The cybersecurity of machinery
Applicable from 20 January 2027. The new Machinery Regulation makes protection against corruption an essential health and safety requirement, and asks machinery to know its software. What it asks, of whom, and what euvex prepares for it.
Who is concerned
Art. 2 and 3
Regulation (EU) 2023/1230 replaces Machinery Directive 2006/42/EC. It applies to machinery, to five families of related products and to partly completed machinery (Art. 2(1)).
Machinery.
An assembly fitted with a drive system other than directly applied human or animal effort, with at least one moving part, joined together for a specific application. This includes an assembly missing only the uploading of the software intended for the specific application foreseen by the manufacturer (Art. 3, point 1).
Related products.
Interchangeable equipment, safety components, lifting accessories, chains, ropes and webbing, and removable mechanical transmission devices.
Software.
A safety component can be “a physical or digital component, including software”, when it fulfils a safety function and is independently placed on the market (Art. 3, point 3).
Partly completed machinery.
An assembly that cannot in itself perform a specific application, intended to be incorporated into machinery. It carries a declaration of incorporation, not a declaration of conformity (Art. 22 and Annex V, Part B).
Exclusions.
Article 2(2) lists seventeen. One directly concerns electronics: certain electrical and electronic products fall outside the Regulation when they are within the scope of the Low Voltage Directive or RED, namely household appliances intended for domestic use, audio and video equipment, information technology equipment, ordinary office machinery, low-voltage switchgear and control gear, and electric motors (point (p)).
More specific.
Where other, more specific Union legislation covers risks in Annex III for a product, the Regulation does not apply to it to that extent (Art. 9).
Whether your product is machinery, partly completed machinery, a related product or none of these is a question of law. euvex does not decide it: in the console, an act that does not concern a product is declared “ne s'applique pas” (does not apply), and it leaves the EU declaration of that product.
What is required on cybersecurity
Annex III, 1.1.9 and 1.2.1
Cybersecurity is not a separate chapter: it is an essential health and safety requirement, in point 1.1.9, protection against corruption, and in point 1.2.1, safety and reliability of control systems. Point 1.2.1 is mostly functional safety; only its cybersecurity passages are covered here.
1.1.9, first paragraph
Connecting another device to the machinery, including a remote device that communicates with it, does not lead to a hazardous situation.
The text: “does not lead to a hazardous situation”.
One question in the Machinery part.
1.1.9, second paragraph
A hardware component that transmits signals or data, and that matters for access to software critical for the compliance of the machinery, is protected against corruption. The machinery collects evidence of an intervention in that component.
The text: “adequately protected against accidental or intentional corruption”.
Two questions in the Machinery part.
1.1.9, third paragraph
Software and data critical for the compliance of the machinery are designated as such, and protected against corruption.
The text: “shall be identified as such”.
One question in the Machinery part.
1.1.9, fourth paragraph
The machinery knows the installed software it needs to operate safely, and can provide the list at all times. It is a software inventory, which the text does not call an SBOM.
The text: “shall be able to provide that information at all times in an easily accessible form”.
Measured on the software scan linked to the product, otherwise declared by you.
1.1.9, fifth paragraph
The machinery collects evidence of an intervention in its software, or of a modification of its installed software or its configuration.
The text: “collect evidence of a legitimate or illegitimate intervention”.
One question in the Machinery part.
1.2.1, point (a)
The control system withstands, where appropriate to the circumstances and the risks, intended and unintended external influences.
The text: “including reasonably foreseeable malicious attempts from third parties”.
One question in the Machinery part.
1.2.1, point (f)
The tracing log of the data from an intervention and of the versions of safety software uploaded after placing on the market stays enabled for five years after the upload, to demonstrate conformity on a reasoned request from an authority.
The text: “enabled for five years after such upload”.
One question in the Machinery part.
1.2.1, self-evolving machinery
For machinery with fully or partially self-evolving behaviour or logic: not going beyond its defined task and movement space, recording the data on the decision-making process of its safety functions for one year, and being correctable at all times.
The text: “it shall be possible at all times to correct the machinery or related product in order to maintain its inherent safety”.
Three questions in the Machinery part. For self-evolving machinery only; others declare it not applicable.
1.2.1, last paragraph
For wireless control, a failure of the communication or connection does not lead to a hazardous situation.
The text: “a faulty connection shall not lead to a hazardous situation”.
One question in the Machinery part.
A software inventory, without the word
The procedure and the standards
Art. 20 and 25, Annex I
The procedure.
Machinery not listed in Annex I follows internal production control (module A). A category in Annex I, Part A, goes through a notified body. A category in Part B can follow module A if the machinery is designed according to harmonised standards or common specifications specific to its category, covering all its essential requirements; otherwise, it also goes through a notified body (Art. 25).
Annex I and software.
Part A includes safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions, and machinery that has embedded systems of that kind not placed independently on the market, in respect only of those systems (points 5 and 6).
The presumption.
Applying a harmonised standard whose reference is published in the Official Journal gives a presumption of conformity with the requirements it covers (Art. 20(1)). Where there is no standard, the Commission can adopt common specifications (paragraph 3).
Certification.
Machinery certified, or covered by a statement of conformity, under a European cybersecurity certification scheme (Regulation (EU) 2019/881) whose reference is published in the Official Journal is presumed to meet points 1.1.9 and 1.2.1, insofar as the certificate covers them (Art. 20(9)).
The expected standard.
As of 27 October 2026, we found in the Official Journal no reference of a harmonised standard published under Regulation (EU) 2023/1230. The standard being prepared for protection against corruption has the reference prEN 50742: the prefix “pr” marks a draft, which gives no presumption.
Saying whether your machinery falls under Annex I, and which procedure to follow, is not the role of euvex. The references in its Machinery part are internal identifiers, not clause numbers of a standard.
The calendar
Applicable from 20.01.2027
The Regulation is applicable from 20 January 2027. Until then, Directive 2006/42/EC applies, and it is repealed with effect from that same date (Art. 51(2)).
The date.
The text published in the Official Journal on 29 June 2023 said “14 January 2027”. The corrigendum of 4 July 2023 reads “20 January 2027”, in Articles 51, 52 and 54. A source that gives the first date is citing the text from before the corrigendum.
The transition.
A product placed on the market in conformity with the Directive before 20 January 2027 can still be made available (Art. 52(1)). EC type-examination certificates issued under the Directive remain valid until they expire (paragraph 2).
The amendments.
Two regulations amended the text after its publication: Regulation (EU) 2024/2748, on emergency procedures, and Regulation (EU) 2026/1744, which provides for requirements for high-risk AI systems, through delegated acts applicable by 2 August 2028 at the latest. Neither moves the date of application.
Every deadline in the sequence, with its source: the key dates.
With the CRA
CRA, Art. 2(1) and 28(3), recital 53
Machinery with digital elements can also fall under the Cyber Resilience Act, whose scope covers products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Art. 2(1)), subject to its exclusions.
No automatic equivalence.
The CRA sets no presumption for the Machinery Regulation. Its recital 53 says that complying with the CRA could facilitate compliance with points 1.1.9 and 1.2.1, and that “such synergies have to be demonstrated by the manufacturer”, who follows the assessment procedures of both acts.
CRA deadlines.
Reporting of actively exploited vulnerabilities, Art. 14, is applicable from 11 September 2026, and the essential requirements, including the SBOM, from 11 December 2027. The day an Art. 14 case opens.
A single declaration.
Where machinery falls under several acts that require an EU declaration of conformity, the manufacturer draws up a single one for all of them, which identifies those acts and their publication references. The Machinery Regulation says so in Article 21(3), the CRA in Article 28(3).
The file and the declaration
Art. 10 and 21, Annexes IV and V
The technical documentation.
Drawn up before placing on the market, according to Annex IV, Part A (Art. 10(2)). It notably includes the list of applicable essential requirements and the measures taken, test reports, standards applied, and, on a reasoned request from a national authority, the source code or programming logic of safety related software (point (m)).
At least 10 years.
The technical documentation and the declaration stay at the disposal of the authorities for at least 10 years after placing on the market or putting into service (Art. 10(3)).
The declaration.
Drawn up according to Annex V, Part A, “under the sole responsibility of the manufacturer” (point 4), and “continuously updated” (Art. 21(2)). It can accompany the machinery, or be made accessible through an internet address or machine-readable code, online for at least 10 years (Art. 10(8)).
The technical documentation and the EU declaration, in plain terms
What euvex prepares for the Machinery Regulation
The product
The Machinery part.
Twelve questions on the cybersecurity passages of 1.1.9 and 1.2.1, attached to a product and its version, each with the evidence you cite, and a printable report.
The measured inventory.
When a software scan is attached to the product and its inventory holds, the requirement in the fourth paragraph of 1.1.9 is established by measurement, and the list can be exported as CycloneDX at any time. Otherwise, euvex takes what you declared, or leaves it blank. The report always says what it rests on, measurement or declaration.
The declaration.
The part feeds the single EU declaration of conformity of the product, alongside the CRA and RED, with the reference of each act.
What euvex does not do
- It does not say whether your product falls under the Regulation, or under which part of Annex I, or which procedure to follow.
- It does not test the machinery, and does not cover functional safety: most of 1.2.1 and the rest of Annex III are outside its scope.
- It is not a notified body. Its part gives a state of readiness, not a conformity assessment.
- It does not prepare the declaration of incorporation for partly completed machinery, and it signs nothing: the declaration remains issued under your sole responsibility.
Sources
Read in the Official Journal on 27.10.2026, English text on 01.11.2026
- Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023 on machinery, OJ L 165 of 29.6.2023, p. 1. Articles 2, 3, 8, 10, 20, 21, 25, 51, 52 and 54; Annexes I, III (1.1.9 and 1.2.1), IV, V and IX.
- Corrigendum to Regulation (EU) 2023/1230 OJ L 169 of 4.7.2023, p. 35. Points 5, 6 and 10: 20 January 2027 replaces 14 January 2027 in Articles 51, 52 and 54.
- Regulation (EU) 2024/2847, the Cyber Resilience Act Article 2(1); Article 14; Article 28(3); recital 53.
- Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI. Article 3, which amends Articles 8, 20 and 47 of the Machinery Regulation for high-risk AI systems. The date of application does not change.
- Regulation (EU) 2024/2748 of 9 October 2024, on emergency procedures in an internal market emergency. Article 6, which adds a Chapter IVa to the Machinery Regulation. The date of application does not change.
- Every deadline in the sequence, with its source: the key dates.
Declare a machine
The Machinery part is free during the beta. Create a product, attach its software scan, answer the questions. See a complete file, on a fictional product (in French).