Compliance is the sales instrument, not the cost line.

The NIS2 Directive treats electricity as an essential sector. Utilities, DSOs and large integrators inside the EU are legally obliged to manage cybersecurity risk across their supply chain, which they discharge by pushing requirements down their contracts to component suppliers. Most manufacturers outside Europe meet NIS2 not as a filing obligation of their own, but as a procurement wall: the questionnaire that arrives before the purchase order, and the clause that follows it.

Incident reporting runs on a tight clock, with an early warning due within 24 hours of a significant incident. A supplier who cannot support that timeline is a supplier the integrator has to explain to its regulator.

Directive (EU) 2022/2555 · eur-lex.europa.eu/eli/dir/2022/2555/oj

NIS2 lands on the operator. The CRA lands on you. Any product with digital elements placed on the EU market carries obligations on the manufacturer: secure by default configuration, vulnerability handling for the support period, a software bill of materials, and CE marking backed by conformity assessment.

Two dates matter. 11 September 2026, when Article 14 reporting begins: actively exploited vulnerabilities and severe incidents must be notified to ENISA and the relevant CSIRT, with an early warning inside 24 hours. 11 December 2027, when the full essential requirements and conformity assessment apply.

Reporting runs through ENISA’s Single Reporting Platform, live the same day. And read Article 69(3) before you assume this is a problem for future products only: the reporting obligation extends to every in-scope product already on the EU market. Hardware you shipped years ago is inside the 24 hour window the moment an exploitation is found.

The practical consequence for a hardware maker is that a coordinated vulnerability disclosure policy and a named security contact stop being good practice and become an entry condition.

Regulation (EU) 2024/2847 · eur-lex.europa.eu/eli/reg/2024/2847/oj

Beyond the horizontal rules there is a sector specific network code for the cybersecurity of cross border electricity flows. It matters to hardware makers because it is the instrument that reaches aggregated fleets, thousands of small devices under one control channel, rather than only large plant. If your gateway or inverter can be commanded remotely at scale, it sits inside a risk perimeter someone is now formally required to assess.

Read the timing carefully. The 4 hour incident clock in Art. 38(3) is real, but it binds only high and critical impact entities, and binding identification of those entities is not due until 13 June 2028. Anyone demanding a 4 hour supplier clock from you today is running ahead of the instrument.

Commission Delegated Regulation (EU) 2024/1366 · eur-lex.europa.eu/eli/reg_del/2024/1366/oj

This is not regulators pushing against industry. In July 2024 SolarPower Europe published its own position calling for a harmonised cybersecurity baseline for solar PV: stronger governance under NIS2, product security through the CRA, a dedicated standard for distributed energy resources, operational PV data held within the EU or equivalent security jurisdictions, and an EU level monitoring layer for manufacturer coordinated devices such as inverters.

Read it as a forecast. Where the trade body asks for a baseline, a baseline arrives.

Position paper · PDF, 11 July 2024

From 18 February 2027, every EV, LMT and industrial battery above 2 kWh placed on the EU market must carry a digital battery passport, reachable by a QR code on the battery itself. The passport holds a unique identifier, model and technical characteristics, carbon footprint specific to the manufacturing site and batch, and performance and durability data, with tiered access for the public, regulators and end of life processors.

The carbon footprint declaration applies 18 months after the later of the delegated act and the implementing act it depends on enters into force, and the Commission has not yet adopted them. Due diligence obligations follow on 18 August 2027, deferred from 2025 by Regulation (EU) 2025/1561.

The commercial point is not the passport. It is that batch level carbon and lifecycle data has to exist before the pack leaves the line. Reconstructing it from ERP records afterwards is what auditors are built to find.

One battery obligation is already live. Since 18 August 2024, Article 14 requires the battery management system of a stationary storage system to hold up to date state of health and expected lifetime data, readable by the buyer and by anyone acting for them. A buyer’s insurer or lender can only rely on that data if it cannot be edited after the fact.

That machinery is no longer battery only in its reach. The Global Battery Alliance and the Solar Stewardship Initiative signed a memorandum of understanding on 22 September 2026 to align traceability, assurance and sustainability reporting across both sectors, which puts passport thinking in front of module makers well before ESPR does. See EU-07.

Regulation (EU) 2023/1542 · eur-lex.europa.eu/eli/reg/2023/1542/oj

The Ecodesign for Sustainable Products Regulation is the framework that generalises the battery passport into a Digital Product Passport for other product groups, set by delegated acts over the coming years. It is the instrument to watch for photovoltaics: it carries product level carbon, durability, repairability and recycled content requirements, and it amends the Battery Regulation directly.

Nothing binds solar modules under ESPR today. The exposure is that the mechanism now exists and has been proven on batteries first.

Regulation (EU) 2024/1781 · eur-lex.europa.eu/eli/reg/2024/1781/oj

Ahead of any binding regulation, European developers, buyers and financiers have converged on the Solar Stewardship Initiative’s ESG and Supply Chain Traceability Standards as the evidence they will accept. Traceability here means documented chain of custody from polysilicon through wafer, cell and module, the thing most supply chains cannot demonstrate because the record was never bound to the physical unit.

This one is voluntary, and it is the one already appearing in tender conditions. It is where a manufacturer can differentiate this year rather than in 2028.

On 22 September 2026 the SSI and the Global Battery Alliance signed a memorandum of understanding in Brussels covering supply chain traceability, sustainability assurance, stakeholder engagement and capacity building. The work named in it is joint guidance, webinars and workshops, working group exchanges, and pilot initiatives on responsible sourcing, traceability and sustainability reporting. The GBA brings the practical experience it built on the Battery Passport to the solar side of the table. The first public output is a joint webinar with the Global Solar Council on 21 October 2026, on battery passports for solar and energy storage.

SSI’s own dashboard, as of 16 October 2026: 79 assessments, 23 certified sites, 13 of them certified to both standards, and no certified wafer, metallurgical silicon or quartz site yet. Against that, manufacturer members have committed that at least 80% of the modules they ship to the EEA, UK and Switzerland come from sites certified to both standards by 1 January 2027, and all of them by 1 January 2028. The gap is upstream evidence, the hardest record to reconstruct afterwards.

Read that as direction of travel. The solar and the battery traceability regimes are converging on one evidence model. A manufacturer building a separate audit trail for each is building the wrong thing twice. The position that gets cheaper over time is one attested record per physical unit that both regimes can read.

solarstewardshipinitiative.org, Supply Chain Traceability Standard · SSI and GBA partnership, 22 September 2026

CBAM entered its definitive phase on 1 January 2026. Its scope is cement, iron and steel, aluminium, fertilisers, electricity and hydrogen. Solar modules and batteries are not in scope.

Your live exposure today is the aluminium frame (CN 7604, 7606, 7610) and the steel mounting structure (CN 7308, 7318). Those are CBAM goods now. The module itself, CN 8541 43 00, is not.

From 1 January 2028 the scope is set to widen, and three lists have been tabled: the Commission’s of December 2025 (about 180 CN codes), the Council’s general approach of 12 June 2026, and the European Parliament environment committee’s of 6 July 2026 (277 further codes). Between them they reach photovoltaic generators (CN 8501 71 00, 8501 72 00, 8501 80 00), inverters above 7.5 kVA (CN 8504 40 86) and heat pumps. None of the three lists contains CN 8541. None of them is law yet, and the final list will be settled in a Parliament and Council negotiation not expected to conclude before the end of 2026.

So the risk to watch is a classification risk rather than a policy one. A product built and declared as a photovoltaic generator lands inside the committee’s list; the same silicon sold as a module does not. If you integrate, get a Binding Tariff Information ruling rather than assuming.

taxation-customs.ec.europa.eu, CBAM

The EU passport is a legal record. The Global Battery Alliance is building the voluntary certificate that sits on top of it: a product level score for each battery, built from facility level reports across the supply chain against 18 benchmark modules, independently verified, with the scheme launching in early 2027. Its 2026 Operational Trials ran with 17 supply chain partnerships whose cell makers account for 80% of global production, among them CATL, CALB, HiTHIUM, Jinko ESS, REPT BATTERO, Sunwoda, EVE Energy and Gotion.

The assurance chain is ISO from end to end. The GBA acts as scheme owner under ISO 17067, verifiers are accredited to ISO 17029, certifiers to ISO 17065, and the mark on the physical battery follows ISO 17030. Verification is risk sampled, so a facility is not audited every year, and the record between audits has to hold on its own.

The trials produced two lessons that matter to a pack maker: supply chain data exchange does not require unrestricted data sharing, and independent verification is what makes the result count with buyers. HiTHIUM, reporting from inside the trials at the GBA, SSI and Global Solar Council webinar of 21 October 2026, added three more: link traceability to physical material lots, tier disclosure so confidential data stays protected, and do not expect a grace period for missing data once the QR code is printed.

All five describe the record, not the report. A unit identity bound at manufacture, signed data a verifier can check without seeing a competitor’s inputs, and the verifier’s attestation written to the same record. Build it once and it serves the legal passport, the GBA certificate and, on the solar side, the SSI audit.

GBA, Battery Benchmarks, Beta Release, September 2025 · globalbattery.org, 2026 Battery Passport pilots · GBA, SSI and GSC webinar, 21 October 2026

Our model is deliberately simple. The UNITY chip goes into the manufacturer’s bill of materials at cost recovery. We do not make margin on silicon. Revenue is shared on the data and API subscription that the verified stream generates over the asset’s life, paid by the parties who need the data: insurers, financiers, asset owners and traders. Sunified brings the European demand side, the manufacturer brings manufacture. The manufacturer gains a compliance and financing position that cannot be bought as a service, because the data has to be originated in the factory.

Sunified is an Amsterdam company that puts a secure chip inside solar panels and battery packs so that generation, identity and carbon data are captured cryptographically at the device rather than reconstructed from spreadsheets later. They are looking for manufacturers who want a position in Europe as the Battery Passport, the Cyber Resilience Act and product level carbon rules come into force between 2026 and 2028. The chip goes into the manufacturer’s BOM at cost recovery; Sunified brings the European buyers, insurers and financiers who need the verified data. Founder is Leon Gerard Vandenberg, who lived and worked in Shenzhen and is on European time. Worth twenty minutes.

Sunified’s UNITY sensor sits inside the panel, the battery pack or the gateway and captures cryptographic proof of energy generation and device identity at source. Every electron creating a byte of data. It produces genesis data: hi-fidelity, panel level, secure, trusted and verified, from the factory floor through deployment to recycling. One verified data source, several compounding revenue streams built on top of it.

UNITY is built on a Silicon Labs EFR32MG24B with Secure Vault High, providing a hardware root of trust, secure key storage and secure boot. That is the foundation a CRA conformity claim rests on, and the assurance a NIS2 obligated integrator needs to see in a supplier. Silicon Labs Secure Vault on the Series 2 family holds PSA Certified Level 3, the first IoT security solution to reach it, with independent penetration testing by Riscure. IEC 62443 alignment runs through our integration partner.

Deployed as an option board today, with a path to main board integration. Sunified is the firmware author and, under the CRA, a manufacturer in its own right, which means the reporting and vulnerability handling obligations sit with us for our part of the stack rather than with the OEM.

The chip measures temperature, voltage and current at the panel. A Bluetooth mesh propagates readings across the array to gateways, which publish a signed stream to the Sunified API. Because each reading is signed at the device, the record is tamper evident along its whole path. That is the difference between telemetry and evidence.

What sits on top: predictive maintenance and yield, insurance and financing at asset level, and the chain of custody record behind traceability and carbon claims. Panel level truth rather than inverter level aggregate is the point. Aggregate data cannot tell you which panel, and every downstream claim needs to know which panel.

A century of chain of custody discipline is why oil is financed, insured and traded with confidence. The solar electron has none of it. Sunified’s purpose is to make solar a trusted asset class for OEMs, producers, owners, financiers and insurers of decentralised solar and battery assets.

The consequence is legal, not only technical. Where generation and custody are attested at the device, a stolen or double counted carbon credit becomes property theft rather than breach of contract: prosecutable, insurable, and recoverable. A carbon credit is only as defensible as the metering behind it.

A battery passport, an SSI certificate, a warranty claim, an insurance payout and a green bond all need five questions answered about the same reading. Today five groups of companies each answer one of them.

• Is this device genuine? Trusted hardware: secure element and identity chip makers. UNITY holds a key born on the die, verifiable offline.
• What is this module or pack doing? Measurement and monitoring: inverter, optimiser, BMS and monitoring vendors. UNITY measures and signs at the source.
• What does the record say? Records and open stacks: passport and traceability platforms. With UNITY the passport starts from a measurement, not a keystroke.
• Did a person check it? Inspection: Notified Bodies and inspection firms. UNITY adds a check that is continuous, per device and machine-verifiable.
• Can this reading be owned, sold, secured and recovered? Legal wrapper: registries and tokenisation platforms. With UNITY the wrapper has something real inside it.

Solar PV and BESS need the same five answers, across stewardship, CBAM and cyber. UNITY answers all five in one signature at the point of production. The five groups are our partners, suppliers and customers, not our competitors.

The public marker for factory automation in this sector is the World Economic Forum lighthouse list. The first lighthouse in each segment: CATL Ningde for batteries (2021), LONGi Jiaxing for modules (December 2023), Tongwei Meishan for cells (2025) and HiTHIUM Chongqing for energy storage batteries (January 2026). LONGi Jiaxing alone runs 784 cameras across 20 processes.

The identity model underneath has not changed. On a module line, EL runs before lamination, and the flash test (IV curve, Pmax) runs after framing and junction box. On a cell line, a laser marks a Data Matrix or QR code on the can at grading, after formation. In both cases the MES links each measurement to the printed code. The binding lives in a row in the maker’s database, and the unit carries only a symbol anyone can copy.

No lighthouse disclosure or MES vendor material we reviewed signs unit measurements with a key held in the unit. The secure elements sold for batteries answer one question, whether a battery is original. On the sources we read, none of them signs a measurement.

CATL · prnasia.com · LONGi · solarquarter.com · Tongwei · gramwzielone.pl · HiTHIUM · technode.global · module line · bisol.com · cell marking · pryormarking.com · MES genealogy · kontron-ais.com

• Materials in. Incoming lots are read and registered against the order before they reach the line.
• Unit identity bound at the station. The chip’s key is registered against the MES serial at layup or junction box on a module line, and at pack end-of-line test for BESS, before the first measurement is taken.
• Flash test and QA verification signed to the unit. The station result (Pmax bin, EL pass, end-of-line test) is signed and bound to the unit’s own key, so the result travels with the unit and not only in the maker’s database.
• Finished goods and production lot tracking. The signed record carries plant and lot. The battery passport declares carbon footprint per battery model and per manufacturing plant, so the unit record and the plant record meet in one signature.
• Read by phone, gate and forklift. Bluetooth plus RFID, so the record is read through the box without opening it.

Cells keep their laser-marked Data Matrix as the cell layer. A chip per cell is not realistic at cell cost; the UNITY chip signs the cell manifest at pack level.

One limit, stated plainly: UNITY fixes the record a flasher produced. The chip does not prove the flasher was calibrated, so we pair it with a signed calibration reference per flasher.

Cell marking after formation · pryormarking.com · Battery passport and carbon footprint, Reg. (EU) 2023/1542 · eur-lex.europa.eu/eli/reg/2023/1542/oj

Inside a warehouse, fixed portals and forklift-mounted readers read pallets in bulk, with forklift readers reaching up to 12 m. Outside, drone readers are commercial for outdoor yards, typically reading 2 to 8 m below the aircraft on flights of 20 to 40 minutes. One reader vendor advises drones for yards and forklift readers for indoor continuous inventory.

The EU battery passport applies from 18 February 2027 to industrial batteries above 2 kWh, EV and LMT batteries, and the passport is reached through a QR code linked to a unique identifier (Art. 77(3)). EN 18220:2026 on data carriers, published as a harmonised standard by Implementing Decision (EU) 2026/1736 (in force 15 July 2026), accepts QR Code, Data Matrix, NFC, HF RFID and RAIN UHF RFID as data carriers.

No published passport text requires the carrier to be signed. The companion standard on data authentication and integrity, EN 18246, was still under approval in mid 2026. A carrier tells a reader where the record is. A carrier does not prove that the pack in hand is the pack the record describes.

UNITY puts Bluetooth plus RFID on the unit, so one signed identity is read at the portal, by the forklift, by the drone over the yard and by a phone at goods-in. The QR code stays. UNITY adds the proof behind it.

Implementing Decision (EU) 2026/1736 · eur-lex.europa.eu/eli/dec_impl/2026/1736/oj · EN 18220 and EN 18246 status · cencenelec.eu · Art. 77, Reg. (EU) 2023/1542 · eur-lex.europa.eu · forklift reads · dronescan.co · drone reads · rfid.me · yards versus indoor · simplyrfid.com

A QR code points to a record. Copy the label, and the copy points to the same record.

An RFID tag laminated in the glass is a QR code you cannot see. India has required one inside the module laminate for MNRE scheme modules since 1 April 2013, and the current PM Surya Ghar guidelines still ask for “a RF identification tag laminated inside the glass”. The tag holds the factory record: maker, dates, origin, I-V data and serial. The tag is written once, no text we found requires a signature, and it has no sensor. Anyone with a writer can write plausible values.

The cost of a label that is not bound to the measurement is visible in the data. Fraunhofer ISE CalLab found that in 2023 crystalline modules measured on average 2.2% below their nameplate, against under 1% in 2012 to 2016. Modules are sorted into 5 W classes, and about 2% is enough to move a module up a class. In a 2016 case, a distributor ordered 250 W modules and received 240 W modules carrying replacement 250 W nameplates.

UNITY signs the flash result to the unit’s own key at the flasher. A relabel or a bin shift then shows up at goods-in, read through the box.

PM Surya Ghar guidelines, Annexure 3, 1.11 · MNRE PDF · MNRE 2013 rule · iitk.ac.in · Fraunhofer ISE CalLab, 5 November 2024 · pv-magazine.com · relabelling case · pv-magazine.com · tag write risk · sinovoltaics.com

Module placement robots now work at gigawatt scale:

• Gritt Robotics, with Burns & McDonnell on the 346 MW Gibson City project in Illinois. A crew of eight places 3,000 to 4,000 panels a day, against about 800 by hand. Gritt lists verification logs and an audit trail as a product capability.
• Terabase Terafab, a field factory on the site. V2 adds in-line module QC. One line installs more than 20 MW per week running continuously, and the company page claims 100+ MW installed.
• AES Maximo, 100+ MW installed at Bellefield, at more than one module per minute.
• Goldbeck Solar HeliomatiX, an assembly hub that inspects each module and scans its serial number.
• TrinaTracker Buildex, up to 90 modules per hour.
• Cosmic Robotics, one panel every 30 to 40 seconds, and Planted, which pairs digital twins with robot-built racking.

None of them publishes a placement record that binds a proven panel identity to a position. The serial-to-position link is still made afterwards, by people: on one 300+ MW project, Rosendin crews scanned nearly 1 million module serials by barcode, row by row.

With UNITY, the robot reads the chip at pick time, and the placement record carries a signed panel identity and its position. Hyperlocation comes from Bluetooth Channel Sounding anchors in the junction boxes, the anchor grid already described on agri.sunified.ai for sites where satellite positioning degrades under the panels.

Gibson City · renewableenergyworld.com · crew output · thenextweb.com · verification logs · gritt.ai · Terafab · terabase.energy · 20 MW per week · Maximo · solarpowerworldonline.com · HeliomatiX · pv-magazine.com · Buildex · pv-magazine.com · Cosmic · techcrunch.com · Planted · pv-magazine-usa.com · Rosendin · nacleanenergy.com · raptormaps.com

Cleaning robots and inspection drones are commercial. TrinaTracker launched Aurora, an unattended cleaning robot, alongside Buildex in September 2026. Drone thermography locates a fault “down to the module level”, which means by position in the array. Turning that position into a serial number is a separate lookup against the as-built map or the barcode scan made at install. No maintenance robot or drone source we found reads the module’s identity in the field.

Warranty evidence rests on imagery standards: capture at 3 cm per pixel, and repeated inspections to show when a defect began and whether the cause is manufacture or installation. None of that proves the imaged module is the serial named on the claim.

With UNITY, the module answers a Bluetooth query with its signed identity and its own signed measurements. The drone or the robot binds the observation to the unit at the moment of capture, and the warranty claim carries the panel’s own record. A BESS rack answers the same way.

Aurora and Buildex · pv-magazine.com · thermography and warranty evidence · raptormaps.com

The Battery Regulation already sets the data a recycler and a second-life buyer receive:

• Annex XIII, dismantling information per battery model: exploded diagrams, disassembly sequences, the type and number of fastening techniques to unlock, and the tools required.
• Annex XIII, per individual battery: state of health, and status as original, repurposed, re-used, remanufactured or waste.
• Art. 14: since 18 August 2024, read-only access to state of health in the BMS for the purchaser and independent operators.
• Art. 77(7): a repurposed battery gets a new passport linked to the passport of the original.

Machine-readable dismantling data per unit matters because robots still struggle to know what they face. The RAPID platform (University of Colorado, March 2026) removed top-cover fasteners from full-scale EV packs with 97% success using taught poses, and 57% using one-shot vision.

Photovoltaic end-of-life is still keyed to a printed serial label, where the label is legible. The voluntary PV passport recommendation from the European Solar PV Industry Alliance names a QR code as the carrier.

A pack or panel that announces its own signed identity tells the disassembly cell which dismantling record to fetch before the first cut. The same key carries the signed use history to the second-life buyer and links the new passport to the original.

Annex XIII, Art. 14, Art. 77(7), Reg. (EU) 2023/1542 · eur-lex.europa.eu · RAPID · arxiv.org/abs/2603.18520 · ESIA PV passport · solaralliance.eu