EU Machinery Regulation 2023/1230: What Businesses Need to Know Before 2027

The EU machinery safety framework is changing. Regulation (EU) 2023/1230 will generally apply from 20 January 2027, replacing Machinery Directive 2006/42/EC. For manufacturers, importers, integrators and businesses modifying machinery, the transition brings important considerations for conformity assessment, digital safety systems and technical documentation.

The underlying principles of machinery risk assessment remain familiar, but modern machinery increasingly relies on software, remote access, automation and autonomous functions. This guide outlines the key changes and the questions organisations should address before the new rules apply.

Why is the Machinery Directive being replaced?

Unlike a directive, which must be transposed into national law, an EU regulation applies directly across Member States. The aim is a more consistent machinery safety framework that also addresses technological developments since the 2006 Directive. Machinery placed on the EU market in conformity with the existing Directive before the new application date can continue to be made available under the transitional provisions.

1. What counts as a substantial modification?

One significant change is the formal definition of “substantial modification” in Article 3(16). This concerns an unplanned physical or digital change made after machinery is placed on the market or put into service, which creates a new hazard or increases an existing risk and requires specified changes to safety controls or measures for stability or mechanical strength.

Under Article 18, the person or organisation carrying out a substantial modification may assume manufacturer responsibilities for the modified machinery. These can include a risk assessment, compliance with applicable Essential Health and Safety Requirements (EHSRs), technical documentation, conformity assessment and an EU Declaration of Conformity.

Example: changing a conveyor

Consider a conveyor upgraded from 0.5 m/s to 1.5 m/s. If the increased speed raises an existing risk and requires guards or protective devices that change the safety control system, the modification may meet the definition of substantial modification. The outcome depends on the actual modification and risk assessment; a speed increase alone does not automatically mean the machine must be CE marked again.

2. Cybersecurity is now a machinery safety issue

Connected machinery may use remote access, programmable controllers, networked sensors and software-based safety functions. The Regulation addresses protection against accidental or intentional corruption of safety-related hardware, software and data. A cyber incident is therefore not only an IT concern when it can create a hazardous machinery condition.

• Unauthorised changes to PLC or safety parameters could defeat safeguards.
• Manipulated interlock or sensor signals could allow operation while a person is in a danger zone.
• Compromised remote access could change machine settings without appropriate control.

For example, reducing a robot cell’s protective laser-scanner field from 2 m to 0.5 m without authorisation could prevent the robot from stopping early enough, creating a crushing or impact risk. Manufacturers should consider the security of safety functions as part of machinery risk management.

3. AI, autonomous machinery and safety-related software

The Regulation recognises systems whose behaviour may vary, including machinery using machine learning or autonomous functions. Where such technology contributes to safety, documentation and validation need to address system capabilities, limitations and the methods used to develop, test and verify it.

Software can also qualify as a safety component where the relevant criteria are met. Safety-related control functions, monitoring, protective functions and safe-motion systems should therefore be considered within conformity assessment, rather than treated as secondary software features.

4. What changes for high-risk machinery and conformity assessment?

The previous Annex IV structure is replaced by Annex I, divided into Parts A and B. The applicable assessment route depends on the machinery category and the extent to which relevant harmonised standards or common specifications cover the EHSRs.

• Annex I, Part A: an applicable conformity assessment procedure involving a notified body is required.
• Annex I, Part B: internal production control may be possible where the specified conditions concerning harmonised standards or common specifications are satisfied.
• Machinery outside Annex I: internal production control is generally available, subject to applicable requirements.

Organisations should classify the machinery first, then select the appropriate conformity assessment route rather than assuming that self-assessment is always sufficient.

5. Digital instructions and technical documentation

Digital instructions are permitted subject to accessibility conditions. Access information must be supplied with the machinery; instructions must be downloadable and available online for the expected lifetime of the product and at least 10 years after it is placed on the market. A paper copy must be supplied free of charge within one month where requested at purchase. Essential safety information for machinery intended for, or reasonably foreseeable to be used by, non-professional users must still be provided on paper.

Technical documentation remains essential and may need to address safety-related software logic, validation, system limitations and relevant data for sensor-driven or autonomous systems. The EU Declaration of Conformity may also be made accessible through an internet address or machine-readable code, subject to the Regulation’s conditions.

6. Essential Health and Safety Requirements and standards

The established risk-reduction approach remains: define machinery limits, identify hazards, estimate and evaluate risks, eliminate hazards where possible and apply protective measures for remaining risks. The assessment should also consider connectivity, digital modifications and autonomous behaviour where relevant.

Relevant technical standards discussed by our machinery safety team include EN ISO 12100 (risk assessment), EN ISO 13849-1 and EN IEC 62061 (control-system safety), EN ISO 14120 (guards), EN ISO 14119 (interlocking), EN ISO 13850 (emergency stops), EN ISO 13857 (safety distances), EN ISO 13855 (safeguard positioning) and EN 60204-1 (electrical equipment). Check the applicable editions and harmonisation status for each project.

7. What should manufacturers, importers and operators do now?

The Regulation distinguishes responsibilities for manufacturers, authorised representatives, importers and distributors. Organisations purchasing machinery from outside the EU should establish which legal role they fulfil and what checks, documentation and traceability duties follow.

• Review machinery projects and planned modifications ahead of 20 January 2027.
• Check whether changes to existing equipment could meet the substantial-modification definition.
• Identify any Annex I classifications and the conformity assessment route required.
• Review safety-related software, remote access and cybersecurity risks.
• Update technical-file, instruction and validation processes where needed.
• Confirm the responsibilities of manufacturers, importers, distributors and integrators in the supply chain.

Common mistakes to avoid

• Assuming every machinery upgrade is automatically a substantial modification—or that none are.
• Treating cybersecurity as separate from safety-related control functions.
• Assuming all machinery can follow internal production control without checking Annex I.
• Providing digital instructions without meeting access, retention or paper-copy requirements.
• Leaving software validation and technical-file updates until the end of a project.

Frequently asked questions

When does EU Machinery Regulation 2023/1230 apply?

It generally applies from 20 January 2027, when Machinery Directive 2006/42/EC is repealed. Some provisions have earlier application dates.

Will existing CE-marked machinery need to be reassessed?

Machinery lawfully placed on the market under the Directive before the application date benefits from transitional provisions. Later substantial modifications may create new obligations.

Does every machinery modification require new CE marking?

No. The Article 3(16) criteria must be considered in the context of the actual change, hazards, risks and protective measures.

Are paper instruction manuals still required?

Digital instructions are permitted subject to conditions, but paper copies remain required in specified circumstances, including certain non-professional use cases.

Can manufacturers still self-assess machinery?

Often, yes, but Annex I classification and the applicable conditions determine whether a notified body is required.

Why does cybersecurity matter for CE marking?

Because corruption or unauthorised alteration of safety-related control functions can create machinery hazards and must be addressed where applicable.

Preparing for the transition

The new Machinery Regulation does not replace the need for sound engineering judgement and effective risk assessment. It broadens the compliance conversation to include modifications, software, connectivity and the evidence needed to demonstrate machinery safety. Reviewing these areas early can help organisations identify gaps before the 2027 application date.