The new Machinery Regulation: what changes on January 20, 2027
From January 20, 2027, Regulation (EU) 2023/1230 replaces the Machinery Directive. For anyone who builds, buys or modifies a machine, three things change: software, modifications and documents.
In this article
On January 20, 2027, the Machinery Directive gives way to a European regulation, 2023/1230. The framework is the one you know: risk assessment, essential health and safety requirements, technical documentation, declaration of conformity, CE marking. What is new is everything that was not yet an issue in 2006, when the Directive was written: machines run by software, connected to a network, modified with an update instead of a wrench.
Below is what the text says, with the article next to it, for the parts that touch our everyday work: control panels, software and revamping. We reread it in the version consolidated as of July 27, 2026, which includes the latest amendments.
From directive to regulation
A European directive does not apply on its own: each Member State has to transpose it into a law of its own. In Italy the Machinery Directive became Legislative Decree 17 of 2010, and every country wrote its own. A regulation skips that step. There is one text, the same from Milan to Munich, and its last line says so:
“This Regulation shall be binding in its entirety and directly applicable in all Member States.”
Regulation (EU) 2023/1230, Article 54
For anyone selling machines in several countries this is a simplification: one law to read, without the differences that come from national transposition. Directive 2006/42/EC is repealed from January 20, 2027 (Article 51). Where a contract, a specification or another law still cites it, the reference is read as a reference to the Regulation, using the correlation table in Annex XII.
One task is left to the Member States: penalties. Each sets its own, which must be “effective, proportionate and dissuasive” and may include criminal penalties for serious infringements (Article 50). They have to be notified to the Commission by October 20, 2026.
The dates to note
The Regulation has been in force since 2023, but almost all of its obligations start in 2027. In between there are a few milestones that concern Member States and notified bodies, not machine builders.
- Publication in the Official Journal of the European Union (L 165).
- Entry into force, twenty days after publication.
- The rules on notified bodies apply (Articles 26 to 42).
- Deadline for Member States to notify their penalties to the Commission.
- The Regulation applies in full. Directive 2006/42/EC is repealed.
- By this date the additional requirements for high-risk artificial intelligence in machinery apply. The Commission has yet to write them.
Watch out for one trap. The text published in the Official Journal in June 2023 said January 14, 2027: a corrigendum published five days later corrected the date to January 20. If a guide or a slide deck still says the 14th, it was written from the wrong text.
There is no period in which you can choose. The European Commission states it plainly: all machinery placed on the EU market before January 20, 2027 must comply with the Directive. From that day the Regulation applies. Before then, manufacturers may add on the declaration of conformity that the machine also conforms with the Regulation, if that is the case.
What counts is the day the machine is placed on the market or put into service, not the date of the order. For a custom machine that starts in 2026 and ships in 2027, put it in the contract: which law it will be declared compliant with.
And the machines already on your floor? They stay as they are. For products placed on the market under the Directive before January 20, 2027, Member States may not impede their making available, and EC type-examination certificates remain valid until they expire (Article 52). The Regulation comes back into play only if one of those machines is substantially modified: more on that shortly.
Software becomes part of safety
This is the biggest change for anyone who writes control software. Until now, a safety component brought to mind an object: an emergency stop, a light curtain, a relay. The Regulation widens the definition:
“A physical or digital component, including software, […] which is designed or intended to fulfil a safety function.”
Article 3(3): “safety component”
The indicative list in Annex II puts “software ensuring safety functions” on the same list as emergency stop devices and two-hand control devices. And a machine that is missing only the upload of its program is already a machine in every respect, not partly completed machinery (Article 3(1)(f)).
Two new requirements follow in Annex III, the one that sets out the essential health and safety requirements.
Protection against corruption (section 1.1.9)
Connecting another device to the machine, including a remote one, must not lead to a hazardous situation. Software and data that safety depends on must be identified as such and protected against accidental or intentional corruption. The machine must be able to tell at any time which software it has installed, among what it needs to operate safely, and must collect evidence of any intervention in that software, legitimate or not.
In shop-floor terms: who can upload a safety program, with what access, and what remains on record afterwards. Remote assistance is not banned. But a door left open on the plant network becomes, from 2027, a matter of machine compliance and not just of IT security.
Reliable control systems (section 1.2.1)
The control system must also withstand “reasonably foreseeable malicious attempts from third parties” leading to a hazardous situation. It must then make it possible to log interventions and the versions of safety software uploaded after the machine is put into service, and to keep that trace for five years. It serves one purpose only: demonstrating conformity if an authority asks with a reasoned request.
The same section has a line for wireless control: a failure of the communication or a dropped connection must not lead to a hazardous situation.
The technical file changes too. The technical documentation, to be kept for at least ten years, includes the source code or programming logic of the safety-related software. This is not an obligation to hand it to the customer: it has to be made available to the authority, on a reasoned request, when it is needed to check the requirements (Article 10 and Annex IV).
Substantial modification: who becomes the manufacturer
This is the question we get asked most, because it decides who answers for the machine after an intervention.
The Directive did not define substantial modification. The Regulation does: a modification is substantial when four conditions hold together (Article 3(16)).
- It is made after the machine has been placed on the market or put into service, by physical or digital means.
- It was not foreseen or planned by the manufacturer.
- It affects safety, because it creates a new hazard or increases an existing risk.
- It requires adding guards or protective devices in a way that means modifying the existing safety control system, or extra protective measures for stability or mechanical strength.
If even one of these conditions is missing, the modification is not substantial. Repair and maintenance that do not affect the machine's compliance stay out: recital 26 says so.
If they are all there, Article 18 kicks in: whoever carries out the modification is considered to be a manufacturer and takes on the manufacturer's obligations. Risk assessment, technical documentation, declaration of conformity under their sole responsibility, CE marking. It applies to anyone: the outside company doing the revamping, but also the plant that modifies the machine with its own maintenance team. The only exception is the non-professional user who modifies their own machine for their own use.
What counts is the effect on safety, not whether you changed a wire or a line of code.
One clarification matters for production lines. If the modified machine is part of an assembly of machinery and the modification affects the safety of that machine only, the obligations cover that machine and not the whole line. The risk assessment has to show it.
Three cases, starting with the simplest
The PLC is replaced with an equivalent one. Same functions, same safety devices, same movements. If no new hazard arises and no risk increases, the third condition is missing. It still has to be written down: a risk assessment of the intervention, kept with the machine's documents.
The speed goes up or a station is added. Here a risk can really increase. If bringing it back under control takes new guards or new light curtains, and connecting them means reworking the safety control system, all the conditions are met.
Only the software is updated. “Physical or digital means” tells you that an update counts as much as a screwdriver. A program that changes the limits of a safety function is assessed by the same yardstick as a mechanical modification.
1994
2026In our revamping jobs the scope is written down before we start: what stays, what changes, what gets reviewed. If the intervention is a substantial modification, you know before we begin and not once the machine is running again.
Who checks conformity
For most industrial machines nothing changes: the manufacturer assesses conformity in-house, through internal production control (Article 25(4)). A notified body comes in only for the categories in Annex I, which is now split into two parts.
| Annex I | A few examples | Who assesses |
|---|---|---|
| Part A (6 categories) | Safety components and systems whose behavior evolves through machine learning; vehicle servicing lifts | Always a notified body |
| Part B (19 categories) | Manually loaded presses and injection molding machines; devices that detect the presence of persons; logic units for safety functions | The manufacturer, only when applying harmonised standards that cover all the requirements; otherwise a notified body |
| Not listed | Most industrial machines and lines | The manufacturer, through internal production control |
One clarification clears up a common doubt. Mandatory third-party assessment of safety software concerns only systems that learn. Recital 55 rules it out for software incapable of learning or evolving, programmed only to execute certain automated functions: like the safety program of a PLC, which always does exactly what it was written to do.
On artificial intelligence the picture moved again in the summer of 2026. Regulation (EU) 2026/1744, in force since July 27, established that the requirements for high-risk AI systems used as safety components will be written into the Machinery Regulation itself, in Annex III, through Commission acts that apply by August 2, 2028. The January 20, 2027 date was not touched.
Earlier, in 2024, a chapter on emergency procedures had been added: it applies only if the Union activates the internal market emergency mode, and it does not enter a machine builder's normal work.
That leaves harmonised standards, the ones that give presumption of conformity. Today they are cited in the Official Journal for the Directive. As we write, on October 1, 2026, the Commission says the list for the Regulation is being prepared and that the first one is expected before the end of the year. Until then, do not take for granted that a standard used today also covers the new requirements.
Digital instructions and declarations
Instructions for use may be provided in digital format (Article 10(7)). A PDF on a USB stick is not enough, though. The manufacturer must:
- mark on the machine, or on its packaging or in an accompanying document, how to access the instructions;
- provide them in a format that can be printed, downloaded and saved, so they are available even when the machine breaks down;
- keep them accessible online for the expected lifetime of the machine, and in any case for at least ten years.
The buyer can always ask for them on paper: if they ask at the time of purchase, the manufacturer provides them free of charge within one month. For machines that may end up in the hands of non-professional users, the essential safety information stays on paper.
The EU declaration of conformity can be digital too: the instructions only need the internet address or a machine-readable code that leads to it, as long as it stays online for at least ten years (Article 10(8)). The same goes for partly completed machinery, with the EU declaration of incorporation and the assembly instructions (Article 11).
Two details not to miss. On the machine, besides the manufacturer's name and postal address, a digital contact must be shown: website, email or other (Article 10(6)). And the declaration template provides for the case of “substantially modified machinery” (Annex V).
What stays the same
A lot. The CE marking, risk assessment as the starting point, the technical documentation, the distinction between machinery and partly completed machinery. The essential requirements have moved house, from Annex I of the Directive to Annex III of the Regulation, but if you know them you will find most of them again: the correlation table is in Annex XII.
The rules for those who use machines stay where they are too. The Regulation speaks to those who build, import, sell or modify them. The safety of work equipment in the plant is a different law, in Italy Legislative Decree 81 of 2008, and it does not change with 2027.
Where to start
It depends on which side of the table you sit.
If you build machines
- Reread your risk assessment next to sections 1.1.9 and 1.2.1 of Annex III: those are the new ones.
- Decide how you identify, protect and trace safety software: versions, access, who can upload what.
- Look at the orders that straddle January 20, 2027 and write in the contract which law they will be declared under.
- If you want to move to digital instructions, decide first where they will live online for ten years.
If you buy a machine
Ask three things in the order: which law it will be declared compliant with, who is the manufacturer of the assembly when there is more than one supplier, and how you will receive the instructions and the software versions. These are questions to ask now, when they cost one line in the specification.
With us, who the manufacturer is gets decided at the start. On custom machines, if we are the manufacturer the CE marking is ours; if it is you, or whoever builds the mechanics, we hand over the electrical part with all its documentation.
If you modify a machine you already have
Start from the risk assessment of the intervention, before the quote. That is where you see whether the modification is substantial. Write down what changes and what does not, and keep it all with the machine's documents: it is the proof that you asked yourself the question.