Machinery Regulation 2027 makes cybersecurity a safety requirement

For almost twenty years, machine safety has mainly meant guards, barriers, emergency stops and reliable control systems. From 20 January 2027 that will no longer be enough, because under Regulation (EU) 2023/1230, which replaces Machinery Directive 2006/42/EC, a machine that can be tampered with or attacked over a network is not considered safe.

It is a major shift for manufacturers, integrators and plant operators, because cybersecurity is no longer just an “IT topic” and becomes part of CE marking.

What changes moving from directive to regulation

The first change is formal but has practical effects, because a regulation applies directly in all Member States, without national transposition. The rules are therefore the same across the Union, with no differences in interpretation from one country to another.

The second change concerns content. The Regulation updates the essential health and safety requirements to reflect machines that are increasingly connected, updated through software and, in some cases, equipped with functions based on artificial intelligence. This is where cybersecurity comes in.

The new cybersecurity requirements

Two points in Annex III deal directly with protection against attacks.

1.1.9 – Protection against corruption

• Connecting the machine to another device, including remotely, must not lead to a hazardous situation.
• Safety-relevant hardware and software components must be protected against accidental or intentional corruption.
• The machine must collect evidence of interventions, legitimate or not, on safety-relevant software and configuration.
• Safety-critical software must be identified, so that its version can be checked at any time.

1.2.1 – Safety and reliability of control systems

• Control systems must withstand not only normal operating stresses but also malicious attempts by third parties that could lead to a hazardous situation.
• Interventions and versions of safety software uploaded after the machine is placed on the market must be recorded in a tracing log kept enabled for five years after each upload.

In other words, the machine’s risk assessment must also consider who could deliberately manipulate it, for example through an unprotected remote access, a USB stick, an unverified firmware update.

Who is affected

• Machine manufacturers, who must design protection in from the start and document it in the technical file.
• Integrators and line builders, who assemble machines and components from different suppliers and are responsible for them as a whole.
• Anyone who substantially modifies a machine, even after commissioning, because whoever makes a substantial modification takes on the manufacturer’s obligations. Changing the safety software or adding a new remote connection may fall into this category.
• Plant users and operators, who are not directly subject to the design obligations but must maintain safe conditions over time, such as access, updates and network segmentation.

The relationship with the Cyber Resilience Act

The Machinery Regulation is not the only rule on the way. The Cyber Resilience Act (Regulation (EU) 2024/2847) covers products with digital elements, such as PLCs, HMIs, gateways, software and, in many cases, the machine itself.

• From 11 September 2026, the obligations to report actively exploited vulnerabilities and severe incidents apply.
• From 11 December 2027, all obligations apply, including secure design requirements and vulnerability handling throughout the life cycle.

The two regulations look at the same product from different angles. The Machinery Regulation requires that an attack does not endanger people’s safety, while the CRA requires the product to be secure from a cyber point of view and to stay that way. It makes sense to handle them with a single process rather than two separate projects.

How to demonstrate compliance

Harmonised standards specifically covering protection against corruption are still being developed. In the meantime, several established technical references can be used.

• EN ISO 12100 for machine risk assessment, to be extended to cyber threats.
• ISO/TR 22100-4, which gives guidance on considering IT security aspects in machine design.
• EN ISO 13849 and IEC 62061 for the functional safety of control systems.
• IEC 62443, in particular part 4-1 for secure development, 4-2 for component requirements, 3-2 and 3-3 for risk assessment and system requirements. It is the most complete reference for turning requirements into technical choices.

For those integrating systems from different suppliers, a reference framework that defines in advance what to require from EPCs, general contractors, integrators and suppliers helps make security requirements verifiable across the whole supply chain.

Six steps to be ready by January 2027

1. Inventory connected machines and components, that is, work out which have network ports, remote access or software updates.
2. Extend the risk assessment to intentional threats, linking them to the physical hazards an attack could cause.
3. Protect access with authentication, separation between the machine network and the plant network, controlled and logged remote access.
4. Manage safety software by identifying versions, checking integrity and logging updates for five years.
5. Update the technical file and instructions with the measures adopted and guidance for the user.
6. Align suppliers and subcontractors with clear contractual requirements, and set up the vulnerability handling processes required by the CRA.

In short

With the new Machinery Regulation, cybersecurity becomes part of product safety, so a vulnerable machine is not compliant. Those who start now have time to build these requirements into design and supplier relationships, instead of chasing them at the last minute.

To find out more, see the page on CRA and Machinery Regulation or get in touch for an assessment of your machines and plants.