Machinery cybersecurity
Sytance · Updated
Regulation (EU) 2023/1230 addresses cybersecurity when it affects machinery safety. Its protection-against-corruption requirements concern connections, software, data and configuration that could cause hazardous situations, and records of intervention in safety-relevant systems.
Machinery cybersecurity requirements
The product placed on the EU market or put into service determines which Annex III requirements apply. The pages below explain those requirements, their place in safety risk assessment, and the technical support available from machinery and industrial-control standards.
Products in scope
Regulation (EU) 2023/1230 applies to machinery, listed related products, and partly completed machinery. Software can also be a safety component when the legal definition is met.
Protection against corruption
Annex III section 1.1.9 addresses hazardous situations caused by corruption, protection of critical software and data, and records of intervention.
Risk assessment
Cybersecurity belongs in the machinery risk assessment when a corruption path can compromise a protective measure or create a hazardous situation.
Software and change
Assess software versions, configuration, updates and intervention records throughout the lifecycle, including whether a later change is a substantial modification.
prEN 50742
prEN 50742 is a draft source for machinery-specific protection against corruption. Its status must stay separate from a final harmonised standard.
Robotics
ISO 10218-1:2025 adds cybersecurity only to the extent that it applies to industrial robot safety.
IEC 62443
IEC 62443 can support secure development, system, and component evidence, but it does not replace the Machinery Regulation.
Technical documentation
The technical documentation links the product boundary, safety functions, interfaces, software/configuration, protection measures, and user information.
Reading path
Read the pages in this order when the product is a connected machine, robot, machine control system, safety component, or partly completed machinery with safety-relevant software or data.
Source status
The Regulation sets the essential health and safety requirements. Standards and guidance provide technical methods. A harmonised standard gives a presumption of conformity only for the requirements and scope covered by its reference in the Official Journal; a draft does not have that effect.
Regulation (EU) 2023/1230 was published in the Official Journal and contains Annex III section 1.1.9 on protection against corruption.
The Regulation applies from this date, subject to earlier dates for specified administrative and transitional provisions.
CEN-CENELEC says CLC/TC 44X will continue work on EN 50742 for machinery protection against corruption. The prEN 50742 source is still a draft.
ISO 10218-1:2025 is a final robot safety standard for industrial robots. It is not a general cybersecurity standard.
Safety boundary
A cybersecurity weakness is relevant to the Machinery Regulation when it can affect the safe operation of machinery or a related product. The safety analysis includes service ports that can change safety limits, robot settings that can alter safeguarded spaces, and firmware updates that can change safe stopping behaviour. A compromised business system on the same factory network is relevant to Annex III section 1.1.9 only if the attack can affect machinery safety.