Machinery Regulation (EU) 2023/1230: what changes on 20 January 2027
Updated:
From 20 January 2027, machinery placed on the EU market must meet Regulation (EU) 2023/1230 instead of Directive 2006/42/EC. The technical file keeps its basic structure, so a sound Annex VII file is a good starting point. What changes is the detail: new items in Annex IV, new high-risk categories, software and cybersecurity duties, digital instructions and a new declaration of conformity.
The date and the transition
- Application date. The Regulation applies from 20 January 2027 (Article 54). The original text said 14 January; a corrigendum in OJ L 169 of 4 July 2023 changed it to 20 January.
- Repeal. Directive 2006/42/EC is repealed from the same date (Article 51(2)). References to it are read via the correlation table in Annex XII.
- Products already on the market. Products placed on the market in conformity with the Directive before that date can still be made available (Article 52(1)). This protects products already placed on the market, not models. "Placing on the market" is normally read per individual unit, so a unit shipped after the date needs Regulation documentation.
- Certificates. EC type-examination certificates issued under the Directive stay valid until they expire (Article 52(2)).
What stays the same
| Topic | Directive 2006/42/EC | Regulation (EU) 2023/1230 |
|---|---|---|
| Technical file | Annex VII, Part A | Annex IV, Part A |
| Partly completed machinery | Annex VII, Part B | Annex IV, Part B |
| Essential health and safety requirements | Annex I | Annex III |
| Risk assessment, applicable requirements, protective measures | Annex VII, Part A, 1(a) | Annex IV, Part A, (b) |
| Drawings, calculations, test reports | Annex VII, Part A, 1(a) | Annex IV, Part A, (c), (d), (g) |
| Presumption of conformity from harmonised standards | Article 7(2) | Article 20(1) |
If your current file is complete and honest about residual risks, most of the work is re-mapping and filling gaps.
What is new
Annex IV adds items to the file
Annex IV, Part A lists at least fifteen elements, points (a) to (o). The ones without a clear Directive equivalent:
- (f): where harmonised standards or common specifications were not applied in full, the other technical specifications used for each requirement.
- (m): source code or programming logic of safety-related software, on a reasoned request from a national authority.
- (n): for sensor-fed, remotely driven or autonomous machinery, a description of the system's characteristics, capabilities and limitations, and of the data, development, testing and validation processes.
High-risk categories: Annex I replaces Annex IV
| Annex I, Part A | Annex I, Part B | |
|---|---|---|
| Examples | Removable mechanical transmission devices and their guards, vehicle servicing lifts, portable cartridge-operated fixing machinery, safety components and embedded systems with self-evolving machine-learning behaviour ensuring safety functions | Woodworking saws and planers, presses with manual loading, plastics and rubber moulding machinery, person lifts with a fall hazard over 3 m, person-detecting protective devices, safety logic units, ROPS, FOPS |
| Internal production control (module A) | Not available | Only if category-specific harmonised standards or common specifications covering all relevant requirements are applied |
| Notified body routes | B+C, H or G | B+C, H or G |
The four mechanical categories in Part A could use internal checks under the Directive if harmonised standards were fully applied. Under Article 25 a notified body is always involved for them. Unit verification (module G) is a new route.
Safety-related software and protection against corruption
- Annex III, 1.1.9. Connecting another device, including remotely, must not create a hazardous situation. Software and data critical for safety must be identified and protected against accidental or intentional corruption. The machine must identify its safety-relevant software and collect evidence of interventions in it.
- Annex III, 1.2.1. Control systems must withstand reasonably foreseeable malicious attempts that lead to a hazardous situation. A tracing log of interventions and of safety software versions uploaded after placing on the market must be enabled for five years.
Certification under a cybersecurity scheme adopted under Regulation (EU) 2019/881 can give a presumption of conformity for these two sections, as far as it covers them (Article 20(9)).
AI and self-evolving behaviour
The risk assessment must cover hazards from the intended evolution of self-evolving behaviour (Annex III, Part B, general principles, point 1). Such control systems must stay within their defined task and movement space, record safety-related decision data for one year, and remain correctable at all times (section 1.2.1). Where they ensure safety functions, Annex I, Part A applies.
Regulation (EU) 2026/1744 (Digital Omnibus on AI) amended the Regulation: the Commission is to add requirements for high-risk AI systems to Annex III by delegated acts applying by 2 August 2028. Until then, AI Act harmonised standards can give a presumption of conformity (new Article 20(10)).
Digital instructions, paper on request
Article 10(7) allows digital instructions for use if you mark how to access them, make them printable and downloadable, and keep them online for the expected lifetime and at least 10 years. A user who asks at purchase gets a free paper copy within one month. Where non-professional users can use the machine, the essential safety information must be on paper. Languages are those the Member State concerned requires. The Directive's "Original instructions" labelling rule does not appear in the Regulation.
A Commission proposal on digitalisation (COM(2025) 504) would change some of these rules. EUR-Lex still lists it as a proposal.
Substantial modification
Article 3(16) now defines it: a physical or digital change, not foreseen or planned by the manufacturer, made after placing on the market or putting into service, that creates a new hazard or increases a risk, and requires either new guards or protective devices that change the safety control system, or extra measures for stability or mechanical strength. Whoever makes it becomes the manufacturer for that machine and runs the conformity assessment (Article 18). Non-professional users modifying for their own use are excluded.
EU declaration of conformity
| Point | Directive (Annex II, 1.A) | Regulation (Annex V, Part A) |
|---|---|---|
| Legislation cited | Directive 2006/42/EC | Regulation (EU) 2023/1230 |
| Person authorised to compile the technical file | Required | Not listed |
| Harmonised standards | Reference | Reference plus OJ publication date, and parts applied if partial |
| Conformity assessment | Notified body, where used | Module named (A, B+C, G or H), notified body and certificate |
| Delivery | Accompanies the machinery | Accompanies it, or a web address or machine-readable code in the instructions (Article 10(8)) |
The declaration must be kept up to date and translated as the Member State requires, and one declaration covers all applicable Union acts (Article 21).
Partly completed machinery and retention
Partly completed machinery follows Annex IV, Part B, with the same source code and sensor-data items. Assembly instructions may be digital, with paper on request (Article 11(7)). The declaration of incorporation (Annex V, Part B) cites Annex III and Annex IV, Part B.
Retention stays at 10 years, but the clock moves: from the date of manufacture or last unit (Directive, Annex VII) to placing on the market or putting into service (Article 10(3), Article 11(3)).
What to do before 20 January 2027
In order of priority:
- List products you will place on the market after the date and check each against Annex I, Parts A and B.
- Contact a notified body for Part A products and for Part B products not fully covered by category-specific harmonised standards.
- Re-map each technical file to Annex IV, points (a) to (o). Fill (f), (m) and (n) first.
- Update the risk assessment to cite Annex III and cover connected devices, malicious attempts and, where relevant, self-evolving behaviour.
- Check your standards list against the OJ references for the Regulation and note publication dates.
- Rewrite declaration templates using Annex V.
- Plan instructions: hosting for 10 years, paper on request, paper safety information, target-country languages.
- Identify safety-relevant software and set up version tracing.
- Ask suppliers for updated declarations and assembly instructions.
- Screen changes against the Article 3(16) definition.
For the item-by-item list, see the Annex IV technical file checklist. The Dossure quick check points out what is missing, inconsistent or worth checking in a file; the decisions stay with you and, where required, your notified body.
Frequently asked questions
- When does Regulation (EU) 2023/1230 apply?
- From 20 January 2027. The Official Journal text first said 14 January 2027; a corrigendum published in OJ L 169 of 4 July 2023 changed it to 20 January 2027. Directive 2006/42/EC is repealed with effect from the same date.
- Can I keep selling machines that were certified under Directive 2006/42/EC?
- Article 52 lets products that were placed on the market in conformity with the Directive before 20 January 2027 continue to be made available. It covers products already placed on the market, not product types. Units you place on the market from 20 January 2027 need documentation under the Regulation. EC type-examination certificates stay valid until they expire.
- Do I still need a technical file under the new Regulation?
- Yes. Article 10(2) requires the technical documentation set out in Annex IV, Part A before placing machinery on the market. Most of its content matches Annex VII of the Directive, with a few added items such as safety-related source code on request and a description of sensor-fed or autonomous systems.
- Can the instructions for use be digital only?
- They may be provided in digital format under Article 10(7), but a user can ask for a free paper copy at the time of purchase, which must be supplied within one month. For machinery that non-professional users can use, the safety information essential for putting into service and safe use must be on paper.
- Does every machine with software now need a notified body?
- No. Annex I, Part A brings in a notified body for safety components and embedded systems with fully or partially self-evolving behaviour using machine learning that ensure safety functions. Recital 55 says software that cannot learn or evolve and only runs programmed automated functions is not covered by that third-party requirement.