EU Machinery Regulation: product safety and cybersecurity
Sytance · Updated
Regulation (EU) 2023/1230 is EU product-safety law for machinery and related products. Cybersecurity is part of that safety assessment when software, data, connections, updates, or configuration can affect a safety function or lead to a hazardous situation.
Product safety law
The Regulation will replace the Machinery Directive with directly applicable EU rules. It governs machinery safety: product scope, essential health and safety requirements, technical documentation, conformity assessment, EU declaration of conformity, CE marking, instructions, and market-surveillance duties.
Products in scope
The product question comes before the cybersecurity question. The Regulation covers machinery and specified related products, and it also addresses partly completed machinery. The applicable cybersecurity requirements depend on which product is being assessed.
Machinery and related products
The Regulation covers machinery and listed related products. The legal product boundary decides which requirements and evidence apply.
Partly completed machinery
Partly completed machinery has separate documentation requirements. It is not handled like a finished CE-marked machine.
Safety components
Software can be relevant when it performs a safety function or changes a safety-related control path.
Updates and modification
A software update can matter when it changes a safety function, configuration, limit, interface, or protective measure.
Cybersecurity through safety
The Machinery Regulation does not turn every network weakness into a machinery-law issue. The key question is whether corruption of software, data, configuration, a control path or an intervention record can affect the machine’s safe operation.
CE file and technical evidence
Cybersecurity evidence is useful only when it connects back to the machinery file. The technical documentation should explain the product boundary, safety functions, safety-related software and data, interfaces, protective measures, change control, intervention evidence, and information for use.
Main dates
Regulation (EU) 2023/1230 was published as the new EU machinery regulation.
The Regulation generally applies from this date, with separate dates for some provisions.