Regulation (EU) 2023/1230 replaces the Machinery Directive 2006/42/EC. Its recitals address malicious third parties acting on product safety and machines with self-evolving behavior. The general application date is widely reported as 20 January 2027, but you should confirm it in the Official Journal.
What replaces what
The text repeals Directive 2006/42/EC and Council Directive 73/361/EEC. A regulation applies directly in member states, so manufacturers selling machinery in the EU work from one text. This post could not confirm the application date from the text, so check it before you plan.
What the recitals say on cybersecurity
Recital 25 deals with risks from malicious third parties that affect product safety. It asks manufacturers for proportionate measures, limited to what product safety requires. That scoping is important. This is not a general security standard for machinery. It is about cases where an attack could compromise safe operation.
Recital 51 says conformity with certain essential requirements can be presumed from a certificate or statement under a cybersecurity certification scheme established under Regulation (EU) 2019/881.
What the recitals say on self-evolving machines
Recitals 54 and 55 say that systems with self-evolving behavior that ensure safety functions should be listed in Annex I, which brings third party conformity assessment. Recital 55 limits this to fully or partially self-evolving systems that use machine learning.
For robot makers using learned models in a safety function, such as perception that decides when to stop, this is the relevant signal. A model that only helps with productivity, and does not ensure a safety function, is a different case.
What this post does not cover
The annexes with the essential health and safety requirements were not read for this post, so it does not state their exact wording. Read Annex III and Annex I in the regulation itself, and read the harmonized standards once they are cited.
Practical steps for a manufacturer
- Identify which parts of your machine could change safe behavior if tampered with: configuration, update channels, remote access, communication with safety controllers.
- Document how each is protected and how access is controlled.
- Decide whether any learned component is involved in a safety function.
- Ask your notified body or legal adviser how the rules apply to your product, since this post is not legal advice.
- Keep an inventory of software and versions in the machine, as covered in our SBOM post for ROS 2 robots.
Who is affected
Manufacturers placing machinery on the EU market are the main audience, but integrators and importers should read it too. If you integrate machines from several makers into a cell, you may take on obligations as the party putting the assembled machinery into service. Ask a qualified adviser how that applies to your role, and begin the documentation now, since evidence of protection is easier to collect during design than after.
Quick check
Does the regulation require a cybersecurity certificate?
The recital cited says conformity with certain requirements can be presumed from a certificate or statement under a scheme under Regulation (EU) 2019/881. Presumption is not the same as a mandate, so read the articles and annexes.
Sources
Last reviewed: 19 October 2026.
