29th June 2023
Regulation published in the EU Official Journal.
20th July 2024
A small number of articles applied early, mainly for notified bodies.
20th January 2027
Regulation applies in full. New machinery placed on the EU market must comply.
Who does it affect?
Anyone placing machinery, partly completed machinery or related products on the EU market, wherever they're based.​
Machines already in use? Machinery placed on the market under the Directive doesn't need re-certifying, unless it's substantially modified.
Machine builders and OEMs
Everything placed on the market from 20 January 2027.
Integrators and modifiers
A substantial modification can make you the manufacturer.
UK manufacturers exporting to the EU
The Regulation applies to machines you ship into the EU.
Importers and distributors
Clearer duties to check marking, declarations and instructions.
The key changes
The basic approach stays the same: risk assessment, essential requirements, technical file, declaration and CE marking. These are the changes that matter most in practice.
01
A Regulation,
not a Directive
It applies directly and identically in every EU country. National transposing laws fall away.
04 • New
AI and self-evolving behaviour
Risk assessment must cover machinery whose behaviour or logic changes after it's placed on the market.
07
Digital instructions
Instructions can be supplied digitally, with a free paper copy if the buyer asks at the time of purchase. Non-professional users still get safety information on paper.
02 • New
Protection against corruption
Cybersecurity becomes a safety requirement. Safety functions must be protected against accidental or malicious corruption.
05
Third-party assessment for some machinery
Certain high-risk categories listed in Annex I Part A must now be assessed by a notified body.
08
Documentation
The EU declaration of conformity can be provided by web link or code. Technical documentation must be kept for 10 years.
03
Substantial modification
If you modify a machine, physically or in software, in a way that adds a hazard or increases a risk, you take on the manufacturer's obligations.
06
People, robots and autonomy
Updated requirements for human-machine interaction, collaborative working and autonomous mobile machinery.
What It Means In Practice
Cybersecurity Is Now A Machinery Safety Requirement
For the first time, machinery law requires protection against corruption. The concern isn't IT security in general. It's stopping a connection, a device or a person from changing a machine in a way that defeats its safety functions.
​
A draft harmonised standard, prEN 50742, is being developed to give a method for meeting these requirements. It builds on the risk assessment you already do.
Protect safety settings and software
Safety parameters and safety-related software must be protected from unauthorised change.
Withstand malicious attempts
Control systems must not create hazardous situations when someone deliberately interferes with them.
Keep evidence of intervention
Record legitimate or illegitimate interventions and the software version installed.
Consider connections
Remote access, networks and connected devices are part of the risk assessment.
What about the UK?
Selling into the EU
Machinery you place on the EU market from 20 January 2027 must meet the Regulation, wherever you're based.
Northern Ireland
The EU Machinery Regulation applies and is enforced in Northern Ireland from 20 January 2027.
Great Britain
From 20 January 2027, GB continues to accept CE-marked machinery alongside UKCA marking. The Government has said it intends to modernise GB machinery law in a similar way, so GB-only manufacturers should expect comparable requirements, including cybersecurity, in the future.
​
What to do now
Six steps to take before 20th January 2027
1
List what you'll place on the EU market after 20 January
Including machines already in build that won't ship until 2027.
​
2
Check whether any need third-party assessment
Compare your machines against the Annex I Part A categories.
​
3
Update your risk assessments
Add protection against corruption, connections and remote access, and any self-evolving behaviour
​
4
Review your control systems
How safety parameters are protected and how interventions and software versions are recorded.
​
5
Update technical files, declarations and instructions
Reference the Regulation instead of the Directive, and decide whether to supply instructions digitally.
​
6
Train the people involved
Design, controls and compliance teams need to understand the new requirements.
How we can help
Independent support to get your machines and your team ready.
TRAINING - 1 DAY
On-site course on the new requirements, using your own machines.
Common Questions
Do machines already in use need re-certifying?
No. Machinery placed on the market under the Directive can stay in use. If it's substantially modified, the modified machine must meet the Regulation.
What counts as a substantial modification?
A physical or digital change, not foreseen by the original manufacturer, that creates a new hazard or increases an existing risk so that new protective measures are needed. Software changes can count.
Is there a transition period?
No. From 20 January 2027, new machinery placed on the EU market must comply with the Regulation.
Is there a standard for the cybersecurity requirements?
prEN 50742 is in development as a draft harmonised standard. The legal requirement applies from January 2027 whether or not it's finalised.
Do I need a notified body?
Only for the high-risk categories in Annex I Part A. Most machinery can still be self-assessed by the manufacturer.
This page is general guidance, not legal advice. Last updated 3rd November 2026.