Navigating the New EU Machinery Regulation (EU) 2023/1230

October 19, 2026

Authored by Paola Pesconi and Sara Tess

EU machinery legislation sets harmonized health and safety requirements for machinery and related products placed on the EU market. It is relevant not only to traditional industrial machinery, but also to commercial appliances, tools, automated systems, robotics and other products that include moving parts or safety-related functions. 

The current Machinery Directive 2006/42/EC, applicable since 2009, is being replaced by Regulation (EU) 2023/1230. The new Regulation aims to ensure more uniform application across Member States, clarify product coverage and conformity assessment procedures, and update the framework to reflect technological developments. 

Regulation (EU) 2023/1230 was adopted on June 14, 2023, and will apply directly in all EU Member States from January 20, 2027. Manufacturers should therefore review product classification, technical documentation and conformity assessment routes before that date. 

The Regulation has a broad scope and covers machinery and partly completed machinery, as well as the following related products: 

• Interchangeable equipment 
• Safety components 
• Lifting accessories 
• Chains, ropes and webbing 
• Removable mechanical transmission devices 

Machinery is defined as: 

an assembly, fitted with or intended to be fitted with a drive system other than directly applied human or animal effort, consisting of linked parts or components, at least one of which moves, and joined together for a specific application. 

Article 3(1) provides the full definition. 

When assessing scope, manufacturers should also check whether the product falls under one of the exclusions, for example certain amusement equipment, weapons, transport equipment or electrical and electronic products generally regulated under the Low Voltage Directive or the Radio Equipment Directive. However, electrical products that meet the definition of Machinery Regulation and are not excluded remain subject to this framework, with electrical hazards addressed through its essential requirements. 

One notable update concerns the definition of safety components, which is no longer limited to physical items but now also covers digital components and software. Article 3(3) provides the definition, while Annex II includes an indicative list of safety components, serving as examples of products that may fall within this category. This change is closely connected to the broader revision of the Machinery Regulation, which updates the concept of safety in light of connected products, digital technologies and other recent technological developments. 

In the past, machinery safety was largely associated with preventing physical hazards caused by mechanical or electrical failures. Today, this concept has expanded significantly.  

Machinery is becoming increasingly connected, intelligent and data-driven. Technologies such as IoT connectivity, advanced sensor systems, real-time data processing and artificial intelligence are creating significant opportunities, but they are also introducing new and complex risks and impact product safety. 

Cyberattacks, unauthorized access or the manipulation of software functions may alter the behavior of a machine and potentially create hazardous situations for users and operators. 

As a result, the concept of safety has evolved. It is no longer limited to traditional safety hazards but now also encompasses cybersecurity and, where applicable, risks associated with AI. Manufacturers are therefore expected to address these risks from the earliest stages of design and development, ensuring that machinery remains safe, secure and reliable throughout its entire lifecycle. 

This broader understanding of safety is reflected in Annex III, where the essential health and safety requirements have been updated. 

For manufacturers, the assessment therefore needs to consider whether software, data, connectivity, cybersecurity vulnerabilities or self-evolving behavior could affect the safe operation of the product or the reliability of its safety functions. In this context, cybersecurity and AI are not standalone compliance topics, but part of the machinery safety assessment where they may have an impact on health and safety. 

Annex III remains the central reference point for the essential health and safety requirements. Depending on the product and its intended use, manufacturers may need to address: 

• Risk reduction through design and construction, including controls, guards and protective devices 
• Information, warnings, marking and instructions for use, including digital instructions, where applicable 
• Hazards linked to ergonomics, noise, vibration, radiation, materials, substances and emissions 
• Supplementary requirements for specific machinery categories, such as machinery presenting mobility risks, lifting operations, underground work or lifting persons 
• Requirements linked to digital technologies where software, data, connectivity or self-evolving behavior can affect safety functions 

The Machinery Regulation addresses the safety implications arising from the increasing use of AI, machine learning and autonomous decision-making capabilities in machinery.   Following the adoption of the Digital Omnibus on AI, an EU legislative initiative designed to streamline compliance by preventing duplicate obligations across high-risk technology sectors, it was clarified that health and safety aspects related to AI-enabled machinery are assessed directly under the Machinery Regulation, avoiding unnecessary overlap with the AI Act. 

As AI becomes increasingly integrated into industrial equipment, the regulation introduces specific requirements for systems that can fully or partially adapt their behavior over time. 

• AI-driven functions must remain intuitive and understandable for users, supporting safe interaction through ergonomic design principles. 
• AI must operate within the limits defined by the manufacturer. Even if the system is capable of learning or adapting, it must not cause the machinery to perform actions or movements that go beyond its intended purpose or safe operating boundaries. 
• Manufacturers must enable the recording of data related to safety-critical decision-making processes. This is important for monitoring system behavior, investigating incidents and demonstrating compliance. 
• Operators must always be able to intervene and correct the system when necessary. Human oversight remains a fundamental principle, ensuring that AI supports, rather than replaces, safe control of machinery. 

An important aspect to highlight is that machinery incorporating safety functions based on machine learning and exhibiting fully or partially evolving behavior is listed in Annex I, Part A of the Machinery Regulation. As a result, manufacturers cannot rely solely on the internal production control procedure (Module A). Instead, third-party involvement through a Notified Body is required as part of the conformity assessment process.

The growing digitalization of machinery has increased the exposure of industrial products to cybersecurity risks that may also affect safety. As a result, manufacturers must assess the interplay between the Machinery Regulation and the Cyber Resilience Act (CRA), two legislative frameworks that address different but complementary aspects of cybersecurity. 

Where machinery falls within the scope of both the Machinery Regulation and the CRA, manufacturers will need to consider both regulatory frameworks. Recital 53 of the CRA clarifies that the CRA’s essential cybersecurity requirements may coexist with the requirements set out in the Machinery Regulation, in particular those concerning protection against corruption and the reliability of control systems. 

Under the Machinery Regulation, manufacturers must implement appropriate measures to protect the safety of machinery against cybersecurity risks. These requirements do not replace or limit additional cybersecurity obligations that may apply under other EU legislation, such as the Cyber Resilience Act. 

In this context, the Machinery Regulation introduces several cybersecurity-related requirements aimed at ensuring the safety and resilience of machinery throughout its lifecycle. (Annex III, Section 1.1.9 and Annex III, Section 1.2.1) 

1. Secure communications: Machinery must be designed so that connections with connected or remote devices do not create hazardous situations. 
2. Protection of communication hardware: Hardware components transmitting signals or data relevant to safety-critical software must be protected against accidental or intentional corruption. 
3. Logging of hardware interventions: Evidence of legitimate and illegitimate interventions affecting safety-critical hardware components must be collected and retained. 
4. Protection of critical software and data: Software and data that are essential for compliance with health and safety requirements must be identified and protected against unauthorized modification, corruption or tampering. 
5. Software identification and traceability: Machinery must be able to identify the safety-relevant software installed and provide this information in an easily accessible form at all times. 
6. Logging of software and configuration changes: Evidence of legitimate and illegitimate interventions, software modifications and configuration changes must be recorded to ensure traceability and support incident investigations. 

Beyond the protection of software, data and communications, the Machinery Regulation also strengthens requirements related to the safety and robustness of control systems. 

1. Control systems shall be designed in such a way that they can withstand risks and intended and unintended external influences, including reasonably foreseeable malicious attempts by third parties that could lead to a hazardous situation. 
2. The tracing log of data generated in relation to an intervention, as well as the versions of safety software uploaded after the machinery or related product has been placed on the market or put into service, shall be enabled for five years after such upload. 

Together, these requirements establish a framework that addresses both traditional machine safety and cybersecurity-related risks, ensuring that machinery remains safe and reliable even when exposed to digital threats or post-market software modifications. 

For most machinery and related products, conformity can still be demonstrated through internal production control and self-declaration. A key change, however, is the revised treatment of higher-risk categories in Annex I. 

Annex I is now divided into Part A and Part B. Products falling under Part A require the involvement of a Notified Body; a new approach introduced by Regulation (EU) 2023/1230. 

Examples include: 

• Removable mechanical transmission devices and guards  
• Vehicle servicing lifts 
• Portable cartridge-operated fixing and impact machinery 
• Safety components and machinery with embedded systems, using self-evolving machine learning approaches to ensure safety functions 

For Part B products, internal production control remains possible only when the applicable harmonized standards or common specifications fully address the relevant essential health and safety requirements. Otherwise, notified body involvement is required. 

The Regulation also introduces unit verification, module G, which may be relevant for individual or highly customized products. 

Harmonized standards represent a key part of the compliance strategy and remain the main route to demonstrate conformity with the essential requirements, while the new Regulation introduces common specifications as an additional tool. 

If no harmonized standard or common specification is available, manufacturers may use other technical specifications or technical solutions, as long as the technical documentation explains how the applicable requirements are met. Existing standards remain useful references, but should be checked against the updated Annex III requirements, including digital technologies, cyber-safety and self-evolving systems.

Regulation (EU) 2023/1230 represents a substantive update of the EU machinery framework, adapting product coverage, safety obligations and assessment procedures to technological progress.  

From January 20, 2027, manufacturers placing products on the EU market or putting them into service should review the applicable classification, determine whether the product is listed in Annex I and ensure that the technical documentation and EU declaration of conformity demonstrate compliance before affixing the CE marking. This review will be particularly relevant for machinery incorporating software, connectivity, cybersecurity-related functions or artificial intelligence, where digital features may affect both the safety assessment and the applicable conformity route. 

UL Solutions is monitoring the implementation of the new Regulation, including developments on harmonized standards, common specifications and guidance, and can support manufacturers in preparing for the revised framework.