Manufacturers, importers and distributors of machinery face a major regulatory change. On 20 January 2027, the Machinery Regulation will replace the current Machinery Directive. It addresses developments such as autonomous machines, AI-based systems and cybersecurity risks. The rules on conformity assessment and documentation will also become stricter.
This article gives a clear overview of the Regulation’s scope, the main changes, the relevant deadlines, and possible penalties. It also explains how the Regulation interacts with other EU legislation.
In a nutshell
- The Machinery Regulation replaces the existing Machinery Directive on 20 January 2027 and applies directly, without a transitional period. Its obligations apply to manufacturers, importers, and distributors of machinery and related products.
- The many changes compared with the Machinery Directive, and the overlaps with other regulations, require careful conformity assessments and thorough documentation.
- Notified bodies for testing and specialised consultancies are likely to become scarce before the Machinery Regulation applies, so acting in good time is worthwhile.
Why does a Directive become a Regulation?
Replacing the Machinery Directive 2006/42/EC with Regulation (EU) 2023/1230 on machinery is more than a formal renaming. Directives must first be transposed into national law by EU Member States, which leaves room for different interpretations. A Regulation, by contrast, applies directly and uniformly in all 27 EU Member States.
The change of legal instrument from Directive to Regulation is intended to ensure that companies across Europe apply the same rules.
The existing Directive does not fully address the risks posed by newer technology. This includes collaborative robots and machines connected to the internet. Autonomous systems that use AI also raise new safety questions. The Machinery Regulation updates the safety rules to address these issues.
Who is affected by the Machinery Regulation?
The Regulation applies well beyond machinery manufacturers. It covers every economic operator that makes machinery or a related product available on the EU market. Articles 10 and following therefore address the following groups:
- Manufacturers, including those who produce products for their own use
- Importers: companies established in the EU that place products from third countries on the market
- Distributors, including online retailers
- Authorised representatives: a representative formally mandated in writing by the manufacturer
The term “machinery and related products” extends beyond machinery in the traditional sense. It also covers interchangeable equipment, safety components, lifting accessories, chains, ropes, webbing, detachable PTO shafts and partly completed machinery.
A company may also be treated as a manufacturer if it markets a product under its own name or trademark. The same applies where it makes a substantial modification. In either case, it assumes the corresponding obligations under the Machinery Regulation.
What are the objectives of the Machinery Regulation?
The Machinery Regulation sets common safety rules for machinery throughout the EU. This supports the free movement of goods in the single market, but the central concern is straightforward: people should be protected from unsafe machinery.
The rules also reflect how machinery has changed. They now address autonomous machines, collaborative robots, and safety functions that rely on artificial intelligence. Such products should be able to reach the market without compromising safety or placing unnecessary limits on technical development.
Cybersecurity is now part of the safety framework as well. Network connections and software controls can expose machinery to risks that older rules did not fully cover.
What are the key changes introduced by the Machinery Regulation?
The concept of "substantial modification"
Article 3(16) of the Machinery Regulation defines “substantial modification” for the first time. The term covers a physical or digital change made after a machine or related product has been placed on the market or put into service. The manufacturer did not foresee or plan that change, and it affects safety by creating a new hazard or increasing an existing risk.
A modification falls within this definition where it requires one of the following measures:
- add separating or non-separating protective devices to the machine or related product, where their integration requires an adjustment of the existing safety control system, or
- take additional protective measures to ensure the stability or strength of the machine or related product.
If a change amounts to a substantial modification, the full conformity assessment must be carried out again.
This matters in practice for businesses that retrofit used machinery. It may also affect software updates to components that perform a safety function.
High-risk machinery and conformity assessment procedures
Article 6 of the Machinery Regulation introduces a categorisation by risk potential, for which the term “high-risk machinery” has become established in practice.
- Annex I, Part A lists six particularly hazardous categories, including detachable PTO shafts, vehicle lifts, and, for the first time, safety components and embedded systems with self-evolving behaviour based on machine learning.
- Part B contains 19 further categories, such as circular and band saws for woodworking, presses for cold working of metal, protective devices for person detection, or logic units for safety functions.
- All machinery that is not listed in either part forms the third group and is subject to the standard procedure.
The Regulation draws on the European standard modules for this purpose:
- Module A is internal production control, in which the manufacturer declares conformity on its own responsibility, without the involvement of a notified body.
- Module B is EU type-examination, in which a notified body examines a representative sample and certifies that it meets the requirements.
- Module C follows on from this: the manufacturer uses its own internal production control to ensure that series production conforms to the approved type. Modules B and C are therefore always combined. Alternatively, Module H (full quality assurance via a certified quality management system) and Module G (unit verification of each product by a notified body) are available.
Machinery listed in Part A must follow a procedure involving a notified body. One option is an EU type-examination under Module B, followed by conformity to type based on internal production control under Module C.
Part B allows more flexibility. Module A may be sufficient if the manufacturer applies the relevant harmonised standards and common specifications in full, and these cover every applicable requirement.
Machinery that does not appear in Annex I remains subject to Module A.
Manufacturers should not treat the current Annex I as fixed. It can be amended, so product classifications need regular review.
Note for manufacturers of networked machinery: A connected machine may also qualify as a product with digital elements under the Cyber Resilience Act (CRA). If it does, the manufacturer must examine the CRA conformity procedure separately. The classification under Annexes III and IV of the CRA should not be confused with the classification under Annex I of the Machinery Regulation.
Digital instructions for use and declaration of conformity
Article 10(7) of the Machinery Regulation allows instructions for use and EU declarations of conformity to be supplied digitally. The documents must remain available online for download throughout the machine’s expected lifetime, and in any event for at least ten years after the machine is placed on the market. A purchaser may still request printed instructions when buying the machine. The manufacturer must then provide them free of charge within one month. The declaration of conformity may also be made available through a URL or machine-readable code.
Where the CRA also applies: Article 13(13) of the CRA requires manufacturers to retain the technical documentation and EU declaration of conformity for at least ten years. If the support period is longer, the documents must be kept for that full period. Manufacturers subject to both Regulations should therefore plan a single documentation system that meets the longer requirement.
Cybersecurity as a new basic requirement, and the interplay with the CRA
Annex III, Part B, point 1.1.9 of the Machinery Regulation requires machinery to be protected against manipulation. A connection to another device, including remote access, must not create a hazardous situation. Hardware that carries signals or data relevant to conformity needs protection from accidental interference and deliberate tampering. The machine must also be able to identify relevant changes to its hardware, software or settings, whether authorised or not, where they affect connectivity, access or conformity.
The Machinery Regulation and the CRA cover some of the same cybersecurity concerns. Annex I of the CRA sets essential requirements for all products with digital elements, including protection against unauthorised access, tampering and attacks. The Machinery Regulation addresses comparable risks for machinery, but through a different legal framework. The duties and consequences under each Regulation therefore need to be considered separately.
A networked machine may therefore have to satisfy both sets of rules. Under the CRA, cybersecurity is a condition for placing a product with digital elements on the market. Harmonised standards can help manufacturers show that the relevant requirements have been met and may support compliance under both Regulations.
Learning and AI-based systems
Machines whose behaviour can evolve or operate autonomously may fall within Annex I, Part A when they perform a safety function. Machine learning is one example. Manufacturers must consider not only the risks present when the product reaches the market, but also those that may emerge as its behaviour continues to develop.
The AI Act may apply at the same time. Under Article 6(1), an AI system can be classed as high-risk where it is a safety component of a product, or is itself such a product, covered by EU legislation listed in Annex I to the AI Act. A further condition is that the product must undergo third-party conformity assessment before it is placed on the market. The result depends on the particular system and the conformity route chosen for the machinery.
What are the consequences of infringing the Machinery Regulation?
The Machinery Regulation does not set a single level of fines across the EU. Instead, Article 50 requires each Member State to provide penalties that are effective, proportionate and dissuasive. Germany did so through the German Machinery Regulation Implementation Act (MaschinenDG), which entered into force on 6 December 2025. Section 9 lists 26 administrative offences. Depending on the infringement, fines may reach EUR 10,000 or EUR 100,000; the absence of CE marking is one example. Most of these penalty provisions will apply from 20 January 2027.
Fines are not the only possible consequence. Market surveillance authorities may require corrective action, restrict sales, withdraw a product or order a recall. A product can face such measures even if it bears the CE marking, where it presents a risk or fails to meet formal requirements. National action may then trigger an EU-wide safeguard procedure. Mistakes in classification, conformity assessment or technical documentation can therefore affect sales beyond the Member State in which they were first identified.
How does the Machinery Regulation relate to other EU Regulations?
Cyber Resilience Act
For manufacturers of networked machinery, the relationship with the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is especially important. A single product may fall under both Regulations. Neither replaces the other; each adds its own requirements:
- Risk assessment: The Machinery Regulation requires a risk assessment under Annex III; the CRA requires a cybersecurity risk assessment under Article 13. In practice, both can be combined in a single document, provided that all requirements of both Regulations are clearly addressed.
- Technical documentation: The Machinery Regulation requires technical documentation demonstrating conformity with the essential requirements; the CRA requires technical documentation under Article 31 and Annex VII. Here too, an integrated documentation package is possible, with a clear separation of the evidence.
- Declaration of conformity: Both the Machinery Regulation and the CRA require an EU declaration of conformity. Article 28(7) of the CRA permits a single combined declaration where all requirements are fully covered in substance.
- CE marking: The CE marking may be affixed only once all applicable rules, including both Regulations, have been met.
AI Act
Where machinery uses an AI-based safety function, the manufacturer must determine whether the system qualifies as high-risk under Article 6(1) of the AI Act (Regulation (EU) 2024/1689). A high-risk classification brings further duties. These include risk management, data quality, logging, technical documentation, human oversight and robustness.
EU Data Act
Manufacturers of networked machinery also need to consider the EU Data Act (Regulation (EU) 2023/2854). It governs data generated by connected products and related services, including who may access and use that data. The Act also covers contractual terms, requests from public bodies and switching between data-processing providers.
What should companies do now?
Companies that manufacture, import, or place machinery on the market should use the remaining time before January 2027:
- Review the product portfolio: Which products fall under the new Machinery Regulation? Have machines been newly included in Annex I? Do networked machines also fall under the CRA?
- Update the risk assessment: For machinery with AI, autonomous behaviour or network connectivity, new hazard scenarios must be taken into account, including, where relevant, cybersecurity risks under the CRA. A combined risk assessment covering both Regulations is generally possible and sensible.
- Implement cybersecurity requirements: Establish processes for detecting and documenting software interventions in accordance with Annex III No. 1.1.9 of the Machinery Regulation. Where the machine is subject to the CRA as a product with digital elements, set up vulnerability handling processes, SBOM considerations and update mechanisms in line with the CRA requirements.
- Define and document the support period under the CRA: For machinery subject to the CRA, the manufacturer must define and document a support period of at least five years. For long-lived industrial machinery, a considerably longer period is generally required. This must be justified in the CRA technical documentation.
- Develop a digital documentation strategy: Under the Machinery Regulation, instructions for use and declarations of conformity must remain digitally accessible for at least ten years, and CRA documentation likewise for as long or longer, depending on the support period. A uniform documentation infrastructure saves effort.
- Contact notified bodies early: Capacity is limited. Allow for long lead times.
Conclusion: Those who start early avoid costly time pressure
The Machinery Regulation goes well beyond a routine update of the Machinery Directive. It changes the rules to reflect connected machinery, software, and autonomous functions. The Regulation will apply from 20 January 2027. By then, affected companies will need to have addressed the new requirements for risk assessment, digital documentation, cybersecurity, and safety functions that rely on artificial intelligence. Preparation cannot wait until the final months.
Networked machinery brings an additional deadline. The CRA will apply from December 2027 and introduces its own cybersecurity compliance process, closely linked to the Machinery Regulation but legally separate. Manufacturers can reduce duplicate work by planning for both regimes together.
Waiting until the deadlines are close creates avoidable risk: Notified bodies and specialist advisers may have little capacity, while errors can lead to penalties or market surveillance action. Companies should review their machinery portfolios now, choose the right conformity assessment route and prepare documentation that works for both Regulations.
