FAQ item index

Search every question across sub-FAQs

Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.

Indexed coverage
41of41items
Across 9 modules • Updated Jul 26, 2026
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 26, 2026
Declaration of Conformity vs Declaration of Incorporation

When is a Declaration of Conformity used?

Use an EU Declaration of Conformity for machinery or a related product when the manufacturer has drawn up the Annex IV Part A technical documentation, completed the relevant conformity assessment procedure, and demonstrated conformity with the applicable essential health and safety requirements in Annex III.

The DoC is the manufacturer's formal responsibility statement for that machinery or related product. It must follow the Annex V Part A model structure, identify the product, list the Union harmonisation legislation and standards or technical specifications relied on, and be kept with the technical documentation for market surveillance.

Match the declaration to the exact model or type and the configuration assessed. A supplier declaration for a component, or a DoI for partly completed machinery inside the assembly, is input evidence for the final manufacturer's file; neither replaces the final DoC for complete machinery.

The Regulation's declaration forms and related product duties apply from 20 January 2027. For products placed on the market before then, use the declaration and transition rules of the Machinery Directive and retain the first-placement date; do not reissue an earlier declaration under the Regulation solely because the product remains in use or is resold.

  • The DoC side is the CE-marked side: Article 10 links the completed conformity assessment to drawing up the DoC and affixing the CE marking.
  • The DoC can cover more than one Union legal act when more than one act requires an EU declaration of conformity, but it must identify those acts and publication references.
  • A declaration alone is not the technical file; it points to the underlying Annex IV Part A documentation, risk assessment, tests, standards mapping, instructions, and production-control evidence.

Does a Declaration of Conformity prove the whole machine is ready for CE marking?

It is the formal manufacturer declaration that conformity with the applicable essential health and safety requirements has been demonstrated. For machinery and related products, the DoC sits after Annex IV Part A technical documentation and the relevant conformity assessment procedure; Article 10 then links that result to affixing the CE marking.

Can a DoC replace the technical documentation?

No. The DoC is part of the compliance package, but the technical documentation is the evidence base. Annex IV Part A requires the product description, risk assessment, applicable essential health and safety requirements, drawings, standards or other specifications, test results, instructions, and production-control evidence.

Citations
Regulation (EU) 2023/1230 on machinery

Articles 10 and 21 and Annexes IV and V govern the DoC, technical documentation, CE marking, and declaration content; Articles 52 and 54 establish the pre-20 January 2027 transition and application date.

European Commission - Machinery sector page

Commission machinery page confirms the Machinery Regulation alignment with the New Legislative Framework and warns that CE marking follows the prescribed conformity assessment procedure.

Declaration of Conformity vs Declaration of Incorporation

When is a Declaration of Incorporation used?

Use an EU Declaration of Incorporation for partly completed machinery. Regulation (EU) 2023/1230 defines partly completed machinery as an assembly that is not yet machinery because it cannot by itself perform a specific application and is only intended to be incorporated into or assembled with machinery, other partly completed machinery, or equipment.

The DoI does not say that a final machine is complete or ready for CE marking. It states that the relevant essential health and safety requirements for the partly completed machinery have been demonstrated, and it must follow the Annex V Part B model structure.

  • The manufacturer of partly completed machinery must draw up Annex IV Part B technical documentation before placing it on the market.
  • The DoI must identify which Annex III essential health and safety requirements are applied and fulfilled and state that the relevant technical documentation was drawn up under Annex IV Part B.
  • Partly completed machinery must be accompanied by assembly instructions under Annex XI, and those instructions must include the DoI or access details for it.

Does a Declaration of Incorporation allow CE marking of partly completed machinery?

No. The DoI is for partly completed machinery and does not supersede the final machinery conformity assessment. The CE marking belongs to machinery or related products after conformity has been demonstrated; the DoI travels with the partly completed machinery so the final integrator can use it in the final technical documentation and safety assessment.

What must the DoI say about essential health and safety requirements?

Annex V Part B requires a sentence declaring which Annex III essential health and safety requirements are applied and fulfilled. That narrower statement is the key difference from a DoC for complete machinery, which states fulfilment of the applicable essential health and safety requirements for the machinery or related product.

Citations
Declaration of Conformity vs Declaration of Incorporation

How do the documents relate to the technical file?

Both declarations depend on technical documentation, but they point to different annexes and different product states. Machinery and related products use Annex IV Part A; partly completed machinery uses Annex IV Part B.

For complete machinery, the technical documentation must show how conformity with the applicable essential health and safety requirements is achieved. For partly completed machinery, the technical documentation must show conformity with the relevant essential health and safety requirements and include evidence that the partly completed machinery can be assembled and incorporated safely.

  • For a DoC, keep the declaration with the Annex IV Part A technical documentation, conformity assessment evidence, instructions for use, and CE-marking record.
  • For a DoI, keep the declaration with the Annex IV Part B technical documentation, assembly instructions, applied-and-fulfilled EHSR mapping, and incorporation assumptions.
  • If partly completed machinery is incorporated into final machinery, the final machinery technical documentation can include the DoI and assembly instructions as inputs, but the final DoC remains the final machinery manufacturer's responsibility.
Citations
Declaration of Conformity vs Declaration of Incorporation

What is the CE and assembly boundary?

The practical boundary is whether the item is already machinery or a related product, or whether it is only partly completed machinery intended for incorporation. If the item can perform the intended application as machinery and the manufacturer places it on the market or puts it into service, the DoC and CE marking path applies.

If the item cannot perform a specific application by itself and needs incorporation into final machinery or equipment, the DoI and assembly-instructions path applies. The final machinery manufacturer then needs to assess the assembled machine, close any remaining essential health and safety requirements, prepare the final technical documentation, issue the final DoC where applicable, and affix CE marking to the final machinery.

  • Do not issue a DoI for a finished CE-marked machine just because another party installs it at a customer site.
  • Do not treat a DoI as proof that the final assembled machinery complies; it only covers the partly completed machinery and the EHSRs stated in the declaration.
  • Do not rely on voluntary certificates as a substitute for the prescribed conformity assessment, DoC, DoI, technical documentation, or CE-marking steps.
Citations
Regulation (EU) 2023/1230 on machinery

Articles 10, 11, 21, 22, 23, and 24 support the split between completed machinery with CE marking and partly completed machinery with a DoI and assembly instructions.

How to map Annex III EHSRs under the EU Machinery Regulation

What are Annex III EHSRs?

EHSRs are the essential health and safety requirements in Annex III of Regulation (EU) 2023/1230. The general principles require the manufacturer to carry out a risk assessment, determine which Annex III requirements apply, and then design and construct the machinery or related product to eliminate hazards or minimise the relevant risks.

The mapping should start with the intended use, reasonably foreseeable misuse, product limits, hazardous situations, severity, probability, and required risk reduction. Annex III says the first chapter is general and applies to all machinery or related products, while the other chapters apply where the risk assessment shows more specific hazards such as mobility, lifting, underground work, lifting persons, or certain product categories.

A harmonised standard does not replace this applicability decision. It can provide a presumption of conformity only for the Annex III requirements it covers, so the EHSR map should record full, partial, or no standards coverage and identify the other technical evidence used for every remaining requirement.

These Regulation-specific Annex III duties apply from 20 January 2027. Products placed on the market before that date remain subject to the Machinery Directive transition in Article 52, so keep the first-placement date and the applicable legal basis with the map instead of retroactively relabelling an earlier file.

  • List each hazard and hazardous situation from the risk assessment.
  • Mark the Annex III section that corresponds to that hazard, including the general chapter and any specific chapter triggered by the product design or use.
  • Record the protective measure used for each applicable EHSR and identify any residual risk that must be handled through instructions, warnings, maintenance, or other controls.
  • For partly completed machinery, map only the Annex III requirements that are relevant to the partly completed machinery and its intended incorporation.

How should Annex III essential health and safety requirements be mapped under the Machinery Regulation?

Start from the risk assessment, not from a generic checklist. For each intended use, foreseeable misuse, hazard, and hazardous situation, identify the applicable Annex III requirement, the protective measure chosen, the residual risk, and the evidence that proves the measure works. The same map should connect to drawings, control-system logic, standards or specifications applied, tests, instructions for use, and the EU declaration evidence.

Is Annex III the same as the Annex I high-risk list?

No. Annex III contains the essential health and safety requirements used to design and assess conformity. Annex I is a list of categories of machinery or related products that must use specified conformity-assessment procedures under Article 25. A product can need detailed Annex III EHSR mapping even when it is not in an Annex I category.

Citations
How to map Annex III EHSRs under the EU Machinery Regulation

How does risk assessment drive the EHSR map?

The Annex III general principles describe an iterative process: determine product limits, identify hazards and hazardous situations, estimate severity and probability, evaluate whether risk reduction is required, then eliminate hazards or reduce risks using protective measures in the required priority order.

That means the EHSR map should be hazard-led. A mechanical movement hazard might point to guards or protective devices; a control-system hazard might point to safety and reliability of control systems; a software or data-integrity hazard might point to protection against corruption; and a mobility hazard might require the mobility chapter in addition to the general chapter.

  • Use the risk assessment to justify why each Annex III section is applicable, not applicable, or covered by a more specific chapter.
  • Tie each risk-reduction measure to design evidence, test evidence, inspection evidence, or instruction text.
  • Show where harmonised standards, common specifications, or other technical specifications were applied, including any partial application.
  • Keep residual-risk language consistent between the EHSR map, instructions for use, labels or markings, and declaration evidence.
Citations
How to map Annex III EHSRs under the EU Machinery Regulation

Where do software and cybersecurity fit?

Software belongs in the Annex III map when it affects safety. The Regulation covers safety components as physical or digital components, including software, and Annex III includes specific requirements for protection against accidental or intentional corruption of hardware, software, and data that are critical to compliance with EHSRs.

For control systems, Annex III requires design and construction that prevent hazardous situations, including attention to faults in hardware or logic, errors in control-system logic, reasonably foreseeable malicious attempts where relevant, and limits of safety functions established through the manufacturer's risk assessment. Where safety-related software versions or interventions are relevant, the Regulation also grounds tracing-log and source-code or programming-logic evidence in defined circumstances.

  • Identify software and data that are critical to EHSR compliance and record how they are protected against accidental or intentional corruption.
  • Record the installed software needed for safe operation and how the machinery can provide that information in an accessible form.
  • For safety-related software, keep version, intervention, validation, and tracing evidence aligned with the technical documentation.
  • For sensor-fed, remotely driven, autonomous, or self-evolving safety functions, document system capabilities, limitations, data, development, testing, and validation where relevant.
Citations
Regulation (EU) 2023/1230 on machinery

Annex III sections 1.1.9 and 1.2.1 ground protection against corruption, control-system safety, software identification, tracing logs, and autonomous or self-evolving safety-function evidence.

How to map Annex III EHSRs under the EU Machinery Regulation

Apply the supplementary EHSRs to the actual machinery

Test the supplementary EHSRs against the real product and use. Record why each chapter applies or does not apply, then connect its design duties to drawings, material specifications, calculations, tests, cleaning or maintenance instructions, and residual-risk information.

Food, cosmetics, and pharmaceutical machinery needs evidence for material compatibility, cleanability, drainage or discharge, prevention of contamination, and instructions for cleaning, disinfecting, and rinsing. Lubricants or auxiliary substances that could contact products need a controlled design and maintenance basis. Hand-held and hand-guided machinery needs handling, control, stability, and vibration evidence. Portable fixing and impact machinery and woodworking machinery require their specific protective measures rather than a generic guarding statement.

Plant-protection machinery needs evidence covering operator and environmental exposure, filling and emptying, leakage, drift or unintended dispersion, distribution and calibration, cleaning, servicing, inspection, and the tests and instructions needed for safe adjustment. Mobile machinery needs visibility, operator position, travel control, stability, rollover or falling-object risks, braking, and information on vibration where applicable. Underground machinery, lifting machinery, and machinery lifting persons each require the corresponding strength, stability, control, access, carrier, anchorage, emergency, and marking checks.

  • Record the product feature or operating condition that triggers each supplementary chapter and the affected machinery variants.
  • For hygienic applications, link contact materials, surface finish, joints, drainage, cleaning methods, contamination controls, and maintenance instructions to verification evidence.
  • For mobile, underground, and lifting applications, link load cases, stability and strength calculations, protective structures, travel or lifting controls, access, emergency functions, tests, and markings to the applicable requirements.
  • For plant-protection machinery, retain distribution and calibration results, leakage and drift controls, filling and emptying design, operator exposure controls, cleaning procedures, and adjustment instructions for the supplied configuration.
  • When one product triggers several chapters, keep one integrated EHSR map and identify shared protective measures without deleting the separate requirement decisions.
Citations
Regulation (EU) 2023/1230 on machinery

Annex III Chapters 2 to 6 set supplementary requirements for specified product categories and hazards, including hygiene, portable machinery, plant-protection machinery, mobility, lifting, underground work, and lifting persons.

How to map Annex III EHSRs under the EU Machinery Regulation

What technical-file evidence should support the EHSR map?

Annex IV requires technical documentation to specify the means used to ensure conformity with applicable Annex III EHSRs. For machinery and related products, that documentation includes a complete product description, risk-assessment documentation, the list of applicable EHSRs, protective measures, residual risks, drawings and schemes, standards or common specifications applied, tests and calculations, instructions for use, declarations, production controls, and selected software or sensor-system evidence where relevant.

A useful EHSR map therefore has one row per applicable requirement or hazard cluster, with cross-references to the risk assessment, design evidence, verification evidence, instruction text, standards basis, residual-risk treatment, and declaration support. If a harmonised standard or common specification is only partly applied, the record should say which parts were applied and what other technical specifications close the remaining EHSR gap.

  • Risk assessment: product limits, hazards, hazardous situations, applicable EHSRs, protective measures, and residual risks.
  • Design evidence: drawings, circuit schemes, control architecture, software logic descriptions, component data, and manufacturing controls.
  • Verification evidence: design calculations, tests, inspections, examinations, and research on components or fittings.
  • User-facing evidence: instructions for use, residual-risk information, warnings, maintenance criteria, and any declarations or assembly instructions that must travel with the product.
Citations
How to map Annex III EHSRs under the EU Machinery Regulation

How is Annex III different from Annex I?

Annex III answers the question: which essential safety requirements apply to this product and how were the risks eliminated or reduced? Annex I answers a different question: is the product in a category that must follow one of the specified conformity-assessment procedures under Article 25?

Keep both analyses in the same compliance pack, but do not merge them. Annex I classification may affect whether a notified body route is needed, while Annex III mapping remains the substantive evidence that the applicable health and safety requirements have been addressed.

  • Use Annex I to classify listed machinery or related product categories such as certain saws, presses, lifts, protective devices, logic units, or self-evolving safety-function systems.
  • Use Annex III to map hazards to requirements and evidence for every in-scope machinery or related product.
  • Where Annex I triggers a third-party route, the notified-body file still needs the Annex III EHSR map, risk assessment, standards basis, tests, and technical documentation.
  • Do not treat absence from Annex I as proof that the product has no Annex III obligations.
Citations
Machinery Regulation and EU AI Act overlap for AI-enabled safety functions

When does AI overlap matter for machinery safety?

Overlap matters most when a safety function depends on software, sensor data, machine learning, autonomous operation, or fully or partially self-evolving behaviour. The Machinery Regulation does not turn every AI feature into a machinery-specific AI issue; the machinery question is whether the system affects an essential health and safety requirement or the conformity assessment route.

For AI Act Article 6(1), an AI system is high-risk only when both conditions are met: it is intended as a safety component of a product, or is itself a product, covered by Union harmonisation legislation listed in AI Act Annex I; and that product must undergo third-party conformity assessment before market placement or putting into service under that legislation. From 27 July 2026, the Machinery Regulation is listed in Section B of that Annex. The listing alone does not make every AI system in machinery high-risk.

For a high-risk AI system related to a product under AI Act Annex I Section B, amended AI Act Article 2(2) makes only Article 6(1), Article 60a, and Articles 102 to 112 directly applicable. Articles 57 to 59 apply only once the high-risk requirements have been integrated into the sectoral law. New Machinery Regulation Article 8 requires Commission delegated acts to add Annex III health and safety requirements reflecting AI Act Chapter III Section 2 and Articles 17, 19, 72, and 73; those delegated acts must apply by 2 August 2028.

The Commission standardisation request describes the machinery-AI intersection as machinery products with systems ensuring safety functions, with fully or partially self-evolving behaviour using machine learning approaches. CEN-CENELEC Q&A material also frames the issue around predictability: for Machinery Regulation purposes, the concern is relevant when unpredictable or self-evolving behaviour concerns a safety function.

  • Start with the safety function, not with the marketing label for the algorithm.
  • Record whether the product is machinery, a related product, partly completed machinery, or a safety component.
  • Identify whether the safety-related operation is controlled by software, external connections, sensor data, autonomous behaviour, or machine-learning logic.
  • Keep a separate note for AI Act applicability; the machinery file should not claim full AI Act compliance unless that separate assessment has been completed.

Does every AI feature in machinery create Machinery Regulation and EU AI Act overlap?

No. The machinery file should first ask whether the AI, software, sensor data, or self-evolving behaviour affects a machinery safety function or an applicable essential health and safety requirement. Non-safety analytics, productivity optimisation, or user-interface features may still need a separate AI Act review, but they should not be treated as Machinery Regulation safety-function evidence unless they affect safety.

Can a Machinery Regulation technical file prove EU AI Act compliance?

Not by itself. The Machinery Regulation technical file can support the safety-function and product-route classification by documenting risk assessment, protective measures, standards, tests, source code or programming logic where needed, and validation of sensor-fed or autonomous safety-related operations. Keep a separate record of the AI Act Article 6(1) test, operator roles, and directly applicable provisions. Also track the delegated acts required by new Machinery Regulation Article 8, because they will add the substantive high-risk requirements to Annex III and may require the machinery file to cover additional evidence.

When do the Machinery Regulation and AI Act product-safety rules apply?

The Machinery Regulation's main product regime applies from 20 January 2027. Regulation (EU) 2026/1744 enters into force on 27 July 2026 and moves the Machinery Regulation into Section B of AI Act Annex I. For AI systems classified as high-risk under the Article 6(1) product route, Article 6(1) applies from 2 August 2028, while amended Article 2(2) leaves the substantive high-risk requirements to be integrated into the sectoral law. The Commission must adopt Machinery Regulation Article 8 delegated acts whose integrated requirements apply by 2 August 2028. Other AI Act provisions have their own dates, so record the provision being assessed rather than treating 2 August 2028 as a universal AI Act start date.

Is the machinery manufacturer also the AI Act provider?

The machinery manufacturer is the AI Act provider when it develops the AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A machine builder that only integrates another supplier's AI still needs a role analysis: changes, rebranding, intended-purpose decisions, or own-name placement can affect which AI Act operator duties apply. Record the AI-system supplier, machine manufacturer, importer, distributor, deployer, product boundary, and intended purpose instead of assigning the role from the commercial contract alone.

Citations
Regulation (EU) 2023/1230 on machinery

Defines conformity assessment, source code, safety components, Annex I categories, essential health and safety requirements, and technical documentation for machinery.

Regulation (EU) 2026/1744 amending the AI Act and Machinery Regulation

Moves the Machinery Regulation to AI Act Annex I Section B from 27 July 2026, limits the AI Act provisions applying directly to those product-related systems, changes the Article 6(1) application date to 2 August 2028, and requires delegated acts integrating substantive high-risk requirements into Machinery Regulation Annex III.

Machinery Regulation and EU AI Act overlap for AI-enabled safety functions

Conformity route and Annex I checks

Do not confuse the two Annex I lists. Machinery Regulation Annex I classifies machinery and related products for Article 25 conformity assessment. AI Act Annex I lists product legislation for the Article 6(1) high-risk test. AI-enabled safety functions can affect the machinery conformity route when the machinery or related product falls within Machinery Regulation Annex I. Products in Part A are subject to the specific procedures in Article 25(2). Products in Part B use the Article 25(3) route, and self-assessment is possible only where the product is designed and constructed in accordance with relevant harmonised standards or common specifications that are specific to the category and cover all relevant essential requirements.

Article 6 also lets the Commission amend Annex I in light of technical progress, advances in knowledge, or new scientific evidence. One listed criterion for Part A inclusion is uncertainty in existing risk-assessment methods for new machinery categories or technologies, which is the relevant machinery-official source boundary for novel AI-enabled safety functions.

  • Check whether the machine, related product, or safety component is in Annex I Part A or Part B before relying on internal production control.
  • For Part B products, verify that cited harmonised standards or common specifications actually cover the AI-enabled or self-evolving safety function.
  • If standards do not cover the relevant essential health and safety requirements, document the alternative technical specifications and the reason for escalation.
  • Track changes in software, data, sensor inputs, standards, and intended use because Article 10 requires series production procedures to account for design and standards changes.
Citations
Machinery Regulation and EU AI Act overlap for AI-enabled safety functions

Documentation boundaries for AI-enabled safety functions

The Machinery Regulation technical documentation must show how the manufacturer ensures conformity with applicable essential health and safety requirements. For AI-enabled safety functions, the machinery file should be concrete enough to connect the hazard, the protective measure, the safety-related software or data input, and the verification evidence.

Annex IV requires risk-assessment documentation, applied harmonised standards or common specifications, design calculations, test and inspection results, and, where relevant, source code or programming logic of safety-related software after a reasoned authority request. It also calls out sensor-fed, remotely driven, or autonomous machinery where safety-related operations are controlled by sensor data: the record should describe the system's general characteristics, capabilities, limitations, data, development, testing, and validation processes.

  • Keep the machinery risk assessment focused on health and safety hazards, protective measures, residual risks, and verification evidence.
  • Describe the versioned safety-related software, model or programming logic, sensor data inputs, fallback behaviour, validation limits, and change-control trigger.
  • Keep the AI Act Article 6(1) classification, provider/importer/distributor role analysis, and directly applicable AI Act evidence identifiable; track the Machinery Regulation Article 8 delegated acts that will integrate further high-risk requirements into Annex III.
  • Cross-reference shared evidence only where it supports both files, such as product description, intended use, safety-function architecture, testing, and post-release change records.
Citations
Regulation (EU) 2023/1230 on machinery

Annex IV lists the technical documentation items for machinery and related products, including risk assessment, standards, tests, source code or programming logic, and sensor-fed or autonomous safety-related operations.

Machinery Regulation and EU AI Act overlap for AI-enabled safety functions

Standardisation request context

The standards context is still a machinery context. The 2025 machinery standardisation request asks CEN and CENELEC to draft or revise standards for machinery products with fully or partially self-evolving behaviour or logic, safety functions governed by such systems using machine learning approaches, and safety functions based on external connections, software, or data that must be protected against corruption.

The request also says standards developed under the machinery mandate should take into account work under the AI Act and Cyber Resilience Act and be prepared as machinery-specific standards. That is useful context for standards monitoring, but it is not a shortcut for claiming compliance with the AI Act.

  • Monitor whether the relevant type-A, type-B, or type-C machinery standard has been revised for self-evolving, machine-learning, autonomous, software, data, or corruption-of-safety-function issues.
  • For existing standards, check whether gap analysis or Annex Z mapping shows which Machinery Regulation essential requirements are covered.
  • Do not import AI Act or Cyber Resilience Act obligations into a Machinery Regulation standards gap analysis unless the machinery source explicitly requires that comparison.
  • Use standards evidence as a presumption-of-conformity argument only for the essential requirements and clauses actually covered.
Citations
Machinery Regulation cybersecurity evidence

What cybersecurity evidence is needed for connected or software-enabled machinery?

The evidence should start with the Machinery Regulation safety question: could a connected device, remote communication path, software change, data change, or control-system logic failure create a hazardous situation? If yes, the cybersecurity record belongs inside the machinery risk assessment and technical documentation, not only in a separate IT security file.

Annex III section 1.1.9 requires protection against corruption for safety-critical signal or data hardware, software, and data. It also requires the machinery or related product to identify software necessary for safe operation and to collect evidence of legitimate or illegitimate interventions in relevant hardware, software, installed software, or configuration.

Scope the controls to machinery safety. The Regulation calls for proportionate protection against malicious third parties where interference can affect product safety; it does not make the machinery technical file a substitute for a separate assessment under other cybersecurity legislation that may apply to the product.

These Machinery Regulation requirements apply from 20 January 2027. Before that date, document the legal basis used for the product placed on the market and keep this Annex III analysis as transition evidence; do not present it as replacing any separate Cyber Resilience Act, radio-equipment, network-security, or sector-specific assessment that applies.

  • List each external connection, remote access route, safety bus, update path, configuration interface, and supplier component that can reach software or data relevant to essential health and safety requirements.
  • Identify the installed software needed for safe operation and keep a version record that can be produced in an easily accessible form.
  • Show how safety-critical software and data are protected against accidental or intentional corruption, including configuration changes and uploaded safety software.
  • Keep intervention evidence: authorised changes, unauthorised attempts where detectable, configuration modifications, firmware or software uploads, test results, and remediation records.
  • Tie each control to the machinery risk assessment, the relevant Annex III EHSR, and the design-verification evidence that shows hazardous situations are prevented.

Does the Machinery Regulation require cybersecurity evidence for every connected machine?

From 20 January 2027, Regulation (EU) 2023/1230 requires machinery-safety evidence where connection, access, software, data, or control-system logic is relevant to essential health and safety requirements or could lead to a hazardous situation. It does not turn every networked feature into a standalone cybersecurity compliance file, and other applicable cybersecurity legislation still needs its own assessment.

What should the cybersecurity record prove?

It should prove that safety-critical software and data were identified, protected against accidental or intentional corruption, monitored for relevant interventions, and assessed with the control-system hazards in Annex III section 1.2.1.

Citations
Regulation (EU) 2023/1230 on machinery

Annex III section 1.1.9 sets the protection-against-corruption evidence requirements; Articles 52 and 54 establish the pre-20 January 2027 transition and application date.

ISO/TR 22100-4:2018

Supports treating IT-security and cybersecurity threats as machinery safety considerations when they can influence machinery safety.

Page 1 of 3
Previous123Next