Machinery Regulation 2023/1230 — transition from the Machinery Directive

The Machinery Directive 2006/42/EC has governed the placing on the EU market of machinery for nearly two decades. It is being replaced by Regulation (EU) 2023/1230, adopted on 14 June 2023 by the European Parliament and the Council. The Commission's dedicated page at single-market-economy.ec.europa.eu/sectors/mechanical-engineering/machinery_en summarises the rationale: digitalisation, AI in safety functions, cybersecurity, and the desire for a single set of directly applicable rules instead of national transpositions.

This article covers the transition timeline, what changes in substance, and what manufacturers should do during the 2026–2027 window.

Timeline at a glance

The application date is the single most important date for compliance planning: products placed on the EU market on or after 20 January 2027 must comply with Regulation 2023/1230. Until then, Directive 2006/42/EC remains the legal regime. Cross-link: see CE marking 101 for the broader CE framework.

Why a Regulation, not a Directive

A Directive must be transposed into national law by each Member State — for 2006/42/EC, that produced 27 slightly different national implementations. A Regulation is directly applicable in every Member State from the application date. This is the same legal-instrument shift the Commission used for GPSR (replacing the General Product Safety Directive) and for the CRA.

Practical consequences:

• One legal text across the EU, no more national transposing acts on the substance.
• Less divergence in interpretation (in theory) — but Member States still designate market surveillance authorities and notified bodies.
• Existing national guidance based on 2006/42/EC may become outdated quickly after 20 January 2027.

What changes — the substantive shifts

1. Cybersecurity is in the essential health and safety requirements

The most-discussed change. The Regulation treats malicious tampering with safety-relevant control systems as a safety risk. Manufacturers must design machinery so that hazardous situations caused by corruption of safety functions through deliberate cyber attacks are addressed. This is explicit in the Essential Health and Safety Requirements (EHSRs) in Annex III.

This is conceptually similar to — and overlapping with — duties under the Cyber Resilience Act for products with digital elements. Connected machinery often falls under both regimes; manufacturers should plan integrated documentation rather than treating CRA and the Machinery Regulation as separate workstreams.

2. Self-evolving behaviour and AI in safety functions

Where the safety-related control system uses fully or partially self-evolving behaviour (the language the Regulation uses to describe certain AI / machine-learning systems used in safety functions), the machinery is treated as higher-risk. This means:

• The category appears in Annex I (the list of high-risk machinery requiring third-party assessment).
• The corresponding safety components appear in the safety-components list (Annex II), including independently placed safety-function software.
• Notified-body involvement is required — the manufacturer cannot rely on self-assessment alone for those products.

This is also where the Machinery Regulation begins to interact with the EU AI Act: safety components of machinery that are also AI systems may sit in both regulatory perimeters simultaneously.

3. Digital instructions for use

The Directive required paper instructions. The Regulation allows digital instructions for use for professional users, on conditions:

• The user can download, print and save the instructions for use on an electronic device.
• The instructions remain available online for the expected lifetime of the machinery and for at least 10 years after the last unit is placed on the market.
• The manufacturer supplies the paper version free of charge on request, within one month.

For machinery intended for non-professional (consumer) users, paper safety information must still be provided. See DoC translation requirements for the language regime that also applies to instructions.

4. High-risk machinery and Annex I

The Regulation lists in Annex I the categories of machinery considered high-risk. For these, the conformity assessment procedure must involve a notified body — the internal production control route (the equivalent of Module A) is not available. Annex I is the lever the Commission can use to add or remove categories over time via delegated acts as technology evolves.

The list is structured in two parts, with the parts differing in whether the manufacturer has any module choice or whether third-party assessment is mandatory. For the practical question of "do I need a notified body?", see When you need a notified body and the broader conformity assessment modules A to H.

5. Partly completed machinery

The concept survives. Article 3(10) defines partly completed machinery as:

an assembly which is not yet machinery as it cannot in itself perform a specific application and which is only intended to be incorporated into or assembled with machinery or other partly completed machinery or equipment, thereby forming machinery

Manufacturers of partly completed machinery continue to issue a declaration of incorporation (not a Declaration of Conformity) and provide assembly instructions. The recipient who completes the integration takes on the EHSR responsibility for the final assembly. This is largely a continuity provision but the documentation has been re-aligned to the Regulation's terminology.

6. Conformity assessment procedures

The modular structure (Modules A, B, C, D, E, F, G, H — see Modules A to H) is retained but the routing is updated:

• Self-assessment (Module A equivalent): allowed for non-Annex I machinery once the manufacturer applies harmonised standards in full.
• Third-party assessment: mandatory for Annex I categories, including the new self-evolving-behaviour items.
• Quality assurance schemes (Modules H, E): available for series production, subject to notified body audit.

The technical file requirements largely track the existing Directive content — see Technical file 101 and the IoT-style technical file template for layout guidance that survives the transition.

What does not change

Useful to know what stays the same:

• The basic CE marking obligation and the rule that the CE marking must be affixed visibly, legibly and indelibly.
• The notion of the manufacturer being responsible for the conformity assessment irrespective of which module is used.
• The role of the EU authorised representative for non-EU manufacturers — see the EC REP guide.
• The Declaration of Conformity model and the rule that it must accompany the product — see Declaration of Conformity 101 and the sample DoC walkthrough.
• The 10-year retention for technical documentation, addressed in Technical file retention requirements.

Practical roadmap for the 2026–2027 window

Manufacturers placing machinery on the EU market need a clear answer to two questions during the transition: (a) which regime applies on the date my product is first made available on the EU market, and (b) when do I need to have new evidence in place?

1. Inventory products by lifecycle date. For each machinery SKU, identify the planned date of placing on the market relative to 20 January 2027. Anything first placed on the market on or after that date must comply with the Regulation; anything placed before continues to be governed by the Directive that applied at placement.
2. Re-classify against Annex I. Walk through the high-risk categories list. Pay specific attention to safety components and to control systems with self-evolving behaviour — these are the categories that move from optional to mandatory notified-body assessment.
3. Plan the cybersecurity work. Map the safety-relevant control system, identify deliberate tampering vectors, document mitigations. If the same product is in scope of the Cyber Resilience Act, unify the evidence.
4. Decide on digital instructions. If you intend to use digital IFU, set up the hosting, download/print path, lifetime commitment and paper-on-request workflow before 20 January 2027.
5. Speak to your notified body early. Notified bodies need re-designation under the Regulation; capacity in 2026 will be tight. The NANDO database tracks bodies authorised under the Regulation as designations are confirmed.
6. Update the technical file template. Section ordering does not have to change radically, but specific references to Directive 2006/42/EC need to be replaced with the Regulation's article numbers. See updating a DoC after amendment for the equivalent DoC discipline.

Common mistakes

• Treating 20 January 2027 as a soft deadline. It is not. Products placed on the EU market on or after that date must comply with Regulation 2023/1230. A Declaration of Conformity citing 2006/42/EC for a product placed on the market on 21 January 2027 is not valid.
• Ignoring the cybersecurity requirements. "It's just machinery, not software" is not a defence. Annex III now requires the manufacturer to address tampering risks to safety functions through deliberate cyber attacks, irrespective of whether the product is "primarily" a software product.
• Missing the Annex I re-classification. If your safety-component portfolio includes anything with self-evolving behaviour or learning, you are likely moving from internal production control to mandatory third-party assessment.
• Assuming the AI Act does not apply. Safety components of machinery that are AI systems are explicitly inside the AI Act perimeter. Plan a single integrated evidence pack rather than two parallel ones.
• Using digital instructions without the legal scaffolding. Digital IFU is permitted but conditional. If you cannot guarantee 10+ years online availability and paper-on-request within one month, do not switch.
• Forgetting partly completed machinery. The declaration of incorporation and assembly instructions are still required and still must use the Regulation's wording from 20 January 2027.

How Cenitia helps

Cenitia treats the Machinery Regulation as a first-class regulation in the platform. The product taxonomy, technical file scaffold and DoC generator all support both regimes during the transition: you can mark a product as "placed under 2006/42/EC" or "placed under 2023/1230" and the generated artefacts cite the correct articles, EHSRs and Annexes. The regulation watcher tracks the Official Journal so that if Annex I or III is amended after 20 January 2027 (the Regulation explicitly contemplates delegated-act updates), Cenitia flags every affected DoC for review.

For manufacturers of connected or AI-enabled machinery, the platform produces a unified evidence pack across the Machinery Regulation, the Cyber Resilience Act, and (where relevant) the Radio Equipment Directive — instead of three parallel workstreams that each cite the same engineering data.

Frequently asked questions

When does the new Machinery Regulation apply?

Regulation (EU) 2023/1230 was published in the Official Journal on 29 June 2023 (OJ L 165), entered into force 20 days later, and applies in general from 20 January 2027. From that date Directive 2006/42/EC is repealed. See the ELI page at https://eur-lex.europa.eu/eli/reg/2023/1230/oj.

Can I still place machinery on the EU market under the old Directive 2006/42/EC?

Yes — until 19 January 2027 you must apply Directive 2006/42/EC. The Commission's machinery page confirms that manufacturers may, in principle, choose to declare conformity with Regulation (EU) 2023/1230 voluntarily before the application date, but the legal regime in force remains the Directive until 20 January 2027.

Do I need a notified body for AI-driven safety functions?

Yes. The Regulation treats machinery with safety-related control systems exhibiting fully or partially self-evolving behaviour as higher-risk and requires third-party conformity assessment. The relevant category appears in Annex I (high-risk machinery) and the safety components list in Annex II.

Are digital instructions for use allowed?

Yes — Article 10 permits digital instructions provided users can download, print and save them, the instructions remain online for the product's expected lifetime (and at least 10 years after the last unit is placed on the market), and a paper version is supplied free on request within one month.

Do partly completed machinery rules change?

The concept survives. Article 3(10) defines partly completed machinery as an assembly which 'is not yet machinery as it cannot in itself perform a specific application and which is only intended to be incorporated into or assembled with machinery'. A declaration of incorporation and assembly instructions are still required.

What is the legal title of the Regulation?

'Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023 on machinery and repealing Directive 2006/42/EC of the European Parliament and of the Council and Council Directive 73/361/EEC'. Adopted 14 June 2023, published 29 June 2023 in OJ L 165/1.

Related from the Library

• CE marking 101 — the umbrella framework that the Machinery Regulation slots into
• Technical file 101 — what the file must contain, mostly unchanged in the transition
• Conformity assessment modules A to H — the module taxonomy used by the Regulation
• When you need a notified body — the trigger logic for Annex I categories
• Declaration of Conformity 101 — DoC mechanics that survive the regime change

Further reading

• Regulation (EU) 2023/1230 (ELI) — official Official Journal entry
• CELEX 32023R1230 — full text on EUR-Lex
• Commission machinery page — DG GROW summary and FAQs
• Directive 2006/42/EC (ELI) — the outgoing Machinery Directive for reference
• NANDO database — notified bodies designated under the Regulation
• EU AI Act (Regulation 2024/1689) — interaction with AI safety components
• Cyber Resilience Act (Regulation 2024/2847) — overlapping cybersecurity duties for connected machinery

Last reviewed: 5 July 2026. Cited regulations watched continuously by Cenitia — when one amends, this article is flagged for update.