Products in scope under the Machinery Regulation
Sytance · Updated
The Machinery Regulation cybersecurity question starts with the product. Regulation (EU) 2023/1230 applies to machinery, listed related products, and partly completed machinery. Cybersecurity evidence is then relevant only when software, data, interfaces, or digital components affect the safety requirements for that in-scope product.
Products in scope
This Regulation applies to machinery and the following related products: (a) interchangeable equipment; (b) safety components; (c) lifting accessories; (d) chains, ropes and webbing; (e) removable mechanical transmission devices. This Regulation also applies to partly completed machinery.
Regulation (EU) 2023/1230, Article 2(1) — English original
The listed related products are interchangeable equipment, safety components, lifting accessories, chains, ropes and webbing, and removable mechanical transmission devices. The Regulation also applies to partly completed machinery. Together, those are the products within the scope of the Regulation.
Machinery
The definition covers assemblies with linked parts or components, at least one moving part, and a specific application. It also covers machinery missing only the upload of application software foreseen by the manufacturer.
Related products
Article 2 lists these as product categories within the Regulation's scope.
Partly completed machinery
Partly completed machinery is within scope, but it has a specific incorporation route because it cannot itself perform its specific application.
Safety components
A safety component can be physical or digital, including software, if it fulfils the Article 3 definition and is independently placed on the market.
Software can change the product boundary
Regulation (EU) 2023/1230 treats software in two important ways. First, an assembly can still be machinery when it is missing only the upload of software intended for the specific application foreseen by the manufacturer. Second, software that performs a safety function and is independently placed on the market can be a safety component.
These rules stop the cybersecurity analysis from being limited to physical hardware. A robot controller image, safety PLC application, drive safety configuration, or separate safety-function software can be central to the machinery-safety conclusion when it fits the source definition.
Market and use terms
The Regulation distinguishes supply on the market, first supply and first use. Different duties can arise at each stage.
This is any supply of a product within the scope of the Regulation for distribution or use on the Union market in the course of a commercial activity, whether paid or free of charge.
This is the first making available of the product on the Union market. Many manufacturer duties are tied to this point.
This is the first use, for the intended purpose, in the Union. It matters for machinery or related products that are not supplied to another person before first use.
Explicit exclusions
Article 2(2) sets out the following 17 exclusions (a)–(q). The exclusions matter because an item can look like machinery in engineering terms and still fall outside the Regulation for that category or risk.
- Article 2(2)(a): safety components intended as spare parts to replace identical components, supplied by the manufacturer of the original machinery, related product, or partly completed machinery;
- (b): specific equipment for fairgrounds or amusement parks;
- (c): machinery and related products specially designed for use within, or used in, a nuclear installation, where conformity with this Regulation may undermine that installation’s nuclear safety;
- (d): weapons, including firearms;
- (e): air, water, and rail-network transport, except machinery mounted on that transport;
- (f): aeronautical products, parts, and equipment within Regulation (EU) 2018/1139 and the machinery definition, insofar as that Regulation covers the relevant essential health and safety requirements;
- (g): motor vehicles and trailers, including systems, components, separate technical units, parts, and equipment designed and constructed for them, within Regulation (EU) 2018/858; machinery mounted on the vehicles is excepted;
- (h): two- or three-wheel vehicles and quadricycles, including their designed and constructed systems, components, separate technical units, parts, and equipment, within Regulation (EU) No 168/2013; mounted machinery is excepted;
- (i): agricultural and forestry tractors, including their designed and constructed systems, components, separate technical units, parts, and equipment, within Regulation (EU) No 167/2013; mounted machinery is excepted;
- (j): motor vehicles exclusively intended for competition;
- (k): seagoing vessels, mobile offshore units, and machinery installed on board them;
- (l): machinery or related products specially designed and constructed for military or police purposes;
- (m): machinery or related products specially designed and constructed for research purposes for temporary laboratory use;
- (n): mine winding gear;
- (o): machinery or related products intended to move performers during artistic performances;
- (p): the following electrical and electronic products, insofar as they are within Directive 2014/35/EU (LVD) or Directive 2014/53/EU (RED): domestic household appliances other than electrically operated furniture; audio and video equipment; IT equipment; ordinary office machinery other than additive printing machinery producing three-dimensional products; low-voltage switchgear and control gear; and electric motors;
- (q): high-voltage switchgear and control gear, and transformers.
Cybersecurity relevance
Once the product is in scope, the cybersecurity question is not whether the product is connected in a general sense. The relevant question is whether a connection, software item, data item, configuration, safety component, or intervention path can affect the applicable essential health and safety requirements.