Section 1.1.9 of Annex III is the new cybersecurity requirement of the Machinery Regulation. It is short, but each of its five paragraphs asks for something different, and an assessor will check them one by one. Reading it as "add some security" is the most common mistake.
Paragraph 1: connections must not create a hazard
Connecting another device to the machine, directly or through a remote device such as a phone app or a cloud service, must not lead to a hazardous situation.
This is a design question before it is a security question. For each interface, decide which commands it may give. A telematics gateway that may read the machine's status but never start a pump or move an axis cannot cause the hazard, whoever controls it. Write that command authority down per interface, and put the check in the receiving controller, not in the device that sends.
Paragraph 2: protect the hardware that gives access
A hardware component that transmits signals or data relevant to connection or access to compliance-critical software must be adequately protected against accidental or intentional corruption. The machine must collect evidence of legitimate or illegitimate intervention in that component.
Think of debug ports, service connectors, removable memory and the gateway itself. Typical measures are a disabled or authenticated debug interface, tamper evidence on the housing and a log entry each time a service tool connects.
Paragraph 3: identify and protect compliance-critical software and data
Software and data that the machine needs to meet the essential health and safety requirements must be identified as such and adequately protected against accidental or intentional corruption.
"Identified" means a list: which firmware, which parameter blocks, which safety limits. "Adequately" means in proportion to the risk. A signed firmware image verified at every start, and safety limits accepted only with a valid signature, are common answers for the items whose corruption could injure someone.
Paragraph 4: show what software is installed
The machine identifies the software installed on it that is needed to operate safely and can show that information at all times in an easily accessible form.
A version number buried in a service menu that needs a dealer tool is not easily accessible. A screen in the operator terminal, or a label generated by the machine itself, is.
Paragraph 5: keep evidence of interventions
The machine collects evidence of legitimate or illegitimate intervention in its software, and of modifications to the software or its configuration.
Two words carry the design. "Collect" means the machine gathers the evidence itself; a paper service record is not enough. "Legitimate or illegitimate" means you log accepted changes as well as refused ones. Section 1.2.1(f) adds a retention rule: the tracing log of interventions and of safety software uploaded after sale is kept for five years after each upload, exclusively to show conformity to an authority that asks with reasons.
The half that is easy to forget
1.1.9 says "accidental or intentional" twice. Flash wear, a write interrupted by a power loss or a bit flip in calibration data can change a safety function as surely as an attack. Error detection with a redundant copy, and a defined safe reaction when both copies are bad, are protection measures too.
What an assessor will ask to see
| Paragraph | Evidence |
|---|---|
| 1 | An interface analysis with the commands each interface may give, and the tests that show the rest are refused |
| 2 | The list of access hardware, the protection of each, and the log entries for interventions |
| 3 | The list of compliance-critical software and data, the protection level of each, the requirements and the tests |
| 4 | Where and how the machine shows its safety software versions |
| 5 | What is logged, how the log is protected, how long it is kept |
All of it belongs in the technical documentation (Annex IV, Part A). Where no harmonised standard is applied, the documentation must describe the other specifications used to meet each requirement. A protection specification with testable requirements is such a description.
Standards
EN 50742, Safety of machinery – Protection against corruption, was approved in October 2026 and is due for publication in November 2026. Once its reference is published in the Official Journal, applying it gives a presumption of conformity for what it covers. Until then, your own specification has to carry the argument.
This article explains Regulation (EU) 2023/1230 in plain words. It is not legal advice.