Why the EU Replaced the Machinery Directive
Directive 2006/42/EC provided a consistent safety framework across all member states. But the world changed. The years that followed saw a dramatic shift in how machinery is designed and operated: autonomous systems, cloud-connected sensors, self-learning algorithms, and software-driven functionality became standard.
The Directive was not equipped to address these realities. It lacked guidance on AI-driven machinery or the liability questions that arise when a machine learns to behave differently over time. And as a Directive, it required each member state to transpose it into national law — creating different implementations across the EU, each with its own interpretation of "essential health and safety requirement."
The European Commission concluded that a faster, more uniform approach was necessary. In June 2023, it adopted Regulation (EU) 2023/1230, which replaces the Machinery Directive entirely. The key difference is legal instrument: a Regulation applies directly across all member states with no transposition, eliminating the fragmentation that had accumulated over years of divergent national implementations.
The transition period is 42 months. Directive 2006/42/EC remains in force until 19 January 2027. On 20 January 2027 (Art. 54, second paragraph), only machinery compliant with Regulation 2023/1230 may be placed on the market. There is no grace period after that date; the switchover is absolute.
For manufacturers, this timeline matters: any machinery placed on the market on or after 20 January 2027 must comply with the new Regulation. That means design, testing, documentation, and certification must be underway now if you plan to ship before mid-2027.
The 4 Biggest Changes You Need to Know
1. Cybersecurity Is Now an EHSR (Annex III §1.1.9)
Under Directive 2006/42/EC, cybersecurity was not a regulatory requirement. Some manufacturers addressed it voluntarily; most did not.
Regulation 2023/1230 changes this fundamentally. Cybersecurity is now an Essential Health and Safety Requirement (EHSR), listed as Section 1.1.9 of Annex III. This means every machinery manufacturer must now:
- Identify external interfaces through which an attacker could compromise the machine (network ports, USB connections, wireless links, firmware update mechanisms, remote diagnostics portals)
- Design controls to prevent unauthorized access, data corruption, and malicious firmware installation
- Ensure that safety-critical functions (emergency stop, pressure relief, load limiting) remain effective even if cybersecurity is compromised
- Document all of these controls in your technical documentation (Annex IV Part A)
The requirement applies to all machinery within the Regulation's scope, not just those with network connectivity. Even a machine designed for future remote diagnostics capability, or one that could receive firmware updates, must address cybersecurity under Section 1.1.9.
Why this matters: This is a significant change. Machinery that shipped under the Directive without cybersecurity controls cannot simply be re-badged under the Regulation. If your current technical file does not include a cybersecurity threat assessment, you will need to perform one before 20 January 2027.
2. Technical Documentation Structure (Annex IV Part A)
Both the Directive and the new Regulation require technical documentation, but the structure and level of detail have changed.
Under Directive 2006/42/EC, Annex VII listed the requirements for technical documentation in a looser format, allowing flexibility in how manufacturers organized information.
Regulation 2023/1230 is more prescriptive. Annex IV Part A specifies 14 distinct, lettered points (a)–(n) that your technical documentation must address. These points establish a structured framework for what manufacturers must document; the specific content requirements for each point are defined in the Regulation itself.
Retention period remains 10 years (Art. 10(3)).
3. Notified Body Involvement — Requirements and Timing
These requirements apply from 20 January 2024 (Art. 54), meaning if you are developing machinery in a high-risk category, you should already be planning Notified Body involvement even during the transition period leading up to 20 January 2027.
4. Declaration of Conformity Format (Annex V Part A & B)
Your Declaration of Conformity (DoC) must now follow a more structured format as set out in Annex V.
Annex V Part A specifies mandatory requirements for the DoC. The DoC must include:
- A statement of conformity with Regulation 2023/1230 (covering all EHSRs, including cybersecurity under Section 1.1.9)
- References to harmonised standards or common specifications applied
New distinction: If your machinery is partly completed (e.g., you are a sub-supplier providing a component that will be integrated into larger machinery by someone else), you must issue a Declaration of Incorporation (Annex V Part B) instead of a DoC. Part B requires you to explicitly declare which EHSR sections from Annex III you have applied and satisfied — this is a more stringent requirement than the regular DoC.
What Stays the Same
Despite the scope of changes, many fundamental principles of EU machinery safety remain unchanged:
CE marking — Your machinery must still be marked with the CE marking. The symbol, size, and placement rules are the same. CE does not mean "compliant with a specific regulation" — it is a declaration that the manufacturer has followed the applicable conformity assessment procedure.
Declaration of Conformity — The requirement to issue a DoC before placing machinery on the market is unchanged. You still cannot sell machinery without it.
Risk assessment — You must still conduct a comprehensive risk assessment covering all design and operational phases. EN ISO 12100 remains the foundational standard for this work and is still applicable and relevant under the new Regulation.
10-year documentation retention — Your technical file must still be retained for 10 years (Art. 10(3)).
Supply chain responsibility — The structure of responsibility remains: manufacturer → importer (if from outside the EU) → distributor → end user. If you import machinery into the EU, you assume certain responsibilities. If you distribute, you must verify that the machinery bears CE marking and is accompanied by required documentation.
Harmonised standards — You can still achieve conformity by applying harmonised standards. The principle is unchanged: harmonised standards create a rebuttable presumption of conformity.
The transition is significant, but it is a modernization of machinery safety, not an abandonment of its core principles.
Your Transition Checklist
If you manufacture machinery or place machinery on the EU market, here is a practical checklist to prepare for 20 January 2027:
By Q4 2026:
- Review your Declaration of Conformity — Does it match the 10 mandatory points in Annex V Part A? Update the template now.
- Conduct a cybersecurity risk assessment — Identify all external interfaces (network, wireless, USB, firmware updates, remote access). Document threat scenarios and controls. This becomes Section 1.1.9 of your technical documentation.
- Update your technical file to Annex IV Part A structure — Reorganize your documentation to address all 14 lettered points.
- Identify partly completed machinery — If you supply components for integration into larger machinery, prepare Declaration of Incorporation forms (Annex V Part B) that explicitly declare which EHSR sections you have addressed.
- Engage notified bodies early — If your machinery requires Notified Body assessment, contact TÜV, BSI, Dekra, or another notified body now. Do not wait until late 2026 — their schedules will be congested.
- Plan for software updates — If your machinery receives firmware or software updates, document the security controls for those update mechanisms.
- Test your controls — Verify that emergency stops, safety interlocks, and other critical functions remain effective even if someone attempts to compromise the machinery's network or software.
By 20 January 2027:
- All machinery placed on the market must comply with Regulation 2023/1230. Anything still in your inventory or pipeline cannot be sold after this date under the Directive.
FAQ
Do we need to re-certify machinery already in the market?
No, not necessarily. If your machinery was lawfully placed on the EU market in compliance with Directive 2006/42/EC before 20 January 2027, it may continue to be made available on the market after that date, even if it does not comply with all provisions of Regulation 2023/1230. This is called "grandfathering."
However, this protection is limited. If your machinery requires significant modification, repair, or upgrade after 20 January 2027, you may need to re-certify under the new Regulation. Consult a compliance advisor to assess whether planned changes will require new compliance work.
Additionally, market surveillance authorities may still audit or take action on machinery that poses a safety risk, regardless of when it was placed on the market.
When does Machinery Directive 2006/42/EC stop applying?
19 January 2027. Starting at 20 January 2027 (Art. 54, second paragraph), the Directive is no longer valid, and Regulation 2023/1230 is the sole applicable instrument.
There is no overlap period. The cutover is instantaneous. After 19 January 2027, you cannot place new machinery on the market under the Directive — it must comply with the Regulation.
What about machines already placed on the market before 20 January 2027?
Machinery that was lawfully placed on the market (i.e., sold or transferred to a buyer) in compliance with Directive 2006/42/EC before 20 January 2027 can continue to be distributed and put into service by end users even after that date. You are not required to recall it, re-label it, or re-certify it.
However, if you continue to manufacture and sell units of the same machinery model after 20 January 2027, new units must comply with Regulation 2023/1230 from that date forwards. You cannot "run out" your remaining stock of old units after the deadline; each unit placed on the market on or after 20 January must meet the new Regulation.
If you have machinery in your warehouse inventory or pipeline as of January 2027, you will need to decide whether to place them on the market before the deadline (under the Directive) or delay until you can certify them under the Regulation. This is a business decision, not a compliance requirement — but the regulatory framework does not allow a grace period for unsold stock.