Regulation (EU) 2023/1230 applies on 20 January 2027. But the text to read is no longer that of June 2023. Since its publication, it has been corrected once and amended twice. The consolidated version published by EUR-Lex is dated 27 July 2026.
Our first article describes the Regulation article by article. This one takes stock: what has changed since 2023, what the text brings, what it costs, and to whom.
The essentials
- Three changes since 2023. A corrigendum on dates in 2023, emergency procedures in 2024, artificial intelligence in 2026.
- AI goes through the Machinery Regulation. Since 27 July 2026, the AI Act no longer applies directly to AI in machinery. Its requirements will be written into the Machinery Regulation, by 2 August 2028 at the latest.
- The gains. A single text across the Union, written roles for each operator, a definition of substantial modification, documentation that can be digital.
- The costs. A switch with no overlap, harmonised standards not yet cited, cybersecurity requirements with no reference standard, a mandatory notified body for six categories.
- One more change pending. It concerns the declaration of conformity and the instructions for use. It has not been adopted.
A text already changed three times
| Act | Date | What it changes |
|---|---|---|
| Corrigendum, OJ L 169 | 4 July 2023 | Corrects the dates: the 20th replaces the 14th. The Regulation applies on 20 January 2027. |
| Regulation (EU) 2024/2748 | 9 October 2024 | Adds Chapter IVa: emergency procedures for machinery declared “crisis-relevant goods”. |
| Regulation (EU) 2026/1744 | 8 July 2026, in force on 27 July 2026 | Routes the requirements applicable to high-risk AI through the Machinery Regulation. Amends Articles 8, 20 and 47. |
The consolidated version is a documentation tool. It has no legal value: only the texts published in the Official Journal are authentic. It is nonetheless the one to have in front of you, because it brings the four texts together in one.
The 2024 emergency procedures
Regulation (EU) 2024/2748 accompanies the Internal Market Emergency and Resilience Act, Regulation (EU) 2024/2747. It adds Articles 25a to 25e to the Machinery Regulation.
These articles have no effect until three conditions are met:
- the Commission has adopted an implementing act covering machinery;
- the machinery concerned has been designated as crisis-relevant goods;
- the internal market emergency mode is activated.
Only then:
- notified bodies process the files for this machinery as a priority;
- a Member State may authorise the placing on the market of a machine without the notified body involvement normally required, if conformity with the essential requirements is demonstrated by another procedure;
- a machine authorised by this route does not bear the CE marking;
- the Commission may designate standards or establish common specifications, valid for the duration of the crisis.
For a manufacturer, there is nothing to do today. You only need to know that this chapter exists.
Artificial intelligence: what July 2026 changes
Before
The AI Act, Regulation (EU) 2024/1689, classifies as “high-risk” an AI system that is a safety component of a product subject to third-party assessment. Machinery legislation was listed in Section A of its Annex I. A machine with a safety function relying on AI therefore fell under both regulations, applied in parallel.
After
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, moves the Machinery Regulation from Section A to Section B of that annex. Four effects.
- The AI Act no longer applies directly. For these systems, only its Article 6(1), its new Article 60a on testing in real-world conditions, and its Articles 102 to 112 remain applicable.
- The requirements go through the Machinery Regulation. The Commission must supplement Annex III by delegated act. The new subparagraph of Article 8 requires it to take over the requirements of the AI Act: risk management, data, documentation, logging, human oversight and robustness, then quality management system, retention of logs, post-market monitoring and reporting of serious incidents.
- A deadline. These delegated acts apply by 2 August 2028 at the latest.
- A bridge for standards. As long as no harmonised standard covers AI under the Machinery Regulation, a system that conforms to the harmonised standards or common specifications of the AI Act is presumed to conform to the requirements of Annex III on this point. This is the new paragraph 10 of Article 20.
The same text tightens the definition of “safety component” in the AI Act. A component fulfils a safety function when its intended purpose is to prevent or mitigate a risk to the health and safety of persons or property. The recital that explains it excludes AI systems that serve only to assist the user, to optimise performance or to automate a task. The mere fact of being integrated into a regulated product is not enough.
What does not change
The Omnibus touches neither Annex I nor the requirements already written in Annex III. On 20 January 2027:
- a safety component, or the embedded system of a machine, whose behaviour evolves through machine learning and which ensures a safety function, remains in Part A of Annex I. The notified body is mandatory;
- the requirements on self-evolving behaviour apply. The limits of the safety functions are set at the design stage. The machine does not act outside its defined working space. Safety decisions taken by software are recorded and kept for one year.
The uncertainty therefore concerns the content of the future delegated acts. It does not concern the date of 20 January 2027.
Directive and Regulation: what changes
| Subject | Directive 2006/42/EC | Regulation (EU) 2023/1230 |
|---|---|---|
| Nature of the text | Directive, transposed by each State | Regulation, directly applicable |
| Operators covered | Manufacturer and authorised representative | Manufacturer, authorised representative, importer, distributor (Articles 10 to 17) |
| Machine modified in service | No rule | Substantial modification defined; whoever carries it out becomes the manufacturer (Articles 3 and 18) |
| High-risk machinery | Annex IV, 23 categories; self-certification possible with harmonised standards | Annex I: 6 categories with a mandatory notified body, 19 with self-certification subject to a condition |
| Procedures | Internal checks, EC type-examination, full quality assurance | Modules A, B with C, H, and G, unit verification, which is new |
| Safety component | Component, with no mention of software | Physical or digital, software included |
| Software and cybersecurity | Absent | Protection against corruption, resistance to malicious acts, logs |
| Autonomy and learning | Absent | Self-evolving behaviour, autonomous mobile machinery, supervisory function |
| Instructions for use | Accompany the machine; paper was the rule | Digital possible; paper on request at the time of purchase |
| Declaration of conformity | Accompanies the machine | Accompanies the machine, or accessible via an internet address or a machine-readable code |
| Retention of the technical documentation | Ten years after manufacture | Ten years after the placing on the market or putting into service |
| Missing harmonised standard | No other means of obtaining the presumption of conformity | Common specifications adopted by the Commission, which give the same presumption (Article 20) |
| Crisis situation | Nothing | Emergency procedures (Chapter IVa) |
The detail of each row is in the first article.
The advantages
What follows is our reading of the text. It commits IndustryHub, not the legislator.
A single text across the Union. There is no longer a national transposing law, so no more differences in wording from one country to the next. A manufacturer selling in several States reads a single version.
Written roles. The importer and the distributor now have their own obligations. The importer checks that the manufacturer has done its work, puts its name on the product and keeps the declaration for ten years. For a European manufacturer, this is support against non-compliant imported products.
A rule for the modified machine. The Directive was silent. The Regulation sets four conditions and one consequence. The operator knows which question to answer before transforming a line.
Self-certification largely maintained. Outside Annex I, the manufacturer remains under internal production control. This is the case for the great majority of machinery.
A route for the one-off machine. Module G, unit verification, did not exist in the Directive. It suits a special-purpose machine covered by Annex I and produced as a single unit.
Documentation that can be digital. Instructions for use, assembly instructions and declaration can be put online. Systematic printing disappears.
Software treated together with safety. Cybersecurity and functional safety enter the same risk assessment and the same technical documentation.
Less duplication for AI. Since July 2026, the requirements applicable to the AI of a machine are due to appear in a single text, the Machinery Regulation, with a single assessment procedure.
Solutions where the standard is missing. The Commission can adopt common specifications. And a product certified under a European cybersecurity scheme is presumed to conform to the requirements on corruption and on control systems, within the limits of what the certificate covers.
The existing fleet preserved. A machine placed on the market under the Directive before 20 January 2027 can continue to be sold. It does not need recertifying. EC type-examination certificates remain valid until they expire.
The drawbacks
A switch with no overlap. The day before, the Directive alone. On the day itself, the Regulation alone. Stock built in 2026 and placed on the market after the date falls under the Regulation.
Harmonised standards not yet cited. A standard only gives the presumption of conformity once its reference is published in the Official Journal under the Regulation. As of 12 October 2026, the Commission’s page refers only to the standards cited for the Directive. According to the Dutch federation RAI Vereniging, the first list is not expected before the end of 2026. The risk is concrete for Part B of Annex I: without a harmonised standard or common specification covering all the requirements, self-certification is closed and a notified body is needed.
No guide to application. The Directive had its own, updated in April 2024. The one for the Regulation has not been published to date.
Cybersecurity with no reference standard. Sections 1.1.9 and 1.2.1 of Annex III apply on 20 January 2027. A draft European standard, prEN 50742, is being prepared for protection against corruption. The Cyber Resilience Act, Regulation (EU) 2024/2847, only applies on 11 December 2027, nearly eleven months later. Its recital 53 states that compliance with its requirements could facilitate compliance with the two sections of the Machinery Regulation. It adds that it is for the manufacturer to demonstrate this. There is therefore no automatic presumption, and there are two texts to follow.
In early 2026, four European federations, CECE, CECIMO, EGMF and FEM, asked for section 1.1.9 and point (f) of section 1.2.1 to be aligned with the date of 11 December 2027. They put the cost of compliance at more than one million euros per platform architecture. The figure is theirs; we did not verify it. The European Trade Union Confederation (ETUC) had opposed any postponement as early as November 2025. The consolidated version of 27 July 2026 contains no postponement.
Records to be designed. One year for safety decisions taken by software. Five years for the log of interventions and of safety software versions. Memory, time-stamping and protection of this data must be provided for from the design stage.
Source code on request. An authority may require, on a reasoned request, the source code or programming logic of the safety software. Article 49 imposes confidentiality on the authorities. The handover still has to be organised with software suppliers.
A notified body with no alternative. For the six categories in Part A, applying harmonised standards in full no longer opens self-certification. The manufacturer bears the cost and the lead time of the body.
An operator who may become a manufacturer. A substantial modification transfers the manufacturer’s obligations to whoever carries it out: technical documentation, conformity assessment, declaration. The four conditions leave room for interpretation. Every modernisation project calls for a written analysis.
Two channels for the instructions. Digital instructions must remain online for the expected lifetime of the machine, and for at least ten years. Paper is still due within one month if the purchaser asks for it at the time of purchase. And the essential safety information stays on paper for machinery that a non-professional can use.
A text still in motion. The delegated acts on AI are still to come. The Commission can move a category of machinery from one part of Annex I to the other. One more amendment is in the process of adoption.
Penalties that remain national. Each State sets its own scale. In Germany, the implementing law of 2 December 2025 (MaschinenDG) provides for fines of up to EUR 100,000 for the most serious breaches, and up to one year in prison in cases of persistent repeat offending or endangerment. There is a single Regulation, but not a single penalty.
Swiss alignment still to be confirmed. Switzerland is to bring the Regulation into its law through a revision of the Swiss Machinery Ordinance. We found no confirmation of its adoption at the date of this article.
The pending amendment: Omnibus IV
On 21 May 2025, the Commission proposed a regulation on digitalisation and common specifications, called Omnibus IV. It amends several pieces of product legislation, including the Machinery Regulation.
Where the text stands:
| Date | Step |
|---|---|
| 21 May 2025 | Commission proposal, COM(2025) 504 |
| 9 June 2026 | Provisional agreement between Parliament and the Council |
| 14 July 2026 | Approval of the text by the parliamentary committee |
| 23 November 2026 | Indicative date of the plenary vote |
The text has therefore not been adopted. The consolidated version of 27 July 2026 does not include it.
Two points concern machinery, according to the proposal and the reactions it prompted. The declaration of conformity would become digital by default. And the manufacturer would have to indicate a “digital contact”, that is, a means of reaching it online.
On 17 February 2026, seven European manufacturers’ federations, including CECE, CECIMO, CEMA and FEM, protested. According to them, machinery would be the only sector deprived of the twenty-four-month adaptation period granted to the others. They also contested the obligation of direct access, by QR code, to the declaration of each machine.
We have not read the final text of the agreement. These points are to be checked when it is published in the Official Journal.
Who gains, who pays
| Stakeholder | What it gains | What it costs |
|---|---|---|
| Manufacturer of series-produced machinery | A single text for all its markets; digital instructions and declaration | Document templates to redo; stock to sell off before the date; ten years of online availability |
| Builder of special-purpose machinery | Unit verification for a one-off machine in Annex I | A risk assessment to complete: corruption, attacks, interactions between machines |
| Line integrator | Responsibility limited to the machine affected, when the modification concerns only one element of an assembly | Manufacturer status with every substantial modification |
| Manufacturer of automation equipment and safety components | Safety software recognised as a product, sold with its declaration | The notified body for machine learning; the logs; the Cyber Resilience Act in parallel |
| Importer, distributor | Clear obligations, identical across the Union | Checks before sale; its name on the product; ten years of retention |
| Operator | An existing fleet preserved; a framework for judging its modifications | A written analysis before each transformation; the manufacturer’s obligations if the modification is substantial |
Cybersecurity: what the text really requires
Four requirements, as read in Annex III.
- A connection, local or remote, does not create a hazardous situation.
- The software and data on which compliance depends are identified and protected against corruption, accidental or intentional.
- The machine can indicate which software necessary for its safety is installed. It keeps evidence of interventions, legitimate or not.
- The control system withstands reasonably foreseeable malicious attempts by third parties, where these could create a hazardous situation.
What the text does not require
One sometimes reads, in commercial documents, that the manufacturer will have to prove that its machine is “tamper-proof”. The text does not say so. It requires adequate protection, proportionate to the risks, against what is reasonably foreseeable.
Its purpose is also narrower than is often thought. The Machinery Regulation protects the health and safety of persons. Data confidentiality and production availability fall under other texts: the Cyber Resilience Act for products, the NIS 2 Directive for companies.
Certified components help, but are not enough
Automation manufacturers put forward certifications to IEC 62443-4-2. Bosch Rexroth, for example, announces a certification at security level 2, issued by TÜV Rheinland, for its control operating system ctrlX OS.
Such a certification covers the component. It lightens the demonstration to be made by the machine builder. It does not replace it. To date, no standard is cited under the Regulation, IEC 62443 included. And the presumption of Article 20(9) only holds for European certification schemes adopted under Regulation (EU) 2019/881.
Five questions to ask
- Which functions of the machine become dangerous if a third party takes control of them?
- Where can it get in: network, remote access, USB port, maintenance workstation?
- Which software and which parameters carry safety, and who can modify them?
- How does the machine keep a record of an intervention?
- For how many years will the components receive patches? The Cyber Resilience Act sets a minimum of five years. A machine often lasts longer.
The updated timeline
| Date | Event |
|---|---|
| 20 October 2026 | Member States apply and notify their rules on penalties (Article 50). |
| 23 November 2026 | Indicative date of Parliament’s vote on Omnibus IV. |
| End of 2026 | First list of harmonised standards expected, with no firm date. |
| 20 January 2027 | Application of the Regulation. Repeal of Directive 2006/42/EC. |
| 11 December 2027 | Application of the Cyber Resilience Act. |
| 20 July 2028 | First evaluation report by the Commission (Article 53). |
| 2 August 2028 | Deadline for application of the delegated acts on high-risk AI. |
What to do now
- Work from the consolidated version of 27 July 2026, and record that date in your procedures.
- For a machine in Part B of Annex I, prepare two scenarios: standards cited in time, or a notified body.
- Address cybersecurity in the risk assessment now, without waiting for the standard.
- Ask automation suppliers for their certificates and their support period.
- For any safety function based on machine learning, get in the queue with a notified body and follow the delegated acts.
- Plan online access to the declaration of conformity, without freezing the template before Omnibus IV is adopted.
- On the operator side, write the procedure for analysing modifications to machinery in service.
Sources
- Regulation (EU) 2023/1230, consolidated version of 27 July 2026 — Articles 3, 8, 10, 18, 20, 25 to 25e, 47, 49, 52 to 54; Annexes I, III, IV.
- Regulation (EU) 2026/1744, Digital Omnibus on AI — recital 42, Articles 1 and 3.
- Regulation (EU) 2024/2748, emergency procedures.
- Regulation (EU) 2024/2847, Cyber Resilience Act — recital 53, Articles 13, 69 and 71.
- European Parliament, file 2025/0134(COD), Omnibus IV — stages of the procedure.
- Cyprus Presidency of the Council, press release of 9 June 2026 — provisional agreement.
- CECE and six other federations, press release of 17 February 2026.
- Eurogip, what the Digital Omnibus on AI changes for the Machinery Regulation, 6 August 2026.
- IBF, request to postpone the cybersecurity requirements, 19 March 2026, in German.
- RAI Vereniging, first list of harmonised standards.
- German implementing law, MaschinenDG, in German.
- European Commission, machinery page.
- Bosch Rexroth France, white paper “Sécuriser l’avenir de l’automatisation” (in French), a commercial document, for the certification example.
This article is an information summary. It replaces neither a reading of the official text nor the opinion of a notified body on a given product.
Going further
- Machinery Regulation: what changes on 20 January 2027
- Functional safety of machinery: IEC 62061 and ISO 13849
- ISO 13849, IEC 62061 and IEC 60204-1
- IEC 62443, security of industrial systems
- OT cybersecurity
- Standards register: safety of machinery
The Machinery Regulation is neither a mere change of reference nor a break with the past. For most machinery, the method remains that of 2006. What really changes comes down to three words: software, responsibility, documentation. And the text keeps moving: read the consolidated version, and check its date.