Short answers to the questions machinery manufacturers ask about the cybersecurity requirements of the Machinery Regulation. Each answer names the provision of Regulation (EU) 2023/1230 it relies on, for example Annex III, section 1.1.9 for protection against corruption, so you can check it yourself.
Section 1.1.9 is five paragraphs long and each one asks for something different. What each paragraph requires, what evidence an assessor will look for, and the half most teams forget.
Section 1.2.1 has protected control systems against faults for decades. The new text adds malicious attempts, protected safety limits and a five-year tracing log. What that means for your risk assessment and your tests.
A connected machine sold in the EU from 2027 usually answers to both the Machinery Regulation and the Cyber Resilience Act. Neither presumes conformity with the other. How they relate, where they pull apart, and how to keep one file.
From 20 January 2027 every new machine sold in the EU must be protected against corruption and malicious attempts. Who is affected, which requirements apply, and what to settle first.
An update can fix a vulnerability and break a safety function in the same step. What the Machinery Regulation asks of software identification and updates, and how to reconcile it with the CRA's push for automatic updates.
Under the Machinery Regulation, whoever substantially modifies a machine takes on the manufacturer's obligations. The definition is narrower than many think, and a software change can meet it.