Manufacturing software development partner: a 2026 buyer's brief

A manufacturing software development partner is a software firm that builds custom applications on top of factory systems: the ERP, the MES, the machines on the line, and the data moving between them. What separates it from a general software agency is the integration surface. The screens are the small part of the work.

Plant managers and manufacturing IT leads hire one when the standard product stops fitting. The MES cannot model a process the plant actually runs. The ERP has no view of what happened on the line in the last hour. Quality records live in a spreadsheet on a laptop bolted next to the machine. A good engagement ends with a small set of applications that read from the line and write back to the systems of record, plus the integration that keeps them honest. This brief covers what that work is made of, what makes it overrun, and what to vet before signing in 2026.

What the partner actually builds

The application tier is thin. Most of the engineering sits underneath it, in acquisition, modelling and reconciliation. The recurring deliverables:

• Operator terminals. Work order start and stop, scrap declaration, changeover checklists. They run next to the machine HMI, not inside it.
• Downtime and OEE tracking. Machine states collected automatically, reason codes entered by the operator, the two reconciled into a number the plant trusts.
• Digital work instructions bound to the running order and to the revision of the part.
• Traceability records. Which lot, which machine, which operator, which parameters, retrievable four years later during a recall.
• Material movement in the gap where the WMS stops and the shop floor begins.
• Planning overlays. Sequencing and rescheduling on top of an ERP that plans in days while the line moves in minutes.
• Customer and supplier portals for order status, certificates and delivery data.

A specialist partner rarely replaces the MES or the ERP. It fills the gap between them and connects what the plant already owns. Anyone proposing to replace both in one project is selling a rewrite, and rewrites in manufacturing are measured in years.

Why manufacturing software projects overrun

Panorama Consulting's 2026 ERP Report found that more than a quarter of organisations exceeded their project budget, with additional technology needs as the leading cause. The sequence is always the same: a functional misfit surfaces late, and the team closes it by buying more software or commissioning custom code that nobody budgeted.

On the shop-floor side the same failure has a name. McKinsey's Global Lighthouse research puts roughly 30 percent of Industry 4.0 pilots as reaching scale across the organisation, leaving the rest in what it calls pilot purgatory, and it locates the blockage in the last IT/OT mile rather than in the model or the dashboard.

The mechanism is mundane. The estimate covers screens, because screens are what everyone can picture during a demo. The cost lives in the forty machines on the line, the eleven protocols they speak between them, the three undocumented serial dialects from a supplier that no longer exists, and the fact that touching any of it needs a maintenance window the plant grants once a month.

How does the partner get data off the line?

This is the question that predicts the outcome. Ask it in the first meeting and listen for proper nouns.

The architecture most plants converge on in 2026 has three tiers. OPC UA at machine level, where the PLC exposes structured data through a companion specification. An edge gateway that translates and buffers. MQTT with Sparkplug B payloads publishing into a broker, where topics follow the ISA-95 hierarchy: enterprise, site, area, line, cell, equipment, tag. That arrangement is what the field calls a unified namespace, and its value is boring and real. Applications subscribe to a stable address instead of holding a point-to-point connection to every SCADA system that will be replaced within five years.

The trade-off between the two protocols is worth knowing before the meeting. OPC UA carries a rich type model and works well close to the machine, at the cost of weight and configuration effort. MQTT with Sparkplug is lighter, event-driven, and survives plant networks that drop, which makes it the better carrier upward and outward. Most plants run both, with the gateway as the seam.

Brownfield is the normal case. Half the machines will speak Modbus, some will offer a file drop, one will offer a dry contact and nothing else. That is workable. It has to be named in the estimate, machine by machine, with an owner against each line. A partner who answers this question with "we will write a custom connector for each machine" has priced the first month and none of the following five years.

Two European deadlines that changed the brief in September 2026

If the plant sells machines or connected products into the EU, two dates sit a day apart and both touch the software a partner is about to write.

Cyber Resilience Act reporting, 11 September 2026. Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents to ENISA and their national CSIRT: early warning within 24 hours, full notification within 72 hours, final report within 14 days of a corrective measure. The remaining obligations, secure-by-design requirements, technical documentation, conformity assessment and CE marking, apply from 11 December 2027. Selling a machine with an embedded touchscreen makes you a manufacturer under this regulation.

Data Act access by design, 12 September 2026. The EU Data Act has applied since 12 September 2025, giving users the right to access data generated by connected products, sensor readings and machine performance included. From 12 September 2026 the design obligation starts: connected products placed on the EU market must be built so that product data is available to the user by default, in a structured, commonly used, machine-readable format. That requirement lands on the data model your partner is drawing, which is why it belongs in the brief and not in a remediation project two years later.

NIS2 makes your supplier your exposure. The manufacturing sectors listed in Annex II of the directive, among them medical devices, computers and electronics, electrical equipment, machinery, and motor vehicles, are classified as important entities. Supply chain security is an explicit obligation, and administrative fines for important entities reach 7 million euro or 1.4 percent of worldwide annual turnover. A software supplier with credentials into plant systems sits inside that supply chain. Its patch discipline and its incident response are part of your posture now.

Five things to vet before you sign

1. An integration inventory inside the estimate. Machine count, protocol per machine, gateway owner, and an explicit list of the machines nobody has documented. A single line item reading "integrations" is a placeholder for the overrun.
2. Ownership of the data model. The namespace, the tag naming, the semantics of what a work order means at your plant. Documented, exportable, yours. When the schema exists only inside the partner's code, the next partner starts from zero and charges you for it.
3. Maintenance windows in the plan. Deploying on a running line is a scheduling problem before it is an engineering one. Ask how many windows the plan assumes, and what happens to the date when one is cancelled for a rush order.
4. The supplier's own security posture. Under NIS2 this is a compliance question rather than a preference. Patch cadence, remote access model, incident notification commitment, written into the contract instead of mentioned in the pitch. Our list of contract clauses worth checking covers where these normally go missing.
5. What happens at three in the morning. The line stops, the terminal is white, the shift supervisor needs a human. Response time, escalation path, and whether your own maintenance team can read the code and change a label without raising a purchase order.

When a specialist partner is the wrong call

Three cases where the honest answer is to spend the money elsewhere.

The gap is a standard feature you have not configured yet. Custom code wrapped around a half-implemented MES multiplies the surface you maintain, and it fights the product on every upgrade. The vendor's configuration hours are cheaper and they age better.

The plant runs one machine family from one supplier. A system integrator who already speaks that stack usually wins on speed, on spare parts, and on the phone number that answers during a stoppage.

You already have a strong internal automation team. Scope external help to the application and data layer and keep the controls in-house. The expensive pattern is hiring a partner to do everything, then supervising it with the people who could have done half.

Adjacent decisions

The commercial mechanics of hiring a build partner are not manufacturing-specific. Writing the brief, splitting the SOW from the MSA and what a discovery phase owes you all apply here, with one addition: discovery in a plant includes a walk of the line with the maintenance lead and an equipment inventory that nobody has updated since the last audit. For the same vetting exercise in another regulated vertical, see what to vet in a fintech development studio.

Sources

• Panorama Consulting Group, 2026 ERP Report
• European Commission, Cyber Resilience Act reporting obligations
• European Commission, Data Act explained
• McKinsey, the last IT/OT mile and Industry 4.0 pilot purgatory
• HiveMQ, smart manufacturing with ISA-95, MQTT Sparkplug and the unified namespace
• NIS2 Directive, Article 34, administrative fines