On 20 January 2027 the Machinery Directive 2006/42/EC is repealed and Regulation (EU) 2023/1230 applies (Art. 54). For most machine builders the visible change is a new set of cybersecurity requirements. The directive never mentioned them. The regulation makes them essential health and safety requirements, checked like guarding or emergency stops.
The date, corrected
The text published in the Official Journal on 29 June 2023 says 14 January 2027. A corrigendum published on 4 July 2023 (OJ L 169) corrected it to 20 January 2027. Some summaries still repeat the old date. The regulation entered into force on 19 July 2023.
Every machine placed on the market from 20 January 2027 must comply, including machines of a type you have sold for years. There is no grandfathering of designs: what counts is the date each unit is placed on the market.
Who is affected
The regulation covers machinery, related products such as interchangeable equipment and safety components, and partly completed machinery (Art. 2(1)). Software can be a safety component on its own (Art. 3(3)).
Two exclusions confuse people. Motor vehicles, trailers and agricultural or forestry tractors are excluded with their systems (Art. 2(2)). Machinery mounted on them is not: a sprayer on a tractor, a loader crane on a truck and a tail lift on a trailer all stay in scope. And a machine that leaves the factory without its application software is still machinery (Art. 3(1)).
What the requirements say
Two sections of Annex III carry the cybersecurity work.
| Section | In plain words |
|---|---|
| 1.1.9 Protection against corruption | Connecting another device, directly or remotely, must not lead to a hazardous situation. Hardware that gives access to safety-relevant software, and that software and its data, must be adequately protected against accidental or intentional corruption. The machine identifies its safety software and keeps evidence of interventions, allowed or not. |
| 1.2.1 Safety and reliability of control systems | Control systems withstand reasonably foreseeable malicious attempts that could lead to a hazard. Safety limits and settings cannot be changed in a way that creates a hazard. A tracing log of interventions and of safety software uploaded after sale is kept for five years after each upload. |
The aim is narrow. These requirements protect the safety of people around the machine. Confidentiality, data protection and harm to other networks are matters for other laws, mainly the Cyber Resilience Act (recital 25).
Who checks your work
Most machines are not listed in Annex I and follow internal production control (Module A): you assess and sign yourself. For the 19 categories in Annex I, Part B, Module A is only allowed if you apply harmonised standards or common specifications that cover all relevant requirements; otherwise a notified body is involved. The six categories in Part A always need one (Art. 25).
That makes the state of standards important. In October 2026 no harmonised standard had been referenced in the Official Journal under the new regulation, and the first list was expected by the end of 2026. EN 50742, Safety of machinery – Protection against corruption, was approved in October 2026 and is due for publication in November 2026. It gives a presumption of conformity only once its reference is published in the Official Journal (Art. 20).
Five questions to answer first
- What is the product? Machinery, a related product or partly completed machinery.
- Is it excluded? Read Art. 2(2) point by point. If you rely on an exclusion, write down which one and why.
- Who assesses conformity? Check Annex I, Parts A and B, before anything else. A notified body needs booking time.
- Which cybersecurity requirements apply? Answer 1.1.9, 1.2.1 and the related points 1.2.6 (loss and return of power and communication) and 3.3 (remote control) with a yes or no and a reason.
- Does a second law apply? A machine with a network connection or a radio is usually also a product with digital elements under the Cyber Resilience Act. Both apply in parallel.
Write the answers down
The answers are the first page of the cybersecurity part of your technical documentation. Record the product and its limits, the category, the exclusions considered, the conformity route, each requirement with its reason, and who decided when. An authority may disagree with a conclusion. It should not find that the question was never asked.
This article explains Regulation (EU) 2023/1230 in plain words. It is not legal advice.