
What IT/OT, the CISO and the DPO need to assess before digital and AR work instructions go live: devices, networks, identity, data, GDPR, the EU AI Act and NIS2
IT and security dossier: AR and AI on the shop floor
Just the newsletter?
Once a month: a practical example, a KPI to steer on and news from DeepSight.
Key takeaways
- Treat tablets, phones and headsets as managed endpoints: MDM enrolment, kiosk or shared-device mode, remote wipe and controlled updates.
- Keep the instruction platform outside the OT control zone; operators need content, not access to PLCs or SCADA.
- Photos, video and step logs are personal data as soon as they can be linked to a worker. Run a DPIA and agree the use of performance data with the works council (OR / Betriebsrat) before the pilot.
- Under the EU AI Act, AI-drafted work instructions are usually not high-risk, but human review, traceability and AI literacy are sensible controls from day one.
Chapters
01 · Why should IT and security be involved before the first pilot?
Because shop-floor AR and AI touch devices, networks, identities and personal data at the same time. Involving IT/OT, the CISO and the DPO at the start avoids a pilot that works operationally but cannot be scaled.
02 · How do you manage tablets, phones and AR headsets?
Enrol every device in mobile device management (MDM), run it in a locked-down kiosk or shared-device profile, and control app and firmware updates centrally. Headsets need the same treatment as tablets, even if MDM support differs per model.
03 · How do you connect AR to the network without touching OT?
Put shop-floor devices on a dedicated wireless segment that has internet or data-centre access to the platform but no route to the control network. Integrations with MES or CMMS run server-to-server through the DMZ, never from the device.
04 · Which data is stored, and what does GDPR require?
Photos, video, audio and step logs become personal data as soon as they can be linked to an identifiable worker. GDPR then requires a lawful basis, data minimisation, defined retention and, where monitoring is systematic, a data protection impact assessment (DPIA).
05 · What does the EU AI Act mean for AI-generated work instructions?
Using AI to draft, translate or summarise work instructions is generally not a high-risk use under the EU AI Act. The relevant obligations are transparency, AI literacy and, above all, sound human review before any AI-drafted instruction reaches the floor.
06 · Does NIS2 apply, and how do identity and SSO fit in?
Many manufacturers, food producers and energy companies fall within the scope of NIS2, which makes supplier security an explicit management responsibility. Single sign-on with role-based access is the most effective single control for a shop-floor platform.
07 · Which questions belong in the vendor security questionnaire?
Use a short, specific questionnaire that covers certification, hosting, data handling, AI, access, resilience and exit. Ask for evidence, not yes/no answers.
Frequently asked questions
Is AR on the shop floor an OT security risk?
Not if it is designed correctly. Instruction devices need content from a business application, not access to control systems. Keep them on a separate network segment without routes to PLCs or SCADA, and run any MES or CMMS integration server-side through the DMZ.
Do we need a DPIA for digital work instructions?
Often yes, or at least a documented screening. Step logs linked to named operators can be used to monitor performance, which is a typical DPIA trigger under Article 35 GDPR. Your DPO decides; do it during pilot design.
Does the works council have to agree?
In the Netherlands the ondernemingsraad has a right of consent on personnel tracking systems and employee data processing (Article 27 WOR). In Germany the Betriebsrat co-determines on systems suitable for monitoring behaviour or performance (Section 87(1)(6) BetrVG). Involve them early.
Are AI-generated work instructions high-risk under the EU AI Act?
Generally not, when AI only drafts or translates content that people review and approve. AI that evaluates or manages individual workers can fall under Annex III, whose obligations now apply from 2 December 2027 after the Digital Omnibus on AI.
Can the platform be hosted in the EU?
This must be confirmed per vendor and per component, including AI services. ActARion can collect this information for DeepSight during the intake.
Rather get a direct answer to your question? Talk to an expert.
In 30 minutes we look at your process, your numbers and the fastest route to a measurable pilot. No sales pitch, just concrete advice.