
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Guide
This guide is for leadership teams and operations directors at manufacturing companies who want to see what AI could change in their plant. We show which applications work straight away and which first need data from machines. We also explain when cybersecurity and AI regulations apply to a plant, and how to plan the first three months.

AI in manufacturing covers two very different kinds of project. The first concerns the office around production: orders, documents, planning and reports. The second concerns the line itself: quality control, machines and their parameters.
Office projects do not interfere with how machines run, use data the company already has and deliver results quickly. Line projects need data from sensors and cameras, a connection to PLCs (the computers that control the machines) and a longer pilot. The table below shows what each area needs and what is worth measuring.
| Area | What it needs | Risk to production | What to measure |
|---|---|---|---|
| Taking in orders from emails and PDFs | Access to the mailbox and the product master data in the ERP | Low – a person approves the order | Time from receiving an order to confirming it, number of errors |
| Reading technical documents | Sample documents and rules on what to extract from them | Low – a process engineer checks the data | Time to prepare a production order |
| Reports and metrics for the management board | Data on machine operation and orders from the ERP, a production system or simple data loggers | None | Time to prepare a report, how current the data is |
| Supporting the planner | Up-to-date data on orders, materials and capacity load | Low – the planner makes the decision | Number of plan changes per week, on-time delivery |
| Image-based quality control | Cameras, constant lighting, images of good and defective products | Medium – wrong rejects or defects let through | Defects that reached customers, false alarm rate |
| Machine failure prediction | Sensor data and a history of breakdowns with their causes | Medium – false alarms or missed failures | Unplanned downtime of critical machines |
Customer orders arrive by email, as a PDF, an Excel spreadsheet or a printout from the customer’s purchasing portal. Someone in the office retypes them into the ERP, looks up products in the master data, checks prices and confirms the delivery date. Customers use their own names and numbers, so retyping takes knowledge and care.
An AI assistant reads the order, recognises products even by the customer’s own names and matches them to item codes in the ERP. It prepares a ready draft order and, when data is missing, such as a quantity or a date, flags it for clarification. An employee checks the draft and approves it with one click.
Do the calculation on your own figures. Suppose the office handles 60 orders a day, and retyping and checking each one takes 6 minutes. That is 6 hours a day, or three-quarters of a full-time job, plus the cost of mistakes in item codes and quantities.
This kind of solution is often built in Microsoft 365 using Power Automate, a tool for moving data automatically between programs, and Copilot Studio, where AI assistants are created. You can also build a separate application connected to the ERP.

In many mid-sized companies, the production plan is drawn up in Excel or an ERP module, but the key decisions are made in the head of an experienced planner. When that person is ill or leaves, the company loses knowledge that nobody has written down.
AI does not replace the planner; it shows them the consequences of their decisions. It brings orders, material availability, machine load and customer deadlines together in one view. The planner can check what will happen if an order is moved by two days and gets an early warning when a deadline is at risk.
A mid-sized company rarely needs an expensive specialist production scheduling system for this. Often it is enough to tidy up the data in the ERP and build a simple view with suggestions on top of it.
In many plants, the production manager puts together a weekly report by hand from several spreadsheets. The management board gets the data late and cannot react during a shift. Power BI, Microsoft’s tool for reports and charts, pulls data automatically and refreshes it on a schedule, even several times a day.
The most commonly measured metric is OEE, or overall equipment effectiveness. It is the product of three figures: machine availability, performance and product quality. For example, 90% × 85% × 98% gives an OEE of about 75%, and the report shows which of the three components is pulling the result down.
The data can come from the ERP, from a manufacturing execution system (a program that records how work progresses on the shop floor) or from simple data loggers on the machines. An AI assistant can also point out unusual changes and answer the management board’s questions, but it is always worth checking the figures in the source report.

The best AI projects in manufacturing do not start with a model. They start with the process that takes up most of people’s time today.
A camera with an AI model can spot scratches, missing parts, discolouration or wrong labels faster than a person at the conveyor, and without the drop in attention at the end of a shift. This is one of the areas where AI has a clear technical advantage. However, it only works well in repeatable conditions.
The most common causes of failure are variable lighting and too few examples of defects. The model has to see many images of each type of defect, and rare defects are hard to collect. The system also has to be connected to the line PLC so that a defective product is rejected automatically.
Start with a pilot at one workstation, ideally where defects most often reach the customer. Throughout the pilot, run manual inspection in parallel and compare the results. Only that comparison will tell you whether the system is better than your current inspection.
Failure prediction means that an AI model analyses sensor data, such as vibration, temperature or power consumption, and warns of an approaching fault. In practice it is often confused with simple monitoring, which only raises an alarm when a threshold is exceeded.
For a model to predict anything, it needs history: sensor data from many months and a record of breakdowns with their causes. If the department responsible for keeping machines running does not record the causes of breakdowns, the first step is to change that habit, not to buy a model.
Start with a few machines whose failure stops the whole line and costs the most. At first, the goal is early warnings for the maintenance technicians. A full replacement schedule based on forecasts is only the next stage.
Not every manufacturing company is subject to cybersecurity regulations. The amended Polish National Cybersecurity System Act, which implements the NIS2 Directive, covers only selected manufacturing sectors. A size threshold must also be met: as a rule, at least 50 employees, or turnover and balance sheet total above EUR 10 million, taking linked companies into account.
Medium-sized and large companies in these sectors are important entities. If your company meets both conditions and has not applied to be entered in the list, the matter needs urgent attention, because the deadline passed on 3 October 2026. AI projects that connect the office network with the machine network must then fit within the security rules required by 3 April 2027.
The AI Act rarely applies to office projects in manufacturing, apart from the Article 4 obligation to support employees’ knowledge of AI. It matters more to manufacturers of regulated products, such as medical devices, in which AI performs a safety function. The list below sets out the manufacturing sectors covered by NIS2, and the table summarises the deadlines.
| Regulation | Who it applies to | From when |
|---|---|---|
| AI Act, Article 4 – employees’ knowledge of AI | Every company whose employees use AI | 2 February 2025 |
| Polish National Cybersecurity System Act (NIS2) | Medium-sized and large companies in selected manufacturing sectors | In force since 3 April 2026; obligations to be implemented by 3 April 2027 |
| Machinery Regulation (EU) 2023/1230 | Machinery manufacturers, including those with safety functions based on machine learning. After the July 2026 changes to the AI Act, this is mainly the act that regulates AI in machinery | 20 January 2027 |
| AI Act – high-risk systems under Annex I | Manufacturers of regulated products, such as medical devices, in which AI performs a safety function | 2 August 2028 |
The safest approach is to start with one process and make one decision after the pilot. The plan in the list below is an example of how the first three months might be laid out. It always depends on the number of systems that need connecting and on the availability of people on the company’s side.
The most important thing is a person on the plant’s side who is responsible for the process, such as the customer service manager or the production manager. Without them, the project will stall on questions about exceptions that nobody has time to answer.
The worst start is buying a ready-made “Industry 4.0” platform, meaning an extensive system for digitising the whole factory, with no chosen process and no data. The company pays for licences, and the rollout ends with a demonstration that never makes it into everyday work.
It is also too early for AI when every department keeps the same data in its own spreadsheet and nobody knows which one is current. The same applies when there are only a few orders a day and nobody records the causes of breakdowns. In that case, you first put data and processes in order, and only then choose the tools.
Related topics in the knowledge base
FAQ
Questions that manufacturing leadership teams ask before their first AI project.
About this page
Sources
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation, we will go through the processes around your production and identify one that is worth piloting first. We will prepare a quotation after that conversation.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.