Predictive maintenance

• Sensor and PLC data from each plant is collected at the edge, read-only, through the historian or an OPC UA server, and passed out of the OT network one way.
• Models watch each critical asset for patterns that came before past failures, and give a plain-English reason and a confidence for every alert.
• A maintenance agent turns an alert into a draft work order in the CMMS, with the likely fault, the asset's history, the manufacturer's procedure and the spares it will need.
• It checks stores and open purchase orders for those spares, and flags a shortage before the job is planned, not on the day.
• A maintenance engineer reviews every draft, decides whether to act, and plans the job into a planned stop. Nothing is raised, ordered or scheduled without them.
• The AI has no route back into the OT network. It can't change a setpoint, stop a machine or override an interlock, by design rather than by instruction.

• HSEProvision and Use of Work Equipment Regulations 1998 (PUWER), regulations 5 and 6
  →

  Work equipment must be kept in an efficient state, in efficient working order and in good repair, and inspected where its condition could create a risk, with inspection results recorded. Predictive maintenance helps meet that duty but doesn't replace it. Statutory inspections and the risk-based schedule stay in place, every alert and decision is logged against the asset, and the CMMS remains the record HSE would ask to see.

• HSEOther statutory examinations (for example LOLER 1998 and the Pressure Systems Safety Regulations 2000)
  →

  Thorough examinations by a competent person for lifting equipment and pressure systems carry on exactly as now. The model can add evidence to them; it never signs one off or extends an interval.

• NCSCSecure connectivity principles for operational technology (January 2026)
  →

  The NCSC and partner agencies set out eight principles, including limiting and centralising connections to OT, using standard secure protocols, hardening the OT boundary, logging all connectivity and having an isolation plan. The design follows them: one brokered, outbound-only route per plant through a demilitarised zone, and a tested way to cut it.

• IECIEC 62443 (industrial automation and control system security)
  →

  The plant network is split into zones and conduits, and the edge gateway sits in its own zone between OT and IT. The OT and controls engineers own the risk assessment, and the AI platform is treated like any other connected supplier system.

• Government / NCSCNIS Regulations 2018 and the Cyber Security and Resilience Bill
  →

  Most manufacturers aren't operators of essential services, and the Bill as introduced doesn't add manufacturing. It does bring medium and large managed service providers into regulation, which may include whoever runs your IT or OT support, and lets regulators designate critical suppliers to essential services. Check both in discovery.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Sensor data is rarely personal, but work orders, sign-offs and shift logs name engineers and operators. Keep that data for maintenance, not for judging individuals' performance, and say so in the DPIA screening and to the workforce.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A reliability engineer owns each model and its alert thresholds, with change control like any other plant system.
• An alert review in the daily maintenance meeting for the pilot, so engineers' findings feed back into the model.
• Clear override rules: engineers record why they rejected an alert, and those reasons are reviewed monthly.
• The OT security owner signs off every new connection, and the isolation plan is tested before go-live.
• Statutory inspections, PUWER checks and planned services stay on their existing schedules until evidence supports a change, which the maintenance manager approves.
• Engineers and planners trained before go-live, including what the model can't see: a new noise, a smell, a leak.

1. 3–4 weeks

   Discovery

   Survey the OT estate at one plant, rank assets by criticality, check historian data quality and CMMS failure history, and agree the OT/IT boundary.

2. Gate · must be true to passPilot asset class chosen, data access agreed with controls engineers, OT security review started, baseline downtime measured.

3. 10–12 weeks

   Pilot

   One asset class at one plant, in shadow mode: alerts and drafts go to the reliability engineer only, and are compared with what actually happens.

4. Gate · must be true to passAlert precision and lead time within agreed limits, no route into OT found in testing, and the maintenance manager signs off.

5. 4–6 weeks

   Production

   Drafts go live in the CMMS for the pilot assets, with monitoring, support and a rollback plan.

6. Gate · must be true to passIsolation plan tested, support model in place, engineers and planners trained.

7. Ongoing

   Scale

   Add asset classes, then plants. Reuse the edge pattern and the alert-to-work-order flow at each site.

8. Gate · must be true to passEach new asset class passes the same pilot gate; each plant passes its own OT security review.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The pilot connects straight to PLCs, and the OT team finds out afterwards.

   How the design avoids it

   Read from the historian or OPC UA, through a DMZ, with the controls engineers designing the connection from day one.

2. 2

   Goes wrong

   Too many alerts, and engineers stop reading them within a month.

   How the design avoids it

   Few assets, tuned thresholds, a reason on every alert, and alert precision measured from the start.

3. 3

   Goes wrong

   The CMMS failure history is too poor to learn from.

   How the design avoids it

   Check it in discovery. Start with anomaly detection and engineers' feedback, and fix failure coding as you go.

4. 4

   Goes wrong

   Planned services get stretched because 'the model says it's fine'.

   How the design avoids it

   Intervals only change on evidence, with the maintenance manager's approval, and statutory inspections never move.

5. 5

   Goes wrong

   A cloud dependency nobody planned for stops a plant.

   How the design avoids it

   Design for the link to fail. Machines never depend on the cloud, and the edge keeps collecting on its own.

1. From 20 January 2027
   The EU Machinery Regulation (2023/1230) applies. It adds cybersecurity requirements for connected machinery and stricter assessment for safety components that use self-learning AI. Great Britain will keep recognising CE-marked machinery that meets it (SI 2026/867).

   Keep AI out of safety functions entirely. Ask suppliers of new machines how they'll deliver security updates and what data interfaces they offer.

2. Late 2026–2028
   The Cyber Security and Resilience Bill brings medium and large managed service providers into regulation, with faster incident reporting, and lets regulators designate critical suppliers.

   Check whether your IT or OT support provider is in scope, and update contracts and incident reporting to match.

3. From 2026
   The Industrial Strategy's advanced manufacturing plan extends Made Smarter adoption support for SME manufacturers in England, and the government's June 2026 AI adoption plan for advanced manufacturing proposes a scan, pilot and scale route.

   If any plant or key supplier qualifies as an SME, check what support is available for the pilot.

4. 20 September 2029
   Azure IoT Central retires. Microsoft points customers to Azure IoT Hub and Device Provisioning Service for connectivity, and Fabric for analytics.

   Don't build anything new on IoT Central. If a plant already uses it, plan the move as part of this work.

5. 2028
   The NCSC's post-quantum cryptography milestone: a full migration plan by 2028.

   OT equipment lasts 20 years or more. Record the encryption used on every plant connection, and choose gateways whose cryptography can be updated.