The rulebook for selling machinery in Europe is being replaced for the first time in almost twenty years. The EU Machinery Regulation, Regulation (EU) 2023/1230, repeals the Machinery Directive of 2006 and applies from 20 January 2027. Among its new essential requirements is one that would have made little sense in 2006: the machine “shall identify the software installed on it that is necessary for it to operate safely, and shall be able to provide that information at all times in an easily accessible form.”
That single sentence changes what a manufacturer needs to know about its own products. It is no longer enough to know what was built. The regulation assumes you can say what a machine is running, and whether anyone has changed it.
Key Takeaways
- The EU Machinery Regulation applies from 20 January 2027 and replaces the Machinery Directive 2006/42/EC from the same date.
- Software and data that are critical to safety must be identified and protected against accidental or intentional corruption.
- A machine must identify its safety-relevant software and collect evidence of any intervention in, or modification of, that software or its configuration.
- A change made by digital means after sale can count as a substantial modification, which makes the update process part of safety compliance.
A New Rulebook From January 2027
The Machinery Directive was written for machines whose safety lived in their mechanics and wiring. The regulation that replaces it was written for machines whose safety increasingly lives in software, controllers and connections.
The timing is worth getting exactly right. The regulation as first published gave an application date of 14 January 2027. A corrigendum published a few days later corrected it to 20 January 2027, along with several other dates in the text, and the Machinery Directive is repealed with effect from the same corrected date. Some early commentary still carries the uncorrected date.
Because this is a regulation rather than a directive, it applies directly across member states instead of being transposed into separate national laws. For a manufacturer exporting into Europe, that means one text to design against.
Software Is Now a Safety Component
The clearest shift is in the essential requirement headed “Protection against corruption.” Connecting another device to a machine, whether directly or through a remote device, must not “lead to a hazardous situation.”
The requirement then goes further. “Software and data that are critical for the compliance of the machinery or related product with the relevant essential health and safety requirements shall be identified as such and shall be adequately protected against accidental or intentional corruption.” Hardware that carries signals or data relevant to accessing that software must be protected in the same way.
The control-system requirements move in the same direction. Control systems must be able to withstand “reasonably foreseeable malicious attempts from third parties leading to a hazardous situation.” A deliberate attack is now something a machine’s safety case has to anticipate, not only a component failure.
The Machine Has to Know What It Is Running
The obligation to identify the software necessary for safe operation, and to provide that information “at all times in an easily accessible form,” sounds modest. In practice it exposes a gap many manufacturers have.
Ask most equipment makers which software version is running on a specific machine in a customer’s facility today, and the honest answer is the version it shipped with, plus whatever updates the service records say were applied. That is a reconstruction, not a reading. It is also the same blind spot described in why manufacturers lose track of equipment after it ships, applied to firmware instead of location.
The regulation places the requirement on the machine itself. The machine must be able to say what it is running. For the manufacturer, the natural next question is whether that information ever reaches anyone who could act on it.
Every Change Has to Leave a Trace
The requirement that stands out most for connected equipment is about evidence. The machine “shall collect evidence of a legitimate or illegitimate intervention in the software or a modification of the software installed on the machinery or related product or its configuration.”
Note the words “legitimate or illegitimate.” The machine is not only expected to detect tampering. It is expected to record authorised changes too, including configuration changes that a dealer or service technician makes in the ordinary course of work.
That is a record-keeping obligation built into the product. It will matter after an incident, when the first question is what state the machine was in, and it will matter in service, when a machine behaves differently from its siblings and the reason turns out to be a setting someone changed two years ago.
An Update Can Become a Modification
The regulation defines a substantial modification as a change made “by physical or digital means” after the machine has been placed on the market, “which is not foreseen or planned by the manufacturer,” and which affects safety by creating a new hazard or increasing an existing risk.
The words “digital means” bring software updates into scope. A change the manufacturer foresaw and planned sits on one side of that line. A change it did not, such as third-party software, an unapproved configuration or a workaround applied in the field, can sit on the other, with consequences for whoever made it.
For manufacturers this makes the update process part of safety compliance. Knowing which updates exist is not enough. It helps to be able to show which updates each machine received, when, and that they were the ones you planned. The connectivity choices that decide whether you can reach a shipped machine at all are covered in how manufacturers choose connectivity for equipment they ship.
What to Settle Before 2027
A short list covers most of the practical work. Identify which software and data on each product line are critical to safety, and document it. Decide how the machine will report its installed safety-relevant software, and in what form. Decide how evidence of interventions and configuration changes will be recorded, and who can read it. Define which updates are foreseen and planned, and how you will prove a machine received only those. And if you plan to move to digital instructions, note the conditions: among them, instructions must remain accessible online during the machine’s expected lifetime and for at least ten years after it is placed on the market.
None of these is purely a legal task. Each one depends on design decisions that are far cheaper to make before a product’s specification is frozen than after.
Where ARMOR™ Fits
ARMOR™ does not make a machine compliant with the Machinery Regulation, and it is not part of a machine’s safety system. Compliance, including the protection of safety-critical software and the machine’s own record of interventions, remains a matter of machine design and conformity assessment.
What ARMOR™ provides is the installed base picture those obligations assume. ARMOR 4+™ reports from each machine into ARMOR Asset Central™, so the manufacturer has a live record of which units are in service, where, and how they are running, rather than a reconstruction from shipping and service paperwork. That is the foundation for knowing which machines an update reached and which it did not.
The unit installs non-destructively using standard wiring harnesses, with no bill-of-materials redesign. How it is built in at the production stage is set out on the ARMOR™ for Equipment Manufacturers page.
Frequently Asked Questions
Is the date 14 January or 20 January 2027?
20 January 2027. The regulation as originally published said 14 January, and a corrigendum published in the Official Journal on 4 July 2023 corrected it. The Machinery Directive is repealed with effect from the same corrected date.
We already prepared for the Cyber Resilience Act. Is this the same work?
They are separate laws with different purposes. The Machinery Regulation is about the health and safety of machinery, including protection against corruption of safety-critical software. Some of the engineering overlaps, but compliance with one should not be assumed to cover the other. Check both with whoever handles your conformity assessment.
Can we stop shipping paper manuals?
The regulation allows instructions in digital format, with conditions. They must be printable and downloadable, remain accessible online for the machine’s expected lifetime and at least ten years, and a user who asks at the time of purchase must receive a paper copy free of charge within one month.
Does this apply if we sell only in North America?
Only if your machines reach the EU market, including through a distributor or a customer who exports them. The obligation attaches to the product placed on that market, not to the manufacturer’s home country.
See how ARMOR™ is built into equipment like yours, at the build stage. ARMOR™ for Equipment Manufacturers
