The EU Machinery Regulation, explained for the teams who build the machines.
Regulation (EU) 2023/1230 replaces the Machinery Directive from 14 January 2027 — and it brings the machine into the connected age: intervention evidence, protected safety software, control systems hardened against malicious interference, and a dedicated conformity route for machine-learning safety components. If you build machinery or related products for the EU market, this is the law your CE marking will stand on — and partly completed machinery travels on its own parallel track.
Who is in scope
Machinery, five related product groups and partly completed machinery — with named exclusions, not general ones.
Article 2(1) applies the Regulation to machinery and to five related product groups — interchangeable equipment, safety components, lifting accessories, chains, ropes and webbing, and removable mechanical transmission devices — and to partly completed machinery, which travels through the whole text with its own duties. Article 3 carries the definitions, and Article 1 states the purpose: health and safety requirements for design and construction, so products can move on the market while protecting people — consumers and professional users alike.
The exclusions in Article 2(2) are a named list, each with its own limiting conditions — among them: safety components intended to be used as spare parts to replace identical components, supplied by the original manufacturer; fairground and amusement-park equipment; machinery for nuclear installations where conformity could undermine nuclear safety; weapons; most transport (air, water, rail, type-approved road vehicles — except machinery mounted on them); seagoing vessels and mobile offshore units; machinery specially designed and constructed for military or police purposes, or for research purposes for temporary use in laboratories; mine winding gear; performer-moving stage machinery; and — insofar as the low-voltage Directive 2014/35/EU or the radio equipment Directive 2014/53/EU covers them — household appliances intended for domestic use that are not electrically operated furniture, audio and video equipment, IT equipment, ordinary office machinery (except additive printing machinery for producing three-dimensional products, which that entry does not exclude), low-voltage switchgear and control gear, electric motors, and high-voltage switchgear, control gear and transformers. Article 9 adds a lex-specialis rule: where Union harmonisation legislation more specific than this Regulation wholly or partly covers a risk addressed by the Annex III requirements, this Regulation does not apply to the product to the extent of that risk.
The duty-holders form the standard economic-operator chain. Manufacturers carry the core duties (Article 10); importers verify before placing on the market (Article 13); distributors act with due care (Article 15); partly completed machinery has its own parallel chain (Articles 11, 14 and 16). Two manufacturer-status rules close the loop: an importer or distributor that places a product on the market under its own name or trademark, or modifies a product already placed on the market in a way that might affect compliance, takes on the manufacturer's obligations (Article 17), and a person who carries out a substantial modification of machinery is treated as its manufacturer — except a non-professional user substantially modifying their own machinery for their own use (Article 18).
What the manufacturer must do
Design to Annex III, prove it, mark it — and keep the evidence for a decade.
Article 8 is the gate: machinery and related products may be made available or put into service only if, properly installed, maintained and used for their intended purpose or under reasonably foreseeable conditions, they meet the essential health and safety requirements of Annex III. Article 10 turns that into the manufacturer's programme: design and construct to Annex III; draw up the Annex IV technical documentation; run the Article 25 conformity assessment; issue the EU declaration of conformity (Article 21) and affix the CE marking (Article 24); keep the documentation for at least 10 years; ensure series production stays conformant; and take corrective action — informing the national authorities where the product presents a risk.
Two duties are new-generation. The technical documentation now reaches into code: where necessary for checking compliance with Annex III, the source code or programming logic included in the technical documentation must be made available to competent national authorities on a reasoned request (Article 10(3)). And instructions may go digital — but the manufacturer must mark how to access them, keep them printable, downloadable and available online during the product's expected lifetime and for at least 10 years after placing on the market, provide a paper copy free of charge within one month where the user requests it at the time of purchase, and — where the product is intended for non-professional users or can foreseeably be used by them — provide the safety information essential for safe putting into service and use on paper (Article 10(7)).
Conformity leans on standards: products conforming to harmonised standards published in the Official Journal are presumed to conform to the Annex III requirements those standards cover (Article 20(1)), and where standards are missing or inadequate the Commission can adopt common specifications as a fallback (Article 20(3)).
The Annex III requirements a security team will recognise
The Regulation writes intervention evidence, software integrity and attack resilience into machine SAFETY law.
Protection against corruption — Annex III, point 1.1.9
Connecting another device — directly or through a remote device that communicates with the machine — must not lead to a hazardous situation. A hardware component transmitting signal or data that is relevant for connection or access to software critical for the product's compliance with the essential requirements must be protected against accidental or intentional corruption, and the product must collect evidence of legitimate and illegitimate interventions in that hardware component, where relevant for that connection or access. Software and data critical for compliance must be identified as such and protected against corruption; the product must be able to identify, at all times and in an easily accessible form, the software installed on it that is necessary for safe operation, and must collect evidence of interventions in — or modifications of — that software or its configuration (Annex III).
Safety and reliability of control systems — Annex III, point 1.2.1
Control systems must be designed to prevent hazardous situations: they must withstand, where appropriate to the circumstances and the risks, the intended operating stresses and external influences — including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation; hardware faults and logic errors must not lead to hazardous situations. The limits of the safety functions must be established in the manufacturer's risk assessment, and no modifications to the settings or rules generated by the machine or by operators — including during a learning phase — are allowed where the modification could lead to a hazardous situation. A tracing log of the intervention data and of uploaded safety-software versions must stay enabled for five years after upload, exclusively to demonstrate conformity with the Annex on a reasoned request from a competent national authority. Control systems with fully or partially self-evolving behaviour carry three extra rails: the machine must not act beyond its defined task and movement space; safety-related decision data must be recorded and kept for one year after collection, under the same exclusive purpose limitation; and it must be possible at all times to correct the machine to maintain its inherent safety.
Which assessment route applies
Annex I decides — and machine-learning safety functions sit on the strictest list.
Article 25 assigns the procedure by list membership in Annex I; Article 6 governs the lists themselves, including the Commission's power to amend them by delegated act as risk knowledge evolves.
| Category | Route |
|---|---|
| Annex I, Part A | Six entries: removable mechanical transmission devices including their guards; guards for removable mechanical transmission devices; vehicle servicing lifts; portable cartridge-operated fixing and other impact machinery; safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions; and machinery with such embedded safety systems that have not been placed independently on the market — in respect only of those systems. No self-assessment: EU type-examination plus conformity to type (modules B + C), full quality assurance (module H), or unit verification (module G) — Article 25(2). |
| Annex I, Part B | The classic high-risk catalogue, defined by specified types and conditions — among them particular configurations of woodworking saws and planers, qualifying metal presses, injection or compression plastics- and rubber-moulding machinery with manual loading or unloading, and two underground machinery types. Internal production control (module A) survives only where the product was designed and constructed in accordance with harmonised standards or common specifications specific to that category, covering all the relevant requirements; otherwise modules B + C, H or G — Article 25(3). |
| Not listed | Internal production control (module A) — the manufacturer's own assessment, Article 25(4). |
For machinery and related products the paperwork converges: the EU declaration of conformity (Article 21) and the CE marking affixed visibly, legibly and indelibly (Article 24, under the general principles of Article 23). Partly completed machinery carries no CE marking under this Regulation — it gets the EU declaration of incorporation (Article 22) instead. Market surveillance then runs on the standard Union model: the Article 43 national procedure for products presenting a risk, and Article 45 for the uncomfortable case of a compliant product that still presents one. Penalties are national: Article 50 requires effective, proportionate and dissuasive rules and allows criminal penalties for serious infringements — the Regulation itself sets no fine ceilings.
Where machine safety meets AI regulation
A 2026 amendment wires the two regimes together — requirements, standards and timelines.
Regulation (EU) 2026/1744 amended the Machinery Regulation in three places (its Article 3). First, Article 8 gains new paragraphs instructing the Commission to adopt delegated acts adding health and safety requirements to Annex III for AI systems classified as high-risk under Article 6(1) of the AI Act because they are a safety component in a product covered by this Regulation, or are themselves such a product. The requirements must reflect the AI Act provisions the amendment names, the Commission must take the AI Act's objectives into account and ensure a level of protection consistent with it, and the delegated acts are to apply by 2 August 2028.
Second, a new Article 20(10) bridges the standards gap: until machinery-side harmonised standards are referenced or common specifications adopted pursuant to Article 20 for high-risk AI systems, conformity with the relevant harmonised standards referenced under Article 40 of the AI Act — or common specifications adopted under its Article 41, respectively — gives a presumption of conformity with the Annex III requirements as regards those systems. Third, the Article 47 delegation mechanics were extended to carry the new power. The direction of travel is explicit: AI safety in machines is machine-safety law, assessed in the machinery conformity file — and Annex I Part A routes machine-learning safety components through notified-body conformity assessment from 14 January 2027.
One headline date, four staged ones
The Regulation applies from 14 January 2027 — but parts of it have been live since 2023.
Article 54: the Regulation applies from 14 January 2027. The staged exceptions it lists: Articles 26 to 42 from 14 January 2024; the Article 50(1) penalties duty from 14 October 2023; Article 6(7), Article 48 and the Article 52 transitional rules from 13 July 2023; and Article 6(2) to (6), (8) and (11), Article 47 and Article 53(3) from 14 July 2024. Article 51 repeals the Machinery Directive 2006/42/EC with effect from 14 January 2027, with references to the Directive construed as references to the Regulation, read in accordance with the correlation table in Annex XII.
Article 52 settles the shelf question: products placed on the market in conformity with the Directive before 14 January 2027 may continue to be made available — with this Regulation's Chapter VI market-surveillance procedure applying to them, mutatis mutandis, since 13 July 2023 in place of the Directive's Article 11, pending procedures included — and EC type-examination certificates and approval decisions issued under the Directive remain valid until they expire. The practical consequence runs the other way: from 14 January 2027, new placings on the market stand on this Regulation — including the Annex III requirements above — not on the Directive your current file may be built against.
Safety law, next to the neighbouring regimes
The Regulation's own boundary rule is Article 9 — and the AI coupling is written into the text.
The Machinery Regulation is product safety law: its Annex III requirements — intervention evidence, software integrity, attack-resilient control systems — exist to prevent hazardous situations, and they are assessed in the CE conformity file. The boundary rule the Regulation itself states is Article 9: where Union harmonisation legislation more specific than this Regulation wholly or partly covers a risk addressed by the Annex III requirements, this Regulation does not apply to the product to the extent of that risk. For AI, the coupling is explicit and cited above.
For the neighbouring regimes we keep separately cited explainers — the Cyber Resilience Act, the NIS2 Directive, the DORA Regulation and the GDPR — each grounded in its own text rather than summarised here. For a connected machine, the practical reading is one product with more than one file to keep straight: the machinery conformity assessment for safety, and whatever the other regimes attach to the same product or to your organisation.
From annex point to a cited gap analysis
Every answer grounded in the regulation, in the AI client your team already uses.
The fastest way to see where you stand: a gap analysis is one of the workflow types on the Free tier — one run a month on a system you describe, reported as a watermarked document with every finding cited to the article or annex point it comes from. The sample gap analysis shows the deliverable shape end to end.
The Machinery Regulation lands hardest on engineering teams with connected or ML-assisted products — the Annex III corruption-protection and control-system points read like a security backlog. Our sector pages for robotics, agriculture and industrial OT show how the served corpora cover the machine-adjacent regimes side by side.
Questions teams ask about the Machinery Regulation
If your question is not here, email us — every message gets a human answer.
Does the Machinery Regulation apply to my product?
Article 2 applies the Regulation to machinery and five related product groups — interchangeable equipment, safety components, lifting accessories, chains, ropes and webbing, and removable mechanical transmission devices — plus partly completed machinery. The exclusions are named and each carries its own conditions — among them: safety components intended as spare parts to replace identical components, supplied by the original manufacturer; fairground and amusement-park equipment; weapons; most vehicles regulated under their own type-approval regimes (except machinery mounted on them); machinery specially designed and constructed for military or police purposes; and — insofar as the low-voltage or radio equipment rules cover them — household appliances intended for domestic use that are not electrically operated furniture, audio, video and IT equipment and ordinary office machinery, an entry that does not exclude additive printing machinery for producing three-dimensional products.
When does the Machinery Regulation apply?
Article 54: the Regulation applies from 14 January 2027, with earlier dates for specific blocks — Articles 26 to 42 from 14 January 2024, the penalties duty of Article 50(1) from 14 October 2023, and the delegated-act machinery of Article 6 and Article 47 largely from 14 July 2024. Article 52 keeps the transition orderly: products placed on the market in conformity with the Machinery Directive 2006/42/EC before 14 January 2027 may continue to be made available — with this Regulation's Chapter VI applying to such legacy products, mutatis mutandis, since 13 July 2023 — and EC type-examination certificates and approval decisions issued under that Directive remain valid until they expire.
What happens to the Machinery Directive?
Article 51 repeals Directive 2006/42/EC with effect from 14 January 2027, and references to the repealed Directive are construed as references to the Regulation, read in accordance with the correlation table in Annex XII. The practical difference in legal form: a regulation is binding in its entirety and directly applicable in all Member States — the closing formula of Article 54 — so the per-country transposition layer of the Directive era falls away.
Do we need a notified body, or can we self-assess?
It depends on which Annex I list your product is on. Article 25(2): categories in Annex I Part A — among them safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions, and machinery with such embedded safety systems not placed independently on the market, in respect only of those systems — take EU type-examination plus conformity to type (modules B + C), full quality assurance (module H), or unit verification (module G). Article 25(3): Part B categories may use internal production control (module A) only where the product was designed and constructed in accordance with harmonised standards or common specifications specific to that category, covering all the relevant requirements; otherwise a Part A-style route applies. Products on neither list self-assess under module A.
What cybersecurity does the Machinery Regulation require?
Annex III carries it as safety. Point 1.1.9, protection against corruption: connecting another device must not lead to a hazardous situation; hardware components transmitting signal or data relevant for connection or access to compliance-critical software — and the critical software and data themselves — must be protected against accidental or intentional corruption; the product must collect evidence of interventions and be able to identify, at all times and in an easily accessible form, the software installed on it that is necessary for safe operation. Point 1.2.1: control systems must withstand, where appropriate to the circumstances and the risks, reasonably foreseeable malicious attempts from third parties leading to a hazardous situation, and must keep a tracing log of interventions and safety-software versions for five years after upload — exclusively to demonstrate conformity on a reasoned request from a competent national authority. Self-evolving control systems carry extra rails, including that it must be possible at all times to correct the machine to maintain its inherent safety.
How does the Machinery Regulation interact with the AI Act?
Two hooks, both added by amendment in 2026. Article 8 now instructs the Commission to adopt delegated acts adding health and safety requirements to Annex III for AI systems classified as high-risk under Article 6(1) of the AI Act because they are a safety component in — or are themselves — a product covered by the Regulation; those requirements must reflect the named AI Act provisions, the Commission must take the AI Act's objectives into account and ensure a consistent level of protection, and the delegated acts are to apply by 2 August 2028. Article 20(10) bridges the standards gap: until machinery-side harmonised standards are referenced or common specifications adopted for high-risk AI systems, conformity with the relevant harmonised standards referenced — or common specifications adopted — under the AI Act's own standards articles gives a presumption of conformity with the Annex III requirements as regards those systems. Separately, Annex I Part A routes machine-learning safety components through notified-body conformity assessment from 14 January 2027.
What about partly completed machinery?
It is in scope with its own track. Article 11 requires the manufacturer to design and construct it in accordance with the relevant Annex III requirements — relevant, because the assembly is not yet complete — and to draw up the Annex IV Part B technical documentation, assembly instructions and, per Article 22, an EU declaration of incorporation rather than a declaration of conformity. The duties then travel down the chain: importers and distributors of partly completed machinery carry their own verification obligations under Articles 14 and 16.
What are the penalties?
The Regulation sets no EU-level fine ceilings. Article 50 requires Member States to lay down the penalty rules for infringements, to take all measures necessary to ensure they are implemented, and to make them effective, proportionate and dissuasive — and it expressly allows criminal penalties for serious infringements. Enforcement runs through market surveillance: under Article 43, authorities with sufficient reason to believe a product presents a risk carry out an evaluation, and corrective obligations follow a finding of non-compliance; under Article 45 even a compliant product that still presents a risk can be pulled back.
See where you stand before January 2027
A free-tier run produces a cited gap analysis of a product you describe — one row per requirement, each anchored to its article or annex point. Start there, then bring your own documents on a paid plan.