Machinery Regulation (EU) 2023/1230: what changes on 20 January 2027

01From directive to regulation: direct application on 20 January 2027, with no transition period

The text governing machine safety in Europe changes in nature. The Directive 2006/42/EC, transposed by each member state, gives way to Regulation (EU) 2023/1230, directly applicable across the Union without national transposition. The stated goal is to reduce diverging interpretations between countries and the associated administrative burden. The regulation entered into force on 19 July 2023, but its requirements only become mandatory after a 42-month preparation period.

“

In the machinery sector, approximately 98% of enterprises are small and medium-sized enterprises (SMEs). In order to ease the regulatory burden on SMEs, notified bodies should consider adapting the fees charged for conformity assessment and reducing them in proportion to the specific interests and needs of SMEs.

Regulation (EU) 2023/1230, recital 27 — official text (EUR-Lex)

The date to remember is 20 January 2027. Contrary to what many hoped, there is no sliding transition period: the switch is binary and rests on the date of placing on the market. A machine placed on the market before that date receives a declaration of conformity under Directive 2006/42/EC; any machine placed on the market from 20 January 2027 falls under the regulation. In practice, a long project designed today but delivered after that date must already be designed to the new regulation.

02Substantial modification: when working on a machine in service makes you a manufacturer

This is one of the most consequential changes for integrators and maintenance teams. The regulation states that anyone who makes a substantial modification to a machine already placed on the market is considered a manufacturer, and takes on the corresponding obligations: a new conformity assessment and new CE marking for the affected scope.

A modification is substantial when it was not foreseen by the original manufacturer and creates a new hazard or increases an existing risk, to the point of requiring added guards, changes to the safety control system, or additional measures for stability or mechanical strength. The modification can be physical or digital: a software update that changes a machine's safety behaviour can itself be substantial. Every intervention on a machine in service becomes a regulatory decision point to trace.

03Software, machinery and related products: definitions that redistribute liability

The regulation clarifies the long-ambiguous status of software. Two practical consequences:

04High-risk machinery: the end of self-certification for Annex I, Part A

What the directive called "Annex IV machinery" now sits in Annex I of the regulation, split into two parts that command different assessment procedures:

1. Outside Annex I. Internal production control (module A) still applies, as today.
2. Annex I, Part A. Self-certification is no longer possible, even when harmonized standards are applied: a notified body becomes mandatory (EU-type examination, full quality assurance, or unit verification).
3. Annex I, Part B. Same procedures by default, but internal control (module A) becomes possible again if harmonized standards are applied.

Safety functions relying on artificial intelligence are among the cases that call for particular care when choosing the procedure. The concrete friction point: the body of harmonized standards under the regulation is only expected to be complete by the end of 2026, just before the cut-off date.

05Cybersecurity and protection against corruption: a new essential safety requirement

This is probably the most visible change. The essential health and safety requirements (Annex III) now include a dedicated point on protection against corruption. Connecting a device (USB key) or linking to a remote device over the Internet must not lead to a hazardous situation, and control systems must resist tampering.

The regulation explicitly distinguishes accidental corruption (a worker making a change without bad intent) from intentional corruption (hacking, social engineering). In practice, you now have to formally identify safety-critical software and data, ensure they cannot be modified without authorization, and secure any external connection. These requirements sit within the EU's cyber strategy, in step with the Cyber Resilience Act and the Radio Equipment Directive.

06Artificial intelligence and self-evolving behaviour: controlling what learns

The regulation addresses, without naming it head-on (to avoid overlap with the AI Act), "self-evolving behaviour" or "self-evolving logic". The risk assessment of a machine whose behaviour evolves must now account for the risks arising from that autonomy. The guiding principle is simple to state, demanding to demonstrate: the machine's learning must not take it outside the safety limits defined at design time. For an engineering team, this means documenting the safe operating domain and proving it holds, even as the system evolves.

07What it changes for an engineering team: from a static file to living compliance

Beyond each requirement taken on its own, the regulation marks a paradigm shift. Compliance is no longer a static file handed over at delivery, but a state to maintain and prove over time: explicit post-market surveillance, an obligation to take immediate corrective measures, and traceability extended across the whole chain of operators (the importer identifies itself on the product, the distributor exercises due diligence). Documentation becomes digital by default — instructions can be provided digitally, downloadable and printable, with paper still due on request — and gains new deliverables such as a change log and vulnerability management.

For engineering teams, the challenge is not intellectual but documentary and organizational: producing and keeping up to date, without weighing projects down, a larger and more interconnected body of evidence, and being able to justify it at any moment. This is exactly where traceability — linking each requirement to its proof and source, and keeping a record of every modification — stops being a convenience and becomes the condition of compliance.

08Frequently asked questions about the Machinery Regulation 2023/1230

This article is an informational summary for educational purposes; it is not legal advice. For any compliance decision, refer to the official text of Regulation (EU) 2023/1230 and, where relevant, to a notified body.