Integrating MES and ERP means production orders pass from the enterprise planning system to the system that runs the shop floor, and confirmations, material consumption and quality results come back without being retyped. In 2026 the rules around that link are changing, through the Data Act and the Cyber Resilience Act (eur-lex.europa.eu) and Poland’s amended cybersecurity act (api.sejm.gov.pl).
Quick Overview
What you will learn:
- Where MES ends and ERP begins in a layered plant model
- Which protocols carry data from machines to business systems
- Which new legal deadlines matter to manufacturers and plant operators
- How to start reviewing an integration you already run
Who this article is for:
- Production and maintenance managers
- Industrial systems architects and integrators
- IT teams running ERP in manufacturing companies
Reading time: 7 minutes
Drawing the Line Between MES and ERP
Integration projects tend to go wrong when nobody has agreed who owns what, and layer models are a good way to settle the question. The OPC UA reference architecture on learn.microsoft.com puts MES components at ISA-95 Level 3, operations management, directly above Level 2, control. In the Purdue model, as the Microsoft Defender for IoT documentation on learn.microsoft.com describes it, Level 3 covers functions such as detailed production scheduling, production reporting and the plant historian, while Levels 4 and 5 are home to the enterprise network and its centralised IT systems. That is where ERP sits.
In short:
- ERP decides what to make: production orders, bills of materials, routings, material requirements and costing.
- MES records how it was made: it dispatches orders to work centres and captures times, consumption, scrap and inspection results.
- The control layer runs the machines: PLCs, HMIs and SCADA systems should not talk to ERP directly.
Once ERP starts steering individual work centres, or MES starts recalculating costs, the boundary blurs and every subsequent change becomes harder.
How the Data Moves at the Edge
The same reference architecture on learn.microsoft.com illustrates a common pattern. Machines that support OPC UA connect to an edge gateway as clients and servers, while equipment without OPC UA comes in through a separate connectivity layer. On the gateway, messages arrive at an MQTT broker, and data flows pass them on to analytics and applications. A Unified Namespace arranges the assets in an ISA-95 hierarchy.
Azure IoT Operations, documented on learn.microsoft.com, puts this idea into practice. It runs on Azure Arc-enabled Kubernetes at the edge and includes an edge-native MQTT broker, and its connector for OPC UA publishes data from OPC UA servers to MQTT topics. Whichever platform you choose, the design principle still holds: process data stays at the edge and in MES, and ERP receives business events such as an operation confirmation, a goods receipt or a material issue.
The Purdue model on learn.microsoft.com also defines Level 3.5, the industrial perimeter network between the site and the enterprise. We recommend routing traffic between the plant floor and the business network through that zone, not around it.
New Legal Deadlines
All the dates below are taken from the legal texts themselves: the EU regulations as published on eur-lex.europa.eu and the Polish act on api.sejm.gov.pl.
| Change | Date | Act |
|---|---|---|
| Amended Polish cybersecurity act in force; a plant in NACE divisions C26 to C30 that is at least a medium-sized enterprise counts as an important entity unless it is an essential one (Art. 5(2)(2) and Annex 2) | 3 April 2026 | Journal of Laws 2026 item 252, api.sejm.gov.pl |
| Cyber Resilience Act: provisions on notified bodies (Chapter IV) | 11 June 2026 | Regulation (EU) 2024/2847, Art. 71, eur-lex.europa.eu |
| Cyber Resilience Act: reporting of actively exploited vulnerabilities and severe incidents (Art. 14) | 11 September 2026 | Regulation (EU) 2024/2847, Art. 71, eur-lex.europa.eu |
| Data Act: connected products placed on the market after this date must give users access to their data by default (Art. 3(1)) | 12 September 2026 | Regulation (EU) 2023/2854, Art. 50, eur-lex.europa.eu |
What this means on the shop floor:
- Machine data is now a purchasing issue. Since 12 September 2025, the user of a connected product, for example a plant that buys a machine, has been able to request data it cannot access directly (Art. 4 of the Data Act on
eur-lex.europa.eu). Ask suppliers what format the data will come in and over which channel your MES will receive it. - Equipment makers have to report vulnerabilities. From 11 September 2026, a manufacturer must send an early warning of an actively exploited vulnerability within 24 hours and a notification within 72 hours (Art. 14(2) of Regulation 2024/2847 on
eur-lex.europa.eu). The obligation extends to products placed on the market before 11 December 2027 (Art. 69(3)). - The plant itself may fall under regulation. An entity that met the criteria when the Polish amendment took effect has 12 months to implement the obligations in Chapter 3 of the act (Art. 33(1) of the amending act on
api.sejm.gov.pl). From then on, keeping an inventory of MES and ERP interfaces is part of security management rather than a side project.
The Cyber Resilience Act applies in full from 11 December 2027 (Art. 71 on eur-lex.europa.eu), so for now this is a year of preparation, not the end of the story.
Where to Start a Review
- Map the layers. Place each system in the Purdue model and name its owner on the IT or OT side.
- List the interfaces. For each flow, record its direction, protocol, frequency and format, and what happens when the link is down.
- Agree on an asset model. MES, ERP and the edge layer should share a single site, area, line and work-centre hierarchy.
- Check your machine contracts. Data access and vulnerability information now belong in procurement terms.
- Confirm your regulatory status. Establish whether the company is an essential or an important entity under the amended act.
Read Also
- Digitising the production line step by step — where shop-floor digitisation begins
- IoT connectivity in the factory — industrial protocols in more depth
- OT cybersecurity in manufacturing plants — protecting the control layer
Build Your Skills
Our SAP S/4HANA PP (Production Planning) course covers production and material requirements planning on the ERP side, and Industrial IoT for Manufacturing Professionals deals with industrial protocols and OT/IT integration. Get in touch and we will tailor the scope to your plant.
Frequently Asked Questions (FAQ)
What does systems integration involve in a manufacturing plant?
It comes down to deciding which system is the source of truth for each type of data, then connecting systems through interfaces so nobody has to re-enter anything by hand. In a plant, that usually spans the control layer, MES, ERP and analytics. A layer map based on ISA-95 or the Purdue model described on learn.microsoft.com is a good place to start.
How do you connect an ERP system to MES?
Separate the roles first: ERP plans the orders, MES carries them out and reports back. Then agree on a shared asset model and on which events go back to ERP, such as operation confirmations and material consumption. Machine data should come in through the edge layer rather than directly from ERP.
How does SAP handle production planning, and what does it pass to MES?
In SAP S/4HANA, production planning is the job of the PP (Production Planning) module, which covers production orders and material requirements planning, among other things. MES usually receives released orders together with their routing and sends back confirmations, consumption and scrap. The details depend on the integration model you choose.
Does NIS2 apply to a manufacturing plant?
It may. Poland’s amended cybersecurity act (Journal of Laws 2026 item 252 on api.sejm.gov.pl) lists manufacturing in Annex 2, including electrical equipment, machinery and motor vehicles. A plant in those divisions that is at least a medium-sized enterprise, and is not an essential entity, is an important entity. Medical devices also come under the manufacturing sector. For the final assessment, go by the text of the act.