EU Machinery Regulation 2023/1230: What Changes on 20 January 2027

A regulation instead of a directive

The Directive had to be transposed into 27 national laws; the Regulation applies directly and identically everywhere in the EU. National implementing acts, such as Germany's 9. ProdSV, lose their basis. For exporters this removes national interpretation differences, and it means the legal text you need to read is the Regulation itself.

High-risk machinery: Annex I Part A and Part B

The old Annex IV list becomes Annex I, split in two. For the six categories in Part A, involving a notified body is always mandatory from 20 January 2027, even if harmonised standards are applied in full (Article 25(2)). Part A includes removable mechanical transmission devices and their guards, vehicle servicing lifts, portable cartridge-operated fixing and other impact machinery, and, new, safety components and machinery with fully or partially self-evolving behaviour based on machine learning. For the 19 categories in Part B, essentially the old Annex IV list, self-assessment remains possible, but only if harmonised standards or common specifications covering all relevant requirements are applied in full (Article 25(3)). The Regulation's notified-body framework has already applied since 20 January 2024, so assessment bodies can be designated against the new rules before the deadline.

For machinery with AI safety functions there is a second track: since the AI Digital Omnibus of July 2026 (Regulation (EU) 2026/1744), the AI Act's high-risk requirements are being folded into the Machinery Regulation's own Annex III by delegated acts, applicable by 2 August 2028, instead of running as a parallel regime.

Cybersecurity becomes a safety requirement

Machinery with digital interfaces must be protected against corruption, so that a malicious third party cannot compromise safety functions. Conformity with these requirements can be supported through certification under an approved cybersecurity scheme of the EU Cybersecurity Act (EU) 2019/881, which triggers a presumption of conformity (Article 20(9)). Separately, the Cyber Resilience Act (EU) 2024/2847 applies to products with digital elements as its own piece of law, with its main obligations applying from 11 December 2027. The machinery cybersecurity requirements apply from 20 January 2027 regardless.

Digital instructions

Instructions may be supplied in digital form for the first time (Article 10(7)): the machine must state how to access them, the format must allow printing and saving, and they must stay accessible online for the expected lifetime and at least 10 years after placing on the market. A buyer who asks for paper at the time of purchase gets it free of charge, and safety information for non-professional users must still be provided on paper. For exporters who today print and ship thick manuals in multiple languages, this is a real cost lever, if the digital delivery is set up correctly.

Substantial modification is now defined

Whoever substantially modifies a machine that is already in service, physically or digitally, in a way that creates a new hazard or increases an existing risk, becomes the manufacturer of the modified machine with the full set of obligations (Article 18). This matters for exporters whose EU customers retrofit or rebuild machines, and for anyone selling upgrade kits.

Technical file and declaration get new content

The technical documentation moves from Annex VII of the Directive to Annex IV of the Regulation and now includes, among other things, the source code or programming logic of safety-relevant software on a reasoned request by a market surveillance authority, and descriptions of sensor-driven and autonomous functions. The EU Declaration of Conformity follows Annex V Part A instead of Annex II of the Directive, may be supplied digitally, and where several EU acts apply, one single declaration covers them all. Safety components are also redefined to include digital components and software, so standalone safety software becomes a CE-marked product in its own right.

The standards gap you should plan around

As of August 2026, no harmonised standard has been cited in the Official Journal under the new Regulation; every existing citation belongs to the old Directive. The standardisation request went to CEN and CENELEC in January 2025, and a first citation decision is expected towards the end of 2026. Until standards are cited, there is no presumption of conformity under Article 20(1); as a fallback the Commission can adopt common specifications by implementing act. Watch this closely if you rely on the Part B self-assessment route, and document your state-of-the-art reasoning in the risk assessment either way.