If you manufacture, import, distribute, or simply use industrial machinery in Europe, the rules of the game change from 20 January 2027. This is not a minor update: it is a deep revision of the entire European framework on machinery safety.
The text that changes everything is called Regulation (EU) 2023/1230, and it is set to replace the Machinery Directive 2006/42/EC — the regulation that has governed the sector for nearly twenty years.
Before getting into what specifically changes, it is worth understanding a basic distinction that many take for granted but which has very concrete practical consequences.
Directive or Regulation: what is the difference?
European law uses two main instruments to establish common rules.
A directive sets the goal to be achieved, but leaves each country free to choose how to get there. In practice: a European directive arrives in Rome, Paris or Madrid and each Member State transforms it into its own national law. This can create small differences in interpretation between countries — differences that over time translate into uncertainty for those operating across multiple European markets.
A regulation, on the other hand, is immediately law across all of Europe, in the same text and at the same moment, without any Member State needing to do anything to implement it. From the day it enters into application, it applies in exactly the same way in Milan, Barcelona and Lyon.
The shift from Directive 2006/42/EC to Regulation 2023/1230 means precisely this: from 20 January 2027, there will be one single rule, the same for everyone, in all 27 EU countries. No more differing national interpretations, no more grey areas between one market and another.
The most important changes: what concretely changes
1. Software becomes part of the machine
Until now, when talking about safety components of a machine, we thought of physical objects: guards, emergency stop devices, sensors. Regulation 2023/1230 radically changes this perspective.
A safety component can now be physical or digital — including software (Art. 3(3)). And the official list of safety components in Annex II now explicitly includes software components (point 18) and artificial intelligence components with safety functions (point 19).
For a CNC machine builder, this has a very concrete meaning: the CNC firmware, the axis control software, the software modules that manage safety functions are now regulated in exactly the same way as a physical guard. They must be assessed, documented and controlled with the same rigour.
2. It is no longer just about the manufacturer: the entire supply chain is involved
Under the old directive, there was essentially one main actor: the manufacturer. The new regulation broadens responsibility across the entire commercial chain, precisely defining the roles and obligations of each party.
The parties involved become four (Art. 3(22)): the manufacturer, their authorised representative (for non-EU producers), the importer (who brings the machine into the European market from third countries) and the distributor (who resells it in the supply chain). Each has specific obligations and distinct accountability.
This means that importing a machine from a country outside the EU is no longer solely a matter for the producer: whoever imports it becomes responsible for verifying that the machine is compliant, and if it is not, they cannot place it on the market.
3. Modifying a machine can make you the new manufacturer
This is perhaps the change that surprises those who work in industrial maintenance or used machinery trading the most.
The Regulation introduces the concept of substantial modification (Art. 3(16)): any intervention — physical or digital — that was not foreseen by the original manufacturer and that creates a new hazard or increases an existing risk. Whoever carries out a substantial modification on a machine already on the market is considered the new manufacturer of the modified machine (Art. 18), with all that this entails: new risk assessment, new technical file, new declaration of conformity, new CE marking.
In practical terms: if a company adds a machine vision system with safety functions to a milling machine already in use, or modifies the control software to extend its operational capabilities, it may find itself having to recertify the machine as if it were new.
4. Cybersecurity becomes an essential requirement
The Machinery Directive 2006/42/EC does not contain a single word about cybersecurity. It was a document written in an era when machines were largely isolated from the digital world.
Regulation 2023/1230 dedicates an entire section — point 1.1.9 of Annex III — to protection against tampering. Networked machines will need to be designed to resist cyberattacks, maintain a log of access to safety functions, retain logs for at least 5 years, and keep an up-to-date inventory of all installed software.
We will cover this in detail in a dedicated article, but the core concept is important to grasp now: the safety of a connected CNC machine is no longer purely a mechanical or electrical matter. It is also a digital matter, and from 2027 it will be a legal matter.
5. Artificial intelligence in machines is its own category
For the first time in European machinery regulation, systems with safety logic components using artificial intelligence — machine learning, neural networks — are listed among high-risk machinery (Annex I, Part A). This means they mandatorily require the involvement of an independent certification body, and cannot be self-certified by the manufacturer.
6. How conformity is certified: the module logic
Under the old directive, the question was simple: is my machine in Annex IV? If yes, a third-party body is needed. If not, the manufacturer can proceed alone.
The Regulation reorganises this system in a more structured way. To understand it, think of three risk tiers.
Most common machines — those that do not appear in Annex I — can be certified by the manufacturer independently, without involving any external body (Module A).
Medium-to-high risk machines, listed in Annex I Part B, give the manufacturer a choice: they can still proceed alone or involve a notified body for a more robust assessment.
High-risk machines, listed in Annex I Part A, leave no choice: an independent notified body must mandatorily assess and certify the machine. The manufacturer cannot self-certify them.
Where to start
20 January 2027 is not as far away as it might seem for those who need to update technical documentation, revise supply contracts and rethink risk assessment processes. There is still time to prepare — but that time needs to be used now.