Digital Packaging Summit Day 3: Sustainability and Cybersecurity

By Kalie VanDewater

Starting off strong on the final day of sessions at Digital Packaging Summit 2025, Marco Boer, conference co-chair and vice president of I.T. Strategies, hosted a fireside chat to dig into sustainability and its impact on the packaging and labels industry.

One of the big things on the minds of printers and converters is the regulations they need to adhere to. Sara Osorio, environmental, health and safety affairs coordinator at PRINTING United Alliance, said that part of the challenge is that there is no standardization.

For instance, in the United States, seven states have passed extended producer responsibility (EPR) legislation, while another 12 are currently considering implementing EPR regulations.

Sara Osorio (right) chats with Marco Boer about the implications and opportunities sustainability holds for package and label producers.

In many cases, the "producer" in EPR is the brand, but Osorio said that some states will consider the converters producing B2B packaging as the "producer" under scrutiny. However, she also noted that some states have exemptions. For instance, in California, if you can prove that your product has at least a 70% recovery rate, you are exempt from EPR regulations.

"That's kind of part of the problem with this whole EPR situation in the U.S.," Osorio said. "Every state is handling it, completely different. There's really very little overlapping."

To further complicate things, many label and packaging providers work with brands who sell their products in other countries, such as Canada and the EU, which are also adopting regulations.

In the EU in particular, the concern is the European Union Deforestation Regulation (EUDR), which, as the name suggests, is intended to stop deforestation by requiring strict due diligence for any products that enter or leave the EU.

"The big [requirement] that everybody is kind of freaking out about is the geolocation, and pinpointing that exact plot of land where the tree was cut down," Osorio said.

But she noted that there is not currently clarity on what that would look like in practice, and that the Commission is working to simplify the EUDR.

"So right now, the way the regulation is written is that every single person that touches that product, every single notch in supply chain, has to have that due diligence record for the EU," Osorio said. "They're trying to simplify it, so you can just use the the initial supplier."

The other simplification they are working on cutting back on the due diligence requirements for negligible risk countries, which are countries not at high risk of deforestation and where they allow their forests to renew themselves.

As of now, there are some delays in implementation. Regardless, big companies are required to comply with EUDR by December of this year, and smaller companies by mid-2026.

Addressing Forever Chemicals

Another topic of concern is PFAS, which are per- and polyfluoroalkyl substances. Often called forever chemicals, PFAS are man-made chemicals that are highly toxic. In the packaging and label industry, they can be found in slip agents and inks. PFAS are also used for scratch resistance.

"Unfortunately, there's been a lot of studies where they're linked to endocrine disruption; they're linked to certain forms of cancer, so there are a lot of bans in place now to ban them in certain products," Osorio said.

To address this, Osorio said that ink manufacturers will need to rethink their formulations. While she acknowledged that this may be a challenge, she also pointed to it as an opportunity for ink manufacturers.

"Sustainability is all about innovation," she said. "And the innovators and the ones that are able to solve these problems and find these new technologies that remove these these harmful chemicals are going to be the shakers and the movers that are going to take this to the next level. So, it can be a little daunting. Change is difficult. But I do think that in order for us to embrace sustainability, we have to be a little open to that innovation, that change, and really embracing it in a holistic and whole manner."

Recyclability

Recyclability of a product has long been a concern for brands, and therefore a necessity for their packaging and label producers to consider.

Like the potential regulations a package must comply with in different countries or states, recycling capacity varies from area to area.

"The problem with recyclability is that a product might be inherently recyclable, but that region or that area might not have the infrastructure to recycle it," Osorio said. "So, the product, you can recycle it, or the plastic will be recycled, but if the infrastructure doesn't exist, then is it really recyclable?"

Looking forward, Osorio sees some big changes coming for substrates and inks in the U.S. These include movements toward fiber-based packaging where possible, and more innovation with bioplastics and bio-based pigments.

"A big issue with recycling in the past has been that when you put the plastic through the mechanical recycling process, they then put it through a caustic wash to clean it off," Osorio noted. "And what would happen is that the pigments would kind of de-ink and get into the water and stain the plastic and render it less recycle or less valuable."

One promising innovation that may address this issue that she's seen recently is magnetic ink.

"There are magnets that pull out metal, obviously, when they're going when the plastic is going through the conveyor belt to make sure that no [metal] gets into the machine," Osorio said. "So the ink actually has microscopic metal particles that then get pulled off — the shredded ink and label get pulled off by the magnet during the recycling process."

Opportunities in Sustainability

While there are several challenges with sustainability, it's important to note that it's not all bad news for package and label printers and converters. Osorio said that it's important to remember that even though much of the emphasis for sustainability is placed on the planet, there are two other essential pillars: people and profit.

"I think sustainability is important because it really is something that fits holistically into your business," Osorio said. "And if it's something that you implement at every level as it should be, it's going to be beneficial. Because if you're looking at it from the people perspective, that means that you have a strong safety culture, your employees are safe. That leads to better production, that leads to keeping people happy and retaining them, which is another big issue in the industry."

On the profit side, you can definitely see cost savings when you pursue sustainability. For example, investing in energy efficiency means you'll see lower energy bills, and installing low-flow toilets means you'll be spending less on your water bill.

And while some converters and printers might be hesitant to spend on sustainability measures, Osorio sees it as just another way to lift your business up.

"There's a lot of different ways that sustainability can be profitable," she said. "The one thing I will say on that, too, is that you make investments for your business every day. It's just another investment."

Cybersecurity and AI

In the afternoon, Amy Servi-Bonner, vice president of consulting, applied AI and printing technology, at PRINTING United Alliance, led the session "Cybersecurity & AI in Packaging: What Would You Do When It Hits the Fan?" In her session, she dove into why it's easier than ever for attackers to infiltrate your company, and what packaging and label providers should do when things go wrong.

Servi-Bonner said that packaging and label converters and printers are prime targets for ransomware attacks. Why?

Amy Servi-Bonner discusses the very real threat of cyberattacks.

"This segment of the print industry spends the least amount on cybersecurity," Servi-Bonner said. "See, hackers, they've kind of figured out that packaging companies and converters who work with brands — those brands rely on you. They trust you. You're part of their supply chain, yet you might be the weakest link that an attacker can exploit to reach someone else."

And cyberattacks have only become easier — in part due to the rise of ransomware-as-a-service (RaaS).

"They're actually selling crime," Servi-Bonner said. "There's subscription model, cybercrime platforms [and] programs that you can you can engage in, even to the extent of having customer support to help you deploy ransomware campaigns. So you don't even have to be a sophisticated actor anymore to launch attacks."

She shared some stark statistics:

55% of ransomware attacks hit companies with fewer than 100 employees.
68% of of attacks start with an AI-written phishing email.
Downtime caused by an AI cyberattack costs a small business $8,000 per hour on average.

To get a sense of how prepared they are for a ransomware attack, Servi-Bonner had attendees talk among themselves to determine how they would handle the first 24 hours following a cyberattack. Many outlined these gut instincts:

Hour 1: Call IT.
Hour 6: Tell no one yet.
Hour 12: Start restoring backups.
Hour 24: Back online.

But Servi-Bonner outlined a more solid action plan:

Hour 1: Isolate network immediately and activate your incident response plan.
Hour 6: Notify leadership, insurer, and legal, and log every action.
Hour 12: Verify that your backups are not infected. AI tools will check data integrity.
Hour 24: Don't let anyone touch anything. Let forensics investigate first, and use your AI models to identify the root cause.

"Your instincts are emotional; the right moves are practical," she emphasized. "And these are things that everybody — I'm telling you, in this room, no matter what role you're in in the organization — has to understand, if nothing else, to keep somebody from losing their mind."

She also encouraged attendees to create and regularly maintain their cyber-resilience system.

Before an attack happens, Servi-Bonner said it's critical to make sure that every piece of your business is prepared. To do this, she recommended running AI-driven tabletop drills on a quarterly basis to simulate how your company would respond during a ransomware attack attempt. She also pointed out the importance of segmenting and isolating your backups; training with simulated phishing that uses your own email tone; and auditing your connections with every vendor.

During an attack, she reiterated that AI tools should be used to identify the root cause of the breach, and to figure out how it spread to the rest of your system. She also said precise communication with your internal team is critical, and that you should decide early if you want to pay the ransom, negotiate, or rebuild.

Once the attack has been addressed, put AI to work reconstructing the timeline of the cyberattack for legal and insurance purposes, and use that data to strengthen your models.

"Sometimes the breach is the best teacher," Servi-Bonner said.

When all is said and done, make sure to review the scenario and retrain your team — and stay up to date by repeating the process.

Servi-Bonner left listeners with this thought: "If AI doesn't hit your P&L, it's just entertainment. But if cyber hits your art files, it's catastrophe."

The event closed with the awards dinner, where the best case study presentations for labels, folding carton, corrugated, and flexible packaging were awarded, as were the company to watch awards (there was a tie this year!) and the overall contributing attendee award. The awards ceremony was followed by a performance by a mentalist.