On this page
The quote that went out on the wrong revision
A scenario, not a reported case.
A customer sends an RFQ for 400 pieces of a bracket your shop has made three times before. The estimator is behind, so the quote goes out from last year's job: same routing, same setup time, same price per piece. The customer issues a PO the next week. Nobody checks the drawing in the package against the vault, and nobody notices it is revision D, with a bore tolerance tightened from ±0.005 in to ±0.002 in and an added anodize step. The first article fails. The second setup eats the margin on the order, and the outside processor's lead time pushes the ship date past the customer's promise.
The check that would have caught it is mechanical: compare the RFQ revision with the released one, list what changed, price from actual hours, show the estimator. An agent can do that on every RFQ before a person signs.
- 4.21% to 10.00%
- Operating margin of US manufacturing corporations with under $50 million in assets, lowest and highest of the five quarters to Q2 2026[1]
- 19.5%
- Manufacturers that used AI in any business function in a two-week period in September 2026, up from 12.7% in November 2025[2]
- About a third
- Share of the short-run AI productivity losses at older plants explained by dropping structured management routines (Census plant data)[39]
On margins that thin, a few mispriced jobs move the quarter. AI use in manufacturing is spreading from a low base, and the plants that dropped their KPI boards and targets while adopting it lost the most. The rest of this page is about adding agents to the quoting, purchasing and quality office without repeating that.
The short version
AI-enabled vs AI-native in a plant
A vision camera on one line, an assistant inside the ERP, a quoting tool the estimator opens when there is time. Each sits beside the work, and the work runs the way it did.
Every RFQ, purchase order, acknowledgement, nonconformance and engineering change starts as an agent's draft from the plant's own records, checked against written rules. A named person commits the price, the date, the disposition or the release, and the record shows who decided and on what evidence.
A plant can own a lot of AI and still be AI-enabled. The test is whether a quote, a PO or an NCR starts as a draft from the plant's own job history and released revisions, and whether you can show afterwards who committed it. The shop floor stays under the plant's own control systems; agents work in the office and read the signals the floor sends.
The missing layer
No plant will replace its ERP, drawing vault or quality system to become AI-native. Agents get added around them, from the ERP vendor, from quoting tools, or set up by the plant. Each needs limits, approvals, a list of drawings it may read and a record of what it did. The ERP governs its own agents. None of these systems governs an agent that reads the vault, drafts in the ERP and emails a supplier in one task.
OrchKernel fills that gap. Agents ask it before they act; it checks the rules, holds what needs a person, and records the result. It does not replace the ERP, MES, vault or QMS, which stay the systems of record, and it has no connection to machine controls. Details are in the OrchKernel blueprint.
Each works for a named estimator, buyer or quality engineer, with no more access than that person.
- Approvals
- Rules
- Data classes
- Human queue
- Audit log
Allows, holds for a person, or denies, and records which.
- ERP
- PDM vault
- QMS
- Supplier and customer portals
- MES
- Historian
- Condition monitoring
- Inspection results
- CMMS
A predicted stop or a yield drop reaches the office agents as an event to act on.
- PLCs and safety-rated code
- Setpoints
- Lockout/tagout
- Safety interlocks
These stay with the controls engineer, the maintenance lead and the plant's procedures.
Where the hours and the margin go
Most manufacturers are small. Of 239,265 US manufacturing firms, 93.1% have fewer than 100 employees and about three in four have fewer than 20[41]. This playbook is written for a plant with a handful of people per office function, not a shared-services center.
Their margins move fast. Census figures for manufacturing corporations with under $50 million in assets show an operating margin of 10.00% in Q2 2025, 4.21% in Q4 2025 and 8.97% in Q2 2026. After tax, the same group earned 2.40% of sales in Q4 2025. All manufacturing earned a 12.77% operating margin in Q2 2026[1]. The Census tables do not split out office costs for this group.
A quarter of manufacturing jobs are office and engineering jobs. In May 2025, 3.28 million of 12.65 million manufacturing jobs (26%) were in management, business and financial operations, architecture and engineering, or office and administrative support. Mean annual wages were $55,120 for office support, $94,210 for business and financial staff and $105,930 for engineers[6]. That is where quoting, purchasing, quality paperwork and customer service happen.
Hiring will not close the gap. Manufacturing employment was 12.652 million in September 2026, up 0.3% on a year earlier[4], and openings fell to 522,000 in August[5]. Deloitte and The Manufacturing Institute project that 1.9 million of the 3.8 million manufacturing jobs needed from 2024 to 2033 could go unfilled[42].
The tasks, by role
What nobody has measured. There is no good public study of how a small manufacturer's office spends its hours, and no public benchmark for office labor as a share of a job shop's revenue. Member-only benchmarks exist at some trade associations. Measure your own baseline in the first 30 days; without it you cannot tell whether an agent helped or just moved the work.
RFQ to cash: where AI works today
A make-to-order plant runs nine steps from RFQ to cash. Seven of them are office work built on documents and records. The other two, making and physically inspecting the part, are where industrial AI such as machine vision and predictive maintenance works. The two tracks meet at the ERP. Here is the flow, with what an agent can draft and what a person commits at each step.
- 1RFQ intake#5
Lists drawings, revisions, quantities and clauses; flags gaps
Estimator decides whether to bid
- 2Review and clarify#5, 6
Checks revisions against the vault; drafts questions
Engineer sends the questions
- 3Estimate and quote#1
Drafts repeat-part quotes from actual hours and scrap
Estimator sets price; planning sets lead time
- 4Order entry#2
Checks the PO against the quote and lists differences
Order entry and quality accept the order
- 5Plan and buy#3, 4
Drafts POs, chases acknowledgements, lists changed terms
Buyer places POs and accepts changed terms
- 6Make#11
Nothing on the machines; reads floor signals
Supervisors and operators run the floor
- 7Inspect and record#7, 8, 14
Drafts NCRs, 8Ds, first article plans and certs
Quality decides the disposition and releases product
- 8Ship and invoice#8, 10
Prepares packing lists, invoices and customs drafts
Shipping and trade compliance sign
- 9After the sale#9, 15
Drafts status replies; triages complaints
Planning gives any new date; quality decides reportability
Who sells what
Categories, not recommendations. Every performance figure below is the vendor's own claim, not an industry benchmark.
What does not exist yet. We found no mature product that turns a customer's print and STEP model into a routing a small shop can trust without an engineer. Plan on agents drafting from your history, not inventing routings for new parts.
Where the money went. The large AI-native bets in manufacturing are new factories, not software for existing plants. Hadrian, which builds automated factories for defense and space parts, raised $260 million in July 2025[53] and $1.37 billion at about a $7.87 billion valuation in August 2026[54]. Instant quoting alone has not made the marketplaces rich: Xometry had $686.6 million of revenue in 2025 and an operating loss of $45.5 million[7]; Proto Labs, quoting online since the 2000s, earned a 4.7% operating margin on $533.1 million[8]. For a job shop they compete for simple parts.
What the evidence says about adoption
Use is rising, from a low base. In the Census Business Trends and Outlook Survey, 19.5% of manufacturing businesses used AI in some business function in late August and early September 2026, up from 12.7% in November 2025 when the question changed; 24.0% expect to within six months, and 10.3% did not know. In the same period, 49.0% of information firms and 43.9% of professional services firms used AI[2]. The two-week readings move around: the wave before was 23.4%. Use rises with firm size: across all sectors, 37% of firms with 250 or more employees used AI against under 20% of firms with fewer than 20[3]. The measure is broad. A plant where one person used a chatbot once counts.
Large manufacturers are further along. In Deloitte's 2024 survey of 600 manufacturers with $500 million or more in revenue, 29% used AI or machine learning at facility or network level and 24% had generative AI deployed at scale. Respondents reported 10% to 20% output gains from smart manufacturing as a whole, self-reported and not attributed to AI alone[43].
The J-curve
The most useful finding for a plant comes from Census data on tens of thousands of US plants. Kristina McElheran, Erik Brynjolfsson and colleagues find "J-curve-shaped returns, where short-term performance losses precede longer-term gains." About 23% of plants used some AI by 2021 and about 8% used it intensively. One standard deviation more AI use went with a 1.33 percentage point drop in productivity; correcting for the fact that plants expecting large gains adopt first, the short-run drop is far larger. AI use raised work-in-progress inventory, robot investment and labor shedding while hurting productivity and profit in the short run. At older plants, dropping structured production management, such as KPI tracking and targets, explains about a third of the loss[39]. As McElheran put it, "AI isn't plug-and-play"[40].
Dashed line: productivity before adoption.
- 1Plants adopt AI, often the ones expecting the largest gains.
- 2Short-run productivity and profit fall, and work-in-progress inventory rises. Older plants that drop KPI tracking and targets fall furthest.
- 3Plants that adopted earlier, and survived, show stronger growth over time.
The data covers industrial AI from 2017 to 2021, before generative agents, so it does not measure office agents. The mechanism still applies: a plant that stops running its routines while it adapts. That is why the staged path keeps the floor's routines untouched and starts with office work checked before it leaves.
The staged path
Six stages, ordered by the J-curve (keep the routines, expect a dip) and by where current AI is strongest: office documents checked before anything ships. Stages 2 and 3 can run side by side once Stage 1 is steady; Stage 4 waits until the office routines are proven.
- 0
Stage 0: Ground truth
Actual hours, matching revisions, classified drawings and a baseline.
About 4 to 8 weeks
What to do
- Check that the ERP records actual setup and run hours and scrap by job and operation.
- Reconcile the item master with the revisions released in the vault, and list every mismatch.
- List the quality clauses customers flow down: first article, material source, certs, special processes, retention.
- Classify drawings (ITAR, EAR, CUI, customer-confidential, none) and list every AI tool that can already read them, including assistants switched on in the ERP, email and CAD. Ban customer drawings from public chatbots.
- Record a baseline for quote turnaround, hit rate, on-time delivery, PO acknowledgements and NCR cycle time.
Why now
A repeat-part draft is only as good as the job history behind it, a revision mismatch an agent quotes becomes scrap, and a controlled drawing in the wrong service is an export or DFARS problem from the first prompt[9,13].
In place first
- An ERP administrator with time set aside.
- A named owner for export-controlled and CUI data, often the ITAR empowered official or the security lead.
What to measure
Share of closed jobs with actual hours by operation; share of active parts whose ERP revision matches the vault; share of drawings classified.
Common mistakes
- Skipping the baseline, so nobody can show later whether anything improved.
- Treating a vendor's SOC 2 report as the answer for CUI. DFARS 7012 asks for security equivalent to the FedRAMP Moderate baseline from cloud services that handle covered defense information[13].
- 1
Stage 1: Office drafts, people send
RFQ to order: the agent prepares, the estimator and order entry commit.
Starts when Stage 0 data covers the parts in scope
What to do
- RFQ intake: list drawings, revisions, quantities, clauses and gaps.
- Draft repeat-part quotes from actual job history, with the revision check shown.
- At order entry, check each customer PO against the quote and list every difference.
- Draft order-status replies from the ERP.
Why now
It is high-volume document work tied directly to revenue, and nothing leaves until a person sends it. A repeat part quoted from actual hours instead of memory, and a flowed-down clause caught at order entry, both show up in the job's margin.
In place first
- Quote approval thresholds written down: who approves what price, margin and lead time.
- Planning's current lead times available to the agent, so it never guesses one.
What to measure
Median quote turnaround; share of RFQs answered; hit rate by count and value; discrepancies caught at contract review; estimator edits per draft.
Common mistakes
- Letting the agent put a lead time in a quote that planning did not give.
- Filling a gap in job history with a guess instead of flagging the part as new.
- Counting hours saved instead of hit rate and margin.
- 2
Stage 2: Supplier and order follow-through
Acknowledgements, pushed dates and delay notices, under written rules.
After Stage 1 has a few months of clean records
What to do
- Chase unacknowledged POs: the buyer approves early reminders; routine ones run under rules once trusted.
- Compare each acknowledgement with the PO and list every changed term.
- When a supplier pushes a date, list the jobs and customer orders it hits, and draft delay notices for planning.
Why now
It catches late surprises before the customer does. Material prices in quotes go stale fast: steel, aluminum and copper tariffs were adjusted by proclamation three times in 2026 alone[26].
In place first
- Rules for which suppliers may be contacted, by whom, from which named mailbox.
- A written list of terms that always go to the buyer: price, quantity, date, payment, warranty, liability.
What to measure
POs acknowledged within your set number of days; late supplier deliveries found before the due date; supplier on-time delivery; customer on-time delivery to first promise.
Common mistakes
- Auto-accepting acknowledgements. Between merchants, added terms can become part of the contract unless the buyer objects in reasonable time[27].
- Letting an agent message suppliers from a shared inbox with no named sender.
- 3
Stage 3: Quality records and engineering change
Drafts of NCRs, 8Ds, first article plans, certs and change packets.
When the approval and record habits of Stages 1 and 2 are proven
What to do
- Draft NCRs, MRB packets, 8Ds and supplier corrective actions from the traveler and inspection data.
- Draft first article plans from the print and the flowed-down clauses, and prepare certs for quality to sign.
- Compare revisions and draft change packets listing affected parts, open jobs, stock and suppliers.
Why now
Quality records are audited by customers, registrars and sometimes regulators. For device makers, "record changes shall not obscure previously recorded information"[20]. Agents should touch these only once approvals and logging are proven.
In place first
- Retention rules per customer and regulation. FAA production approval holders, for example, keep quality records at least 5 years, 10 for critical parts[22].
- Part 11 validation where FDA rules apply; MRB membership and authority written down.
What to measure
NCR cycle time; repeat NCRs by cause; corrective actions closed on time; open orders caught on an old revision.
Common mistakes
- Letting an agent choose a disposition. Some dispositions need the customer too.
- Editing a released record instead of adding a new entry with a reason and an approver.
- 4
Stage 4: Signals from the floor
Predicted stops and yield drops turn into office work.
Later, and only with a named owner for each signal
What to do
- A predicted machine stop produces a list of affected orders and a draft customer note.
- A yield drop opens an NCR draft and a question to the supplier.
Why now
Machine data needs its own systems and safety limits. In Census plant data, production-side AI raised work-in-progress and cut productivity before it helped[39], so this waits until the office routines are steady.
In place first
- A maintenance or production owner for each signal.
- No agent write access to machine controls, setpoints or maintenance intervals.
What to measure
Unplanned downtime hours; first-pass yield; schedule attainment; customer notices sent before the customer asks.
Common mistakes
- Dropping tier meetings or KPI boards because "the system watches it now". The Census paper ties that lapse to the deepest losses at older plants[39].
- Giving an agent the ability to change setpoints or defer maintenance.
- 5
Stage 5: Operating model
Roles, reviews and reporting built around drafts and exceptions.
When Stages 1 to 3 run with evidence
What to do
- Redesign estimating, purchasing, quality and customer service roles around exceptions.
- Name the owner of agent operations; review rules, permissions and scorecards quarterly, and put agent changes through management of change.
- Tell customers who ask how you use AI, and brief the CMMC affirming official where CUI is in scope.
Why now
Freed time only shows up in margin if roles and targets change with it. Defense suppliers also have a named official who affirms continuing CMMC compliance[14], and agents that touch CUI are part of what they affirm.
In place first
- Named owners for agent operations, data and export/CUI.
- A year of records from the earlier stages.
What to measure
Gross profit per office employee; quotes per estimator; customer on-time delivery; audit findings closed.
Common mistakes
- Keeping estimator and buyer targets from before, so freed time turns into slack.
- Leaving customer rules about AI in email threads instead of in rules the agents check.
Your first 90 days
Stage 0 for one flow, then Stage 1 in draft mode. Repeat-part quoting is the usual choice because it is closest to revenue; PO acknowledgements are the choice when late material is the bigger pain. We do this with you as a design partner.
- Days 1 to 30
Pick one flow: repeat-part quoting, or PO acknowledgements. Name its owner. Write down the rules a good estimator or buyer already follows: price and margin thresholds, the terms that always need a person, the customers with special clauses. Classify the drawings and data that flow touches as controlled or not. Record four weeks of baseline numbers.
- Days 31 to 60
Connect OrchKernel to the ERP, the vault and the mailbox for that flow. Run agents in draft mode: people send everything. Track edits per draft, catches (revision mismatches, changed terms) and turnaround. Review the audit log with the owner every week.
- Days 61 to 90
Let routine, rule-covered actions run without a click, for example a second reminder on an unacknowledged PO. Keep every commitment (price, date, terms) with a person. Compare with the baseline and decide, with numbers, whether to widen the flow or start the next one.
How roles change
Inferred from the work, not from a survey; we found no data on how manufacturers are changing office roles. Where the time goes today is in the table above. In each role the agent assembles the quote, NCR or reply, and the person keeps the signature.
Decisions not to automate
Agents can prepare each of these. A named person makes the call, and the log shows who.
Rules that bite
The recurring requirements: control who and what sees technical data, keep quality records nobody can quietly change, and meet fixed reporting clocks. Voluntary frameworks such as the NIST AI Risk Management Framework[44] help organize the work but replace none of the rules below.
Export controls on technical data
Defense, space and dual-use work under ITAR or the EAR
Under ITAR, an export includes releasing technical data to a foreign person inside the United States, and release includes letting a foreign person "access, view, or possess unencrypted technical data"[9]. Sending or storing technical data is not an export if it is unclassified, secured with end-to-end encryption meeting FIPS 140-2 (or equivalent, at least AES-128), and not sent to or stored in a proscribed country[10]. The EAR has a parallel carve-out[11].
Civil penalties under the Arms Export Control Act currently reach the greater of $1,271,078 or twice the value of the transaction per violation, an amount adjusted for inflation each year[12].
For agents: A model must read a drawing in the clear, so the encryption carve-out does not obviously cover AI inference. Whether a service's processing, logging or human review counts as a release is a question for export counsel, service by serviceTo be confirmed. Until then, keep controlled drawings away from services that cannot show where data is processed and who can see it.
Defense cybersecurity: DFARS 7012 and CMMC
Contractors and subcontractors handling covered defense information or CUI
DFARS 252.204-7012 requires NIST SP 800-171, cyber incident reports "within 72 hours of discovery," preserved images for at least 90 days, and, for any external cloud service that stores, processes or transmits covered defense information, security equivalent to the FedRAMP Moderate baseline[13].
The CMMC program rule took effect on 16 December 2024[15] and the DFARS rule that puts it into contracts on 10 November 2025[16]. Phase 2, which adds third-party Level 2 assessments, begins one year after Phase 1[17]: about 10 November 2026. That date is derived from the rule text; check DoD has not moved itTo be confirmed. An affirming official must affirm continuing compliance[14].
For agents: A model API or agent platform that processes CUI drawings is a cloud service provider under the clause. Adding one changes the system security plan that a named official affirms.
Quality records
Medical device makers by regulation; aerospace and automotive suppliers mostly by contract and certification
FDA's Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016[18]; 820.35 sets what complaint records must hold[19]. Part 11 asks for "secure, computer-generated, time-stamped audit trails" and validated systems with access and authority checks[20].
FAA production approval holders need a quality system in which only authorized people make dispositions and records are kept at least 5 years[22]. AS9100, IATF 16949 and ISO 9001 add similar duties through customer contracts; they are paywalled and we did not quote them.
For agents: An agent that drafts or changes a quality record needs the same audit trail as a person, and no agent makes a disposition.
Reporting clocks
Consumer product makers (CPSC) and medical device makers (FDA)
CPSC says firms should report within 24 hours of information that reasonably supports the conclusion that a product has a defect that could create a substantial risk of injury, among other triggers[23]. Device makers file medical device reports within 30 calendar days of becoming aware, and within 5 work days where an event needs remedial action to prevent an unreasonable risk of substantial harm to the public health[21].
For agents: A triage agent that files a complaint as "cosmetic" can start a clock nobody sees. Complaints that mention injury, fire or safety go to a person's queue with the deadline attached.
Customs, origin and forced labor
Any plant that imports material or components
Negligent misstatements on entry can cost up to twice the lost duties, four times for gross negligence[24]. Under UFLPA, goods made wholly or partly in Xinjiang or by listed entities are presumed barred since 21 June 2022, and the importer must show by clear and convincing evidence that no forced labor was involved[25]. Section 232 tariffs on steel, aluminum and copper were adjusted by proclamation in April, June and July 2026[26]; check the current proclamation before pricing, as we have not restated rates here.
For agents: A proposed tariff code or origin claim is a statement the importer is liable for. Trade compliance signs it.
Safety around machines
Every plant
OSHA says "there are currently no specific OSHA standards for the robotics industry," and many robot accidents happen during programming, maintenance and setup[28]. Lockout/tagout covers servicing where unexpected startup could hurt someone[29].
For agents: An agent may suggest a maintenance action. It never clears a lockout, changes safety-rated code or defers safety-critical maintenance.
Worker data
Plants with biometric time clocks, monitoring, or workers in Illinois, New York or the EU
Illinois BIPA requires written notice and a signed release before collecting biometric identifiers such as fingerprint time clocks, with damages of $1,000 per negligent and $5,000 per intentional or reckless violation[58]. A 2024 amendment is reported to count repeated scans as one violation per personTo be confirmed. New York requires written, acknowledged notice at hiring of monitoring of phone, email and internet use, with penalties from $500 to $3,000[30]. In the EU, AI that allocates tasks or monitors and evaluates workers is high-risk under the AI Act[37], with those duties applying from 2 December 2027[38]To be confirmed, and inferring workers' emotions has been banned since 2 February 2025[37].
For agents: Keep biometric and monitoring data away from agents that do not need it; decisions from it stay with a person.
Contract law: who commits the firm
Every plant that buys and sells on purchase orders
Between merchants, additional terms in an acknowledgement become part of the contract unless they materially alter it, the offer limited acceptance to its own terms, or the buyer objects within a reasonable time[27]. In Moffatt v. Air Canada (2024), a tribunal held the airline liable for what its chatbot told a customer, rejecting the claim that the bot was a separate legal entity[57].
For agents: An agent that files acknowledgements without flagging changed terms lets them in by silence. An agent that tells a customer a lead time or a price speaks for the firm.
What failure looks like
Real cases first. Most are not AI failures; each shows a control an AI-native plant needs anyway.
Alaska Airlines 1282: four bolts that were never reinstalled
A door plug was removed in Boeing's factory and four bolts were not put back. The NTSB cited inadequate training, guidance and oversight of the parts removal process; workers lacked clear direction on when removal records were needed[31].
The control: A step that changes a product's state (removed, reinstalled, inspected) leaves a record before the next step can go ahead.
Kobe Steel: falsified inspection data
Disclosed in October 2017: falsified strength and durability data for aluminum, copper and steel products, reaching more than 500 companies including Toyota, GM, Ford and Boeing[56].
The control: Certificates and inspection records that cannot be changed without a visible trail, released by a named person (controls 8 and 14).
Samsung: internal data into a public chatbot
After sensitive internal data leaked through ChatGPT in April 2023, Samsung banned generative AI tools on company devices from 1 May 2023[55].
The control: Data access by role and field; controlled data reaches only models cleared for it (control 5).
Jaguar Land Rover: a cyberattack that stopped production
After an attack stopped production in 2025, the UK government backed a loan guarantee of up to £1.5 billion, citing about 120,000 jobs in the supply chain[32].
The control: Every connection an agent holds is a path into plant systems: scoped credentials, allowed hosts, a kill switch and incident clocks (control 13).
Moffatt v. Air Canada: the chatbot speaks for the company
A tribunal held the airline liable for its chatbot's wrong answer[57]. A lead time an agent gives a customer is the same kind of statement.
The control: Customer-facing commitments need a person's approval (controls 1 and 15).
Agent failures to design against (scenarios)
Scenarios, not reported cases. Each maps to the control points that stop it.
The OrchKernel blueprint for a manufacturer
OrchKernel sits between AI agents and the plant's office systems, as drawn in the missing layer. Agents ask it before they act; it checks the rules, holds what needs a person, and records what happened.
What it is not. OrchKernel is not an ERP, a vault, an MES or a QMS, and those stay your systems of record. It does not classify drawings, make a model provider FedRAMP-equivalent, validate a Part 11 system for you or touch machine safety. Whether a given model provider is acceptable for ITAR or CUI data is your decision with your export counsel and assessor.
The mechanisms
- Approvals
- An action waits for a named person, who sees the exact payload first: the quote with its price and lead time, the PO, the delay notice, the change packet.
- Rules
- Checked before every action: margin floors, lead times only from planning, PO value limits, approved suppliers, terms that always go to the buyer. A rule allows, holds or denies, with the reason.
- Acting on a named person's authority
- Each agent works for a named estimator, buyer or quality engineer and never has more access than that person; delegation only narrows it. A buyer's PO limit is the agent's limit.
- Data access by role and field
- Who sees which records and fields, and which models are cleared for which data class. A drawing tagged ITAR or CUI reaches only cleared models and hosts; outbound calls are checked against allowed hosts.
- Tamper-evident audit log
- Every request, rule result, approval and denial, hash-chained so an edited or deleted entry shows, and checkable with one command.
- Human queue
- Work only a person may do lands with an owner and a deadline: changed supplier terms, a complaint that mentions an injury, a revision mismatch, a disposition.
- Connections to your systems
- The ERP, PDM vault, QMS, email, file storage and supplier or customer portals, through their APIs, MCP servers or adapters for any REST API, under the same rules and log, each with a kill switch. Where a portal has no API, a person does that step.
Sixteen control points
Where a make-to-order plant needs a control whatever tools it uses, who owns it, how OrchKernel enforces it, and what stays in another system.
Quotes, orders and customers
Suppliers and purchasing
Drawings, changes and controlled data
Quality records and reporting
The floor, people and security
Limits. OrchKernel governs what agents do in the office systems it is connected to. An agent inside a vendor's product that does not go through OrchKernel follows that vendor's controls, so connect what you can and list what you cannot. OrchKernel is source-available under the Business Source License and runs on your own servers, so you can read the code that enforces these controls.
Scorecard by stage
Record a baseline before Stage 1 and track the same numbers at each stage. Apart from the Census margin and AI-use figures, no public benchmark exists for a small make-to-order plant, so compare each stage with your own Stage 0 numbers.
What we don't know yet
- How office staff in small plants spend their hours. No independent time study exists for estimators, buyers or quality engineers. Design partners will start with a four-week baseline.
- Quote hit-rate and turnaround benchmarks. Nothing public beyond vendor before-and-after claims; trade associations may hold member data.
- Whether sending controlled technical data to a model for inference is a release under ITAR or the EAR, which model endpoints a small defense supplier can use for covered defense information, and whether a self-hosted OrchKernel fits a typical system security plan. We want export counsel and a CMMC practitioner's view before saying more.
- Whether generative agents follow the same J-curve as the industrial AI of 2017 to 2021.
- Cost of poor quality and downtime figures. The widely repeated percentages could not be traced to a source we were able to open, so we left them out.
- Exact dates for EU AI Act duties on machinery and workplace AI, which we read in an unofficial copy and will confirm in the Official Journal.
Sources
Last reviewed October 2026. Sources were read in October 2026; dates are publication or data dates.
Primary sources
Government statistics, regulations, statutes, proclamations, investigation reports and SEC filings. EU AI Act text is read in an unofficial copy and its dates are to be confirmed in the Official Journal.
- 1Quarterly Financial Report: manufacturing, mining, trade and selected service industries, 2026 Q2, Table 1.0. US Census Bureau, released 8 September 2026.Small corporations means manufacturing corporations with under $50 million in assets
- 2Business Trends and Outlook Survey, sector data (sector 31 to 33, AI use questions). US Census Bureau, published 24 September 2026; reference period 24 August to 6 September 2026.
- 3AI use among businesses, by firm size. US Census Bureau, May 2026.
- 4Employment Situation, Table B-1 (manufacturing). US Bureau of Labor Statistics, September 2026, preliminary.
- 5Job Openings and Labor Turnover Survey, Table 1. US Bureau of Labor Statistics, August 2026.
- 6Occupational Employment and Wage Statistics, manufacturing (NAICS 31 to 33). US Bureau of Labor Statistics, May 2025 data.Pulled from the BLS public API for management, business and financial, engineering, and office and administrative support occupations
- 7Xometry, Inc. annual report (10-K) for fiscal 2025, company facts. US Securities and Exchange Commission, XBRL data, filed 24 February 2026.
- 8Proto Labs, Inc. annual report (10-K) for fiscal 2025, company facts. US Securities and Exchange Commission, XBRL data, filed 20 February 2026.
- 922 CFR 120.50 (export) and 120.56 (release). eCFR, International Traffic in Arms Regulations.120.56 is at the same address with section-120.56
- 1022 CFR 120.54(a)(5): activities that are not exports, including end-to-end encrypted data. eCFR, International Traffic in Arms Regulations.
- 1115 CFR 734.18(a)(5): activities that are not exports, reexports or transfers. eCFR, Export Administration Regulations.
- 1222 CFR 127.10: civil penalty. eCFR, International Traffic in Arms Regulations, text current in October 2026.Amounts are adjusted for inflation each year
- 13DFARS 252.204-7012: safeguarding covered defense information and cyber incident reporting (May 2024). eCFR, Defense Federal Acquisition Regulation Supplement.
- 14DFARS 252.204-7021: contractor compliance with the CMMC level requirements (November 2025). eCFR, Defense Federal Acquisition Regulation Supplement.
- 15Cybersecurity Maturity Model Certification (CMMC) Program, final rule (32 CFR Part 170). Federal Register, 89 FR 83092, 15 October 2024; effective 16 December 2024.
- 16DFARS: assessing contractor implementation of cybersecurity requirements (DFARS Case 2019-D041), final rule. Federal Register, 90 FR 43560, 10 September 2025; effective 10 November 2025.
- 17
- 18Quality Management System Regulation (QMSR). US Food and Drug Administration, in effect from 2 February 2026.
- 19
- 20
- 21
- 22
- 2316 CFR 1115.14: time computations and timeliness of reports. eCFR, Consumer Product Safety Commission.
- 2419 USC 1592: penalties for fraud, gross negligence and negligence. Legal Information Institute, Cornell Law School.Copy of the statute
- 25Uyghur Forced Labor Prevention Act. US Customs and Border Protection.
- 26Proclamation 11032: further adjusting the tariff regimes for imports of aluminum, steel and copper. Federal Register, document 2026-11314, signed 1 June 2026.Earlier and later proclamations on the same metals: 2026-06960 (April 2026) and 2026-14990 (July 2026)
- 27UCC 2-207: additional terms in acceptance or confirmation. Legal Information Institute, Cornell Law School.Model text; check your state's enacted version
- 28Robotics: safety and health topic. Occupational Safety and Health Administration.
- 29
- 30New York Civil Rights Law 52-c: electronic monitoring by employers. New York State Senate.
- 31In-flight separation of left mid exit door plug, Alaska Airlines flight 1282 (DCA24MA063), report AIR-25-04. National Transportation Safety Board, board meeting 24 June 2025.
- 32Government backs Jaguar Land Rover with £1.5 billion loan guarantee. UK Government (GOV.UK), 28 September 2025.
- 33Machinery: Regulation (EU) 2023/1230. European Commission.
- 34Liability for defective products: Directive (EU) 2024/2853. European Commission.
- 35Cyber Resilience Act. European Commission.
- 36Data Act. European Commission.
- 37EU AI Act: Annex III point 4 (employment) and Annex I (Union harmonisation legislation, Sections A and B). Regulation (EU) 2024/1689, unofficial copy at artificialintelligenceact.eu.Annex I is at /annex/1/; Article 5 prohibitions at /article/5/
- 38EU AI Act, Article 113 as amended, and implementation timeline. Regulation (EU) 2024/1689, unofficial copy at artificialintelligenceact.eu, timeline updated 31 August 2026.Dates to be confirmed in the Official Journal
Industry bodies and independent research
The National Association of Manufacturers, Deloitte with The Manufacturing Institute, NIST, and research on Census plant data.
- 39The Rise of Industrial AI in America: microfoundations of the productivity J-curve(s) (CES WP 25-27). Kristina McElheran, Mu-Jeung Yang, Zachary Kroff and Erik Brynjolfsson, Census Center for Economic Studies working paper, April 2025.Industrial AI at US plants, 2017 to 2021; predates generative AI
- 40The productivity paradox of AI adoption in manufacturing firms. MIT Sloan School of Management, 9 July 2025.
- 41Facts about manufacturing. National Association of Manufacturers, citing Census data for 2022.
- 42Taking charge: manufacturers support growth with active workforce strategies. Deloitte and The Manufacturing Institute, 3 April 2024.
- 432025 Smart Manufacturing and Operations Survey. Deloitte, fielded August to September 2024; 600 manufacturers with $500 million or more in revenue.
- 44AI Risk Management Framework (AI RMF 1.0) and the generative AI profile (NIST AI 600-1). National Institute of Standards and Technology, January 2023 and July 2024; revision concept note April 2026.
Vendor sources
Published by companies that sell AI or automation to manufacturers. Directional, not an industry benchmark.
- 45
- 46Where AI in manufacturing is headed, according to the people building it. Paperless Parts blog, 2025.Vendor source
- 47
- 48
- 49
- 50Machine health and predictive maintenance. Augury.Vendor sourceIts Forrester Total Economic Impact study is commissioned by the vendor
- 51
- 52
Company and press
News coverage and encyclopedia summaries, used where no primary text was reachable.
- 53Hadrian raises $260M to build out automated factories for space and defense parts. TechCrunch, 17 July 2025.
- 54Defense tech Hadrian raises $1.37B at $8B valuation. TechCrunch, 6 August 2026.
- 55Samsung bans use of generative AI tools like ChatGPT after April internal data leak. TechCrunch, 2 May 2023.
- 56
- 57
- 58