The Machinery Regulation

What the Machinery Regulation changes and when

The Machinery Regulation (EU) 2023/1230 replaces the Machinery Directive 2006/42/EC, which has shaped machine building in Germany for more than fifteen years. According to the EUR-Lex document information, which reflects the corrigenda to the original text, the machinery regulation applies from 20 January 2027; the directive is repealed from the same date.

Some provisions apply earlier, including the rules on notified bodies (since January 2024) and the Member States' duty to notify their penalty rules (October 2026). From 2027, machinery and related products placed on the EU market must comply with the regulation's essential health and safety requirements, its conformity assessment procedures and its new rules on digital instructions, software and substantial modifications.

For German machine builders, component suppliers and plant operators the shift from directive to regulation matters in two ways. First, the rules apply directly, so the national Machinery Ordinance (the Ninth Ordinance under the Product Safety Act) that transposed the directive will lose its role for new machinery. Second, the content has moved on: the machinery regulation responds to collaborative robots, connected machines, machine learning and remote updates, which the 2006 directive did not anticipate.

Scope and key definitions of the machinery regulation

The machinery regulation covers machinery and "related products": interchangeable equipment, safety components, lifting accessories, chains, ropes and webbing, removable mechanical transmission devices and partly completed machinery. Safety components now expressly include digital components, including software, that perform a safety function and are placed on the market separately. That brings standalone safety software into the scope of product law for the first time.

A further key definition is "substantial modification" (Article 3). It covers modifications by physical or digital means after the machine has been placed on the market or put into service which the manufacturer did not foresee or plan, and which affect safety by creating a new hazard or increasing an existing risk so that new guards or protective devices are needed. Under Article 18, whoever carries out a substantial modification is treated as the manufacturer for the affected part, or for the whole machine where the modification affects its safe operation. Plant operators who retrofit, interlink or reprogram older lines must therefore check whether they are taking on manufacturer duties.

Conformity assessment, high-risk categories and AI

As under the directive, most machinery is self-certified through internal production control (module A). Article 25 and Annex I, however, set out two lists of categories that need more. Annex I Part A lists categories where a notified body must always be involved, through EU type-examination (module B with module C), full quality assurance (module H) or unit verification (module G). Annex I Part B lists categories where internal production control is only available if harmonised standards or common specifications are applied in full.

The most discussed Part A entries concern artificial intelligence. Safety components with fully or partially self-evolving behaviour using machine learning approaches that ensure safety functions, and machinery with embedded systems of that kind, require third-party assessment. The recitals clarify that this applies only to learning systems, not to conventionally programmed software that executes automated functions.

Manufacturers using AI in safety functions must also consider the AI Act, under which an AI system that is a safety component of a product covered by the Union machinery legislation listed in Annex I of the AI Act is high-risk where that product must undergo third-party conformity assessment (Article 6(1) AI Act). The two regimes are meant to be applied together, so that one technical file and, where possible, one notified body procedure address both sets of requirements.

New essential health and safety requirements

Annex III of the machinery regulation updates the essential health and safety requirements. Several changes stand out for engineering and compliance teams:

• Protection against corruption: machinery must be designed so that connection to another device, directly or remotely, does not lead to a hazardous situation, and safety-relevant software and data must be protected against accidental or intentional corruption. A cybersecurity certificate under the Cybersecurity Act can create a presumption of conformity for these points (Article 20).
• Safety and reliability of control systems: control systems must log interventions and software versions, and limits must be set for what self-evolving systems may do.
• Human-machine interaction: requirements address psychological stress and the design of autonomous mobile machinery and collaborative applications.
• Risk assessment over the lifecycle: the risk assessment must cover hazards that may arise during the machine's lifecycle, including foreseeable evolutions of its behaviour.

These requirements will be supported by revised harmonised standards. Until those are published in the Official Journal, manufacturers must document how they meet each requirement directly, which increases the importance of a well-structured technical file.

Digital instructions, documentation and economic operators

A practical improvement under the machinery regulation is that instructions for use may be provided in digital format (Article 10). The manufacturer must indicate on the machine or in a document how to access them, make them available in a format that can be printed and downloaded, keep them accessible online for the expected lifetime of the machine and at least ten years after placing on the market, and supply a paper version free of charge within one month if the user asks at the time of purchase.

Technical documentation and the EU declaration of conformity must be kept for at least ten years; source code or programming logic must be made available to authorities on reasoned request.

The machinery regulation also adopts the New Legislative Framework model of economic operators. Importers and distributors have verification and cooperation duties, and authorised representatives act under written mandates. For non-EU manufacturers selling into Germany, the Market Surveillance Regulation already requires an EU-based economic operator for CE-marked products; the new rules make the division of responsibilities in distribution agreements even more important.

Enforcement and the transition in Germany

In Germany, the Machinery Directive was transposed by the Ninth Ordinance to the Product Safety Act (Maschinenverordnung, 9. ProdSV). Because the machinery regulation applies directly, it will take over that role for machinery placed on the market from 2027, while the Product Safety Act continues to provide the national framework for market surveillance and fines. Member States must notify the Commission of their penalty rules, and German legislation will need to align its catalogue of administrative offences with the regulation's duties. Companies should follow the national implementing measures closely and treat the regulation's own text as the primary reference in the meantime.

Market surveillance of machinery is carried out by the occupational safety authorities of the federal states. They may request technical documentation, test products, order corrective measures and withdrawals and, in serious cases, prohibit making a product available.

Breaches also have private-law consequences: a machine that does not meet the essential requirements is likely to be defective under the warranty provisions of the German Civil Code (Bürgerliches Gesetzbuch, BGB) and may give rise to product liability claims if someone is injured. Accident investigations by statutory accident insurers often start with the declaration of conformity and the risk assessment, so the quality of those documents shapes the company's position in any later dispute.

Contracts along the machine supply chain

Machinery projects involve many parties: component and software suppliers, machine builders, integrators who combine machines into lines, and operators who modify equipment over its lifetime. The regulation's allocation of duties should be mirrored in contracts. Supply agreements for safety components should state who acts as manufacturer, which conformity assessment route applies, how software updates are managed and who bears the cost of re-assessment. Integration agreements should define whether the integrator issues a declaration of conformity for the assembly and what documentation each supplier must deliver for partly completed machinery, including the declaration of incorporation and assembly instructions.

Operators should build a modification check into their change-management process. Before reprogramming a line, adding a new robot or changing a safety concept, the engineering team should document whether the change is foreseen by the original manufacturer and whether it creates a new hazard or increases an existing risk. If it does, the operator becomes responsible for conformity of the affected part. Retrofit contracts with service providers should allocate that responsibility expressly. Standard terms for machinery sales should also be reviewed: limitation-of-liability clauses must remain effective under German law on standard business terms, and warranties for software-driven functions need careful drafting.

Preparing for the machinery regulation in 2027

There is no general grandfathering of machine types. Machinery placed on the market from 20 January 2027 must comply with the machinery regulation even if the same design was certified under the directive. Units placed on the market before that date remain lawful. Planning should therefore start with the product roadmap. A sensible sequence is to:

1. map the portfolio against the new definitions, including standalone safety software and partly completed machinery;
2. identify Annex I categories and AI-based safety functions that need a notified body;
3. run a gap analysis of Annex III, with particular attention to cybersecurity and control systems;
4. update templates for declarations of conformity, declarations of incorporation and digital instructions;
5. review supply, distribution and retrofit contracts for the allocation of manufacturer duties and modification risks.

Illustration: a German integrator builds production cells combining a robot from a third-party supplier with its own vision-based safety system that learns to detect human presence. The integrator should expect the vision system to fall under Annex I Part A, plan a module B or H assessment, and agree with the robot supplier who provides which documentation and updates. The Cyber Resilience Act and the AI Act's high-risk rules will apply to many of the same products.

How TRW & Co helps

We advise machine builders, component and software suppliers, integrators and operators on the transition to the machinery regulation. We analyse portfolios against the new scope and Annex I, assess the interplay with the AI Act, the Cyber Resilience Act and the General Product Safety Regulation, review technical documentation processes and draft supply, integration and retrofit agreements that allocate manufacturer responsibilities and liability. We also support companies in dealings with notified bodies and market surveillance authorities. Our product compliance practice works with our manufacturing and Mittelstand team. Please contact us to discuss your 2027 roadmap. This note is general information, not legal advice.