Machinery Regulation 2023/1230: what's new and what to do before 2027

Regulation (EU) 2023/1230 replaces the Machinery Directive 2006/42/EC and applies from 20 January 2027. It is not a complete revolution, because the structure and much of the requirements remain, but it does change how a machine is designed, documented and certified. These are the changes that affect manufacturers and integrators most.

When does it apply and what does it replace?

• It was adopted on 14 June 2023, published in the Official Journal of the EU on 29 June and entered into force on 19 July 2023.
• It applies in general from 20 January 2027. The rules on authorities and notified bodies have applied since 20 January 2024.
• It repeals Directive 2006/42/EC and Directive 73/361/EEC.
• Being a regulation, it is directly applicable: no national transposition is needed and the rules are the same in every Member State. In Spain it replaces the directive and its transposition, Royal Decree 1644/2008.

In general terms, a machine lawfully placed on the market before 20 January 2027 under the directive does not have to be redone. Anything placed on the market from that date must comply with the regulation. Check the transitional provisions for each specific case.

The key changes

1. Cybersecurity becomes a safety requirement

Points 1.1.9 (Protection against corruption) and 1.2.1 (Safety and reliability of control systems) of Annex III require connections, software and control logic to withstand reasonably foreseeable malicious attempts. The directive had nothing equivalent. The harmonised standard prEN 50742 is being developed to meet it, which we explain in this article.

2. Artificial intelligence and self-evolving behaviour

For the first time, provisions cover systems with fully or partially self-evolving behaviour based on machine learning. Safety components and machinery with this type of system ensuring safety functions appear on the high-risk list in Annex I and require a notified body.

3. A new list of high-risk machinery (Annex I)

• Part A: six categories for which a notified body is always involved, even if harmonised standards are applied. They include, among others, removable mechanical transmission devices and their guards, vehicle servicing lifts, portable cartridge-operated fixing tools and the two artificial intelligence categories.
• Part B: a longer list, largely inherited from the former Annex IV of the directive. Self-certification is possible if harmonised standards are fully applied; otherwise a notified body is needed.

The difference from the directive is significant: in Part A, applying harmonised standards no longer lets you avoid the notified body.

4. Documentation in digital format

Instructions and the EU declaration of conformity can be provided in digital format. If the user requests it, the manufacturer must supply the instructions on paper.

5. Substantial modification, made clearer

Whoever substantially modifies a machine, physically or digitally, where that modification was not foreseen by the original manufacturer and affects the safety requirements, becomes the manufacturer of the modified machine, with the conformity assessment and CE marking that entails. It is especially relevant for integrators and for companies that retrofit machines or change their software.

6. Software, connectivity and collaboration with people

The essential requirements of Annex III have been revised and extended. They now take into account, among other things, software and its updates, internet connection (IoT), functional safety and collaboration between people and robots. The regulation also widens the concept of risk to include the psychological stress that interaction with robots can cause.

7. Harmonised standards under review

Many of the directive's harmonised standards are being revised and new ones, such as prEN 50742, are being developed. Applying a harmonised standard cited in the Official Journal of the EU gives a presumption of conformity with the requirements it covers.

What changes depending on your role?

• Manufacturers: classify each machine against Annex I, update the risk assessment, incorporate cybersecurity and renew the technical file and declaration of conformity.
• Integrators, importers and distributors: check the documentation and CE marking of what they place on the market, and watch for modifications that could make them manufacturers.
• User companies: be careful with modifications to machines and their software, which may be considered substantial.

What to do before 20 January 2027

1. Take inventory of the models you will keep placing on the market after that date.
2. Classify them against Annex I (Part A, Part B or neither) and, if applicable, contact a notified body well in advance.
3. Review the risk assessment against the new Annex III requirements: cybersecurity, software and collaboration with people.
4. Define the cybersecurity strategy, building on IEC 62443 and prEN 50742.
5. Update the technical file, the instructions (with digital format) and the EU declaration of conformity.
6. Review contracts and processes with suppliers and integrators, and the control of software updates and modifications.
7. Follow the publication of harmonised standards and European Commission guidance.

The earlier you start, the less pressure in the final months: notified bodies and file reviews have their own lead times.

Frequently asked questions

When is the new Machinery Regulation mandatory? In general, from 20 January 2027.

Do I have to recertify the machines I already sell? In general, not those lawfully placed on the market before that date under the directive. Models placed on the market from then on must comply with the regulation.

Do I always need a notified body? No. It is mandatory for the Part A categories of Annex I. For Part B, only if harmonised standards are not fully applied. Everything else is self-assessed.

Does it affect machines I sell outside the EU? The regulation applies to machinery placed on the market or put into service in the European Union. For other markets, check each country's rules.

How ENBRA can help

We support you through the transition: classification against Annex I, risk assessment, OT cybersecurity requirements, technical file and CE marking. You can see how we approach it in EU Machinery Regulation, or contact our team to review your case.