Customer (as published)	A German manufacturer of automated food-processing and packaging machinery
Component supplied	Embedded operator terminals (two consecutive hardware generations) — Windows-Embedded-based HMI/control terminals integrated into automated food-processing and packaging machinery
Industry	Food-processing and packaging machinery — automated production and packaging lines
Relationship	Framework supply agreements in place since approximately 2010
Scope of work	Series & spare-parts supply, repair/RMA, obsolescence management, Cyber Resilience Act advisory, life-cycle and run-out planning
Engagement horizon	Framework agreement extended through 2026

 

The Challenge

This customer's machines ship with the same family of embedded operator terminals — two consecutive hardware generations — deeply integrated into the machine platform, with units in the field for many years. Several key components used in these Windows-Embedded-based terminals have since been discontinued by their original manufacturers: a common risk for any electronics platform with a multi-year service life, but a serious one here, because the terminal isn't a peripheral — it's built into the machine. Losing terminal supply would not just mean re-sourcing a part; it would put the serviceability of the customer's entire installed base, and the service business built around it, at risk.

On top of that, the customer came to us directly with a forward-looking question rather than waiting for a problem: how does the EU Cyber Resilience Act affect a Windows-Embedded-based terminal of this kind, and what do they need to do about it. That question matters on two timelines, not one — the Cyber Resilience Act's reporting obligations for actively exploited vulnerabilities and severe incidents already apply as of 11 September 2026, ahead of the main essential-requirements and CE-marking obligations that follow on 11 December 2027.

Editorial note — remove before publication: CRA dates per Regulation (EU) 2024/2847, Art. 71 (reporting obligations under Art. 14 apply from 11 September 2026; full application including essential requirements and CE marking from 11 December 2027), re-verified in October 2026. Re-confirm once more immediately before publication, since Commission guidance and harmonised-standards deadlines have continued to shift.

Our Approach

The relationship is built on long-running framework agreements, in place for roughly a decade, with call-offs covering both series production and spare-parts demand. Rather than reacting order by order, we run joint annual forecast and framework planning with the customer, so both sides can plan capacity and components ahead of time. For units already in the field, we provide repair and RMA service, keeping existing machines running rather than forcing a replacement.

When the customer raised the Cyber Resilience Act question, we treated it as an advisory request, not a sales opportunity: we carried out a structured CRA impact assessment on the Windows-Embedded-based terminal platform, at their request, covering both the near-term reporting obligations and the longer-term essential requirements, so they could plan with accurate dates rather than guess.

• Material release concept — releasing long-lead components ahead of need, so terminal supply continues without interruption while the next framework order is finalized.
• Last-time-buy planning — securing remaining production runs of discontinued components before they disappear from the market entirely, sized to the customer's actual field and spares demand.
• Transparent life-cycle and run-out planning — open communication on component availability and remaining runway, with run-out quantities for both terminal generations planned together with the customer and sized to the installed base and spares demand, so the end of the platform's production life is a dated, plannable event the customer can build its own roadmap around, rather than a forced cutover on short notice.
• Quality documentation support — contributing to the customer's own test instructions and error catalogue, so terminal-level quality data feeds directly into their machine qualification process.

The Solution

The result is uninterrupted terminal supply across two hardware generations, plus repair service for the installed base — with one partner covering series production, spare parts, field service, regulatory compliance guidance and life-cycle planning, instead of the customer having to coordinate separate vendors for each of those pieces.

Impact & Results

Machines already in the field stay serviceable for years, and the customer never faced an interruption in terminal supply: the component-obsolescence risk is being managed on the supply side — as a planned run-out backed by secured spares — rather than passed on to the customer as an engineering problem to solve on their own. The framework agreement has been extended to cover 2026, continuing a relationship that has been renewed year after year since roughly 2010.

The Relationship

The pattern of behavior is itself the feedback: framework contracts renewed year after year, and regulatory questions like the Cyber Resilience Act brought to us before a decision is made, not after. Being asked before a decision, rather than only supplying after one has already been made elsewhere, is what a trusted-advisor relationship looks like — as distinct from a purely transactional supplier relationship.

Frequently Asked Questions

What kind of operator terminals are involved?

Windows-Embedded-based HMI and control terminals built into automated food-processing and packaging machinery, used by machine operators to run and monitor the production line. Two consecutive hardware generations have been supplied over the life of the partnership; the platform is now in a planned run-out phase, with spare-parts and repair support for the installed base continuing.

Why is component obsolescence a bigger deal here than for a typical electronics product?

Because the terminal isn't a peripheral that can simply be swapped for an equivalent part — it's deeply integrated into the machine platform itself, and units stay in the field for many years. When a key component is discontinued, the risk isn't just re-sourcing one part; it's the continued deliverability and serviceability of the customer's entire machine platform.

What does the EU Cyber Resilience Act mean for a Windows-Embedded-based terminal like this?

Two dates matter, not one. Reporting obligations — notifying actively exploited vulnerabilities and severe incidents — already apply as of 11 September 2026. The main essential cybersecurity requirements and CE-marking obligations follow on 11 December 2027. Both were covered in the impact assessment we carried out at the customer's request.

What happens when key components of the terminal are discontinued?

Discontinued components can't be re-sourced indefinitely, no matter how well supply is managed. Last-time-buy planning and early material release buy time and secure the spares demand of the installed base, but they don't remove the underlying obsolescence — so the run-out of the terminal platform is planned openly with the customer, with quantities and timelines agreed in advance, instead of turning into an unplanned forced cutover once components genuinely run out.

What happens to machines already in the field?

They continue to be supported: spare parts remain available through the framework agreement's call-offs, backed by last-time-buy stock for discontinued components, and field units are covered by repair and RMA service. The run-out is planned around the installed base, not imposed on it.

How is this different from a standard spare-parts or supply contract?

A standard supply contract typically covers one thing — parts, or repairs, or a redesign — and leaves the customer to coordinate the rest. Here, series production, spares, field repair, obsolescence and regulatory advisory, and the planned run-out of the terminal platform all sit with one partner, planned jointly on an annual cycle rather than negotiated fresh each time a problem comes up.