Scanners, printers and mobile computers sit on the network and talk to the ERP. Managing them like any other endpoint turns an obligation into a head start.
Identification hardware used to be chosen for read speed, print quality and ruggedness. That is no longer enough. A mobile computer today is a networked device with apps, Wi-Fi access and credentials for the ERP system. A label printer has a network interface and firmware. Each of these devices is an endpoint.
Two sets of rules turn this into an obligation. In Germany, the NIS2 Implementation Act applies to operators; it transposes the EU NIS2 Directive on network and information security. At EU level, the Cyber Resilience Act applies to manufacturers of connected products. Here is what both mean for the devices in your warehouse and production, and what you should do regardless of any regulation.
What applies, and from when
Three dates mark the way.
Germany’s NIS2 Implementation Act came into force. Important and essential entities must manage risks, report incidents and take the security of their supply chain into account.
Since this date, the reporting obligations of the Cyber Resilience Act apply to actively exploited vulnerabilities in products with digital elements.
From then on, the product requirements of the Cyber Resilience Act apply in full. Among other things, manufacturers must define a support period for security updates.
Why AutoID hardware is now in focus
Networked devices on the shop floor are productive because they capture data exactly where it is created. That is also what makes them vulnerable: every device that posts bookings into the ERP is a route into it.
The decisive question is organisational, not technical. Who manages the label printer at the dock, who manages the mobile computer in the high-bay area? Are they in the same inventory as the office laptop, with software version and update cycle? Where the answer is no, the risk does not start with an attacker but with the missing overview.
Three layers that belong together
Security in AutoID does not come from a single product. It comes from planning three layers together. Scroll through the layers:
Operating system, firmware, apps, and how long the manufacturer delivers security updates.
Wi-Fi coverage, separation of office and production networks, monitoring during operation.
Who posts what into the ERP, who may change label templates and printer configurations, and can that be traced?
Only when these three layers are aligned does an environment emerge that is both efficient and resilient.
What this means for hardware, software, service and consumables
A device without security updates remains a risk, even if it still scans perfectly. When purchasing, ask until when the manufacturer commits to updates. Under the Cyber Resilience Act, stating this becomes a manufacturer obligation.
With mobile device management, apps, operating systems and security policies are managed centrally. Devices can be locked remotely if needed. Label templates come from one source, with clear rights on who may change them.
Monitoring and updates belong in day-to-day operation, not in a project every few years. With defined response times and a pool of replacement devices, the process keeps running even when a device has to be taken out of service.
If systems are isolated after an incident, labelling must continue. That requires a plan for which labels and ribbons are kept on site and which printers can print in emergency mode without a central connection.
A self-check in five questions
Every question you cannot answer with a confident yes today is a good place to start.
What you get from OPAL
We recommend devices based on your process and the committed support period, not on a fixed brand.
Rollout, updates, security policies and replacement across the entire life cycle.
On-site surveys, planning, installation and monitoring during operation.
Maintenance, support, replacement devices, monitoring and updates with response times agreed in writing.
We are not a legal advisor and do not replace an information security management system. Whether your company falls under NIS2 rules is a question for your legal or compliance function; in Germany, the BSI applicability check helps. We make sure the devices on your shop floor meet the requirements that follow from it.
Frequently asked questions
Are scanners and printers covered by the Cyber Resilience Act?
Connected hardware and software placed on the EU market counts as a product with digital elements. The obligations fall primarily on the manufacturers. For you as an operator, the committed support period becomes a firm selection criterion.
Our company is not covered by NIS2. Does this still concern us?
Possibly through your customers. Companies covered by the rules must take the security of their supply chain into account and ask their suppliers about it.
What should we do with devices that no longer receive security updates?
First record where they are and what they do. Then plan the replacement and, until then, limit access to what is necessary. A replacement can be organised so that operations keep running.
We take stock of your devices and show where updates, network and access rights do not fit together.
Sources, as of October 2026
BSI: NIS-2 regulated companies (German)
This article is general information and does not constitute legal advice.
