Machinery Regulation cybersecurity: what 2023/1230 means for machine builders

Last updated: 2026-10-19

The EU Machinery Regulation (EU) 2023/1230 replaces the Machinery Directive 2006/42/EC and applies from 20 January 2027. For the first time, its essential health and safety requirements address cybersecurity directly: Annex III section 1.1.9 requires protection against accidental or intentional corruption of safety-critical software, data and connections, and section 1.2.1 requires control systems to withstand reasonably foreseeable malicious attempts that could cause a hazard. Machines that contain products with digital elements must also meet the Cyber Resilience Act.

Key dates

The original Official Journal text printed 14 January 2027 as the application date. A corrigendum corrected the application dates, and the European Commission states that the Regulation applies “as of 20 January 2027”. Some older articles still quote 14 January; use 20 January. Earlier application dates for specific articles (notified bodies, implementing powers) were corrected by the same corrigendum; check the consolidated text for those.

There is no transition period during which you can choose either regime after 20 January 2027.

The cybersecurity requirements in Annex III

Section 1.1.9 – Protection against corruption

The machinery or related product must:

1. Safe connections. Be designed so that connecting another device to it, directly or via any remote device, does not lead to a hazardous situation.
2. Protected hardware interfaces. Hardware components that transmit signals or data relevant for connection or access to safety-critical software must be adequately protected against accidental or intentional corruption, and the machine must collect evidence of legitimate or illegitimate intervention in that hardware.
3. Protected safety software and data. Software and data critical for compliance with the essential requirements must be identified as such and adequately protected against accidental or intentional corruption.
4. Software identification. The machine must identify the software installed on it that is necessary for safe operation, and be able to provide that information at all times in an easily accessible form.
5. Evidence of changes. The machine must collect evidence of legitimate or illegitimate intervention in, or modification of, its installed software or configuration.

Section 1.2.1 – Safety and reliability of control systems

Control systems must be designed so that, among other things:

• (a) they withstand intended and unintended external influences, including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation;
• (b)–(c) hardware faults and logic errors do not lead to hazardous situations;
• (d) the limits of safety functions are set in the risk assessment, and no modification of settings or rules generated by the machine or operators, including during a learning phase, may lead to hazardous situations;
• (f) the tracing log of data generated by an intervention, and of versions of safety software uploaded after the machine was placed on the market, is enabled for five years after the upload, solely to demonstrate conformity on a reasoned request from a national authority.

Presumption of conformity through certification

Under Article 20(9), machinery certified (or covered by a statement of conformity) under a cybersecurity certification scheme adopted under the Cybersecurity Act, Regulation (EU) 2019/881, and referenced in the Official Journal is presumed to conform to sections 1.1.9 and 1.2.1 to the extent the certificate covers them. Harmonised standards for these sections are under development; their references and dates are (to be confirmed).

How the Machinery Regulation and the CRA fit together

CRA recital 53 says machinery that is also a product with digital elements must comply with both regulations, and that meeting the CRA requirements can facilitate compliance with sections 1.1.9 and 1.2.1, provided the manufacturer demonstrates it, for example by applying harmonised standards after a risk assessment covering those risks. The CRA does not exclude machinery from its scope.

In practice:

• A PLC, HMI, industrial gateway or remote-access router sold separately is itself a product with digital elements under the CRA, so its maker carries CRA duties.
• The machine builder that integrates these components must exercise due diligence (CRA Art. 13(5)) and, where the machine itself has digital elements, meet the CRA as manufacturer of the machine.
• Remote maintenance links, cloud dashboards and vendor VPNs are typical places where both 1.1.9 (“connection of another device… does not lead to a hazardous situation”) and CRA Annex I apply.

For the CRA side, start with the Cyber Resilience Act hub and the CRA 24h reporting guide.

What machine builders should do now

1. Inventory software per machine type. List PLC firmware, HMI software, drives, gateways, embedded PCs and their versions. This is the basis for “identify the software” in 1.1.9 and for an SBOM under the CRA. Our firmware SBOM guide covers components without source code.
2. Mark safety-critical software and data. Decide which programs, parameters and configurations affect safety functions, and how they are protected.
3. Add cyber threats to the risk assessment. Treat “reasonably foreseeable malicious attempts” as a hazard source: remote access, USB, engineering laptops, network exposure.
4. Design for evidence. Plan audit logs for configuration and software changes and a five-year trace of safety-software uploads.
5. Lock down interfaces. Restrict maintenance ports, require authentication for engineering access, segment the machine network.
6. Check suppliers. Ask component makers for SBOMs, vulnerability information and CRA plans.
7. Use IEC 62443 as a working method. IEC 62443-4-1 and 4-2 are widely used for secure development and component requirements; whether they will be cited as harmonised standards for 2023/1230 is (to be confirmed).

Softwsp builds machine-level SBOMs and vulnerability reports from the components you ship, without installing anything on the machine, and maps findings to 1.1.9, 1.2.1 and the CRA: see services for machine builders.

This guide is general information, not legal advice.