Regulation (EU) 2023/1230 on Machinery: a new era for security and industrial innovation

The European Parliament’s approval of the Regulation on Machinery (EU) 2023/1230 is a crucial step towards ensuring that the old continent’s industrial sector will be able to meet the challenges of Industry 4.0 securely.

From 20th January 2027, the new series of laws will replace the previous Directive 2006/42/CE, bringing the legislative framework up to date with recent technological developments involving the Internet of Things (IoT), artificial intelligence (AI) and increased digital connectivity.

This change in legislation signals a radical departure for companies, who from now on, will be required to incorporate the new requirements into the design, production and management of industrial machinery.

Legislative developments from 2006 to 2023

The main difference between the Machinery Directive 2006/42/CE and the new regulation lies in their giuridical nature.  The Directive had to be transposed into each member state’s national legislation, running the risk that the resulting laws may not be uniform or could be subject to different interpretations.  Regulation 2023/1230 will instead be directly applicable in all EU member states, ensuring immediate, efficient legislative harmonisation.

The update mainly focuses on points linked to health, security and compliance, with special focus on the dangers associated with emerging technologies.  This includes not only traditional mechanical risks, but also digital ones, such as IT tampering, unauthorised software modifications and vulnerabilities in connected interfaces.

New obligations for the entire sector

The Machinery Regulation reformulates roles, definitions and responsibilities, expanding compliance obligations to include various key operators in the supply chain (producers, importers, distributors and agents).  Each of these is allocated specific tasks, including the verification of documentation and EC labelling, and correct machinery identification.

The objective is twofold:

1. to prevent unsafe machinery from entering the market;
2. to reinforce traceability and transparency across the supply chain.

This systemic approach is based on the principle of shared responsibility, which is already a feature of other European regulations, such as the General Data Protection Regulation (GDPR).

Cybersecurity: a cornerstone of the new regulation

One of the most innovative aspects is the specific integration of cybersecurity as part of the essential security requirements.  Paragraphs 1.1.9 and 1.2.1 of the regulation stipulate machinery must be designed to be resistant to modification, with integral mechanisms to protect against unauthorised external access.

This emphasis is motivated by the exponential increase in digital connections between machines, which expose the industry to vulnerabilities including ransomware, unautorised remote access, industrial sabotage and the theft of sensitive data.  This has led to the necessity of ensuring that all equipment is not only mechanically safe but also resilient in terms of cybersecurity.

Preparing for 2027: step by step

Although the new legislation is not set to come into force until January 2027, companies must start their compliance procedures immediately.  Considering the length of design and production phases, postponing preparations could mean risking their products not being ready for the market.

Some of the key measures to be introduced include:

• analysis of substantial modifications: the regulation clarifies that any modification (even post-production) coul lead to a product’s original conformity being forfeited. This implies new responsibilities for those carrying out updates or repairs;
• traceability of software used in the machines: every digital component must be registered, evaluated and updated securely;
• rigorous component selection, especially in terms of interoperability and updating.

Integration with the Cyber Resilience Act (CRA)

Another key element to consider is the regulation’s synergy with the Cyber Resilience Act, adopted  on 23rd October 2024 and which is also due to come into force in December 2027.  The CRA defines security directives governing all products with digital elements for the duration of their life cycle (design, production, distribution, use, update and disposal).

Companies must therefore activate a strategy of joint compliance, able to meet the requirements of both the Regulation on Machinery and the CRA.  There are some overlaps in the regulations, including:

• protection from cyber attacks;
• management of software updates;
• verification of the digital integrity of devices;
• obligation of notification in case of serious vulnerabilities.

The above regulatory convergence underlines the EU’s increasingly integrated approach to cyber-physical system security.

Recommendations for compliance with the Regulation on Machinery (EU)

In order to deal with the change efficiently, companies must adopt a strategic vision and an articulated operational approach.  Below are some of the main operational recommendations:

1. security by design: incorporating security (both physical and digital) from the early stages of design, according to the principle of ‘Security by Design and by Default’:
2. a systemic approach to security: it is not sufficient to protect single components. The entire ecosystem must be secure, from network interfaces to peripheral devices;
3. continuous compliance: constantly monitoring the machinery’s compliance over time, updating software, documentation and operational practices;
4. secure software lifecycle: ensure secure development, regular patch application and the use of trustworthy programming languages;
5. access and digital identity control: implementing advanced authentification systems to prevent unauthorised access to devices and data;
6. incident response plans: preparing strategies to deal with any breaches or attacks quickly and efficiently;
7. verification of external ecosystems: every partner, supplier or software developer must demonstrate that they respect European security standards;
8. staff training: promoting a security-based company culture, via regular training and refresher courses;
9. exploiting the CRA: using the guidelines and tools stipulated in the Cyber Resilience Act to strengthen compliance with the requirements of the new regulation;
10. documentation and traceability: keeping detailed evidence of the measures adopted, incidents recorded and improvements introduced.

The Regulation on Machinery (EU) 2023/1230) constitutes a necessary and long-term development for European industry.  It establishes a more complete, modern and responsive legislative framework to meet the challenges of an increasingly digitalised, interconnected era.  Although complying with it may seem complex, it is in reality a strategic investment to ensure competitivity, innovation and, above all, security.

The ability of companies to respond proactively to these challenges will determine their success in decades to come. The industry of the future will not only be smart and sustainable but also secure and the Regulation on Machinery already forms one of its cornerstones.

Translated by Joanne Beckwith