From 20 January 2027, EU Machinery Regulation 2023/1230 will introduce new safety requirements. These requirements apply to machinery placed on the market. Manufacturers remain responsible when machinery is first placed on the market. However, operators will assume broader responsibilities throughout the machine lifecycle. This applies particularly when equipment undergoes a substantial modification.
Cybersecurity, artificial intelligence and technical documentation will become more closely linked to machinery safety compliance. The regulation changes how existing machinery must be assessed after alterations or upgrades. An operator that makes a substantial modification may be treated as the manufacturer of the modified machine. This status creates obligations that traditionally applied to machine builders. These include risk assessment, technical documentation and conformity assessment. These steps must be completed before the equipment returns to service.
The transition is complicated by the current lack of detailed official implementation guidance. Therefore, manufacturers, system integrators and plant operators must make decisions without a complete interpretation of every practical situation. According to Leuze, early preparation is important. This is especially relevant for organisations that regularly adapt machinery to new products, processes or automation requirements.
Substantial modifications can change the compliance role
The distinction between routine work and a substantial modification will directly affect machine operators. If a change qualifies as a substantial modification, the operator may assume the responsibilities of a manufacturer. These responsibilities include conducting a risk assessment and maintaining the required technical documentation. They also include completing a conformity assessment before the modified machine returns to operation.
For production sites, this increases the importance of defined and documented modification procedures. Changes to guarding, controls, automation functions or other safety-related elements must be recorded clearly. This documentation should support a later compliance assessment. The issue is not limited to new machinery purchases. Existing equipment may also require review when planned upgrades change its operation or safety characteristics. Leuze advises operators to involve machinery manufacturers and system integrators when assessing planned changes. Their involvement can help clarify how a modification affects machine compliance and which documentation is required. Organisations should also review the new regulation early. Waiting until the application date may create difficulties because assessing installed machinery and establishing internal procedures can take time.
Cybersecurity enters the machine safety framework
A central change in the new regulation is the inclusion of cybersecurity in machinery safety requirements. Organisations will need to protect machinery against unauthorised access, data manipulation and other cyber risks. Compliance must be supported by suitable risk assessments and documentation. As a result, cybersecurity becomes part of the broader machine safety process. This requirement expands the traditional scope of machine safety. Safety engineers, automation specialists and IT security teams will need to cooperate more closely. This is particularly important when machinery is connected, modified or assessed. Cybersecurity measures can no longer be treated solely as an IT matter. A cyber risk may affect the safe operation of equipment.
Operators should review whether their existing safety and modification processes address cybersecurity risks. Documentation should cover safety-related changes and inspections. Cybersecurity strategies should also be considered alongside mechanical and control system safety. Moreover, operators should monitor standards related to machinery safety, cybersecurity and artificial intelligence. The regulation places responsibility for safe machine operation across the full lifecycle. This responsibility therefore continues after equipment is commissioned. For operators, structured documentation and early assessment of planned changes are increasingly important. Cooperation between technical disciplines will also become more important before the new requirements take effect.
