Cybersecurity Requirements of the EU Machinery Regulation
The Machinery Regulation (Regulation (EU) 2023/1230) sets binding cybersecurity requirements for machinery and related products for the first time. It has been in force since July 2023 and applies from January 20, 2027. The EU adopted it in response to the growing connectivity of production equipment, which creates new cybersecurity challenges for machine builders.
Manufacturers, importers, and users of machinery need to rethink their safety approach. Alongside physical safety, protection against digital threats now moves to the center. From design and production to operation, machinery must be protected against cyberattacks.
Contents
Why cybersecurity matters for machinery
In connected industry, machines and plants are increasingly linked to the internet and to each other. This enables more efficient processes and remote maintenance, but it also makes the systems vulnerable to cyberattacks. A successful attack can stop production. In the worst case, it can also create safety risks for workers or the environment.
Cybersecurity requirements in Annex III
The Machinery Regulation sets specific cybersecurity requirements for machinery and related products. They are laid down in Annex III, section 1.1.9 (protection against corruption). Their aim is to ensure the integrity and safety of machinery in an increasingly connected manufacturing environment.
As a manufacturer, you must meet the following requirements. Each block quotes the official text, explains it, and gives an example.
Secure connectivity
“The machinery or related product shall be designed and constructed so that the connection to it of another device, via any feature of the connected device itself or via any remote device that communicates with the machinery or related product does not lead to a hazardous situation.”
Machinery must be designed so that connecting external devices or remote access does not create a hazard.
For example, a machine could have an integrated firewall and secure authentication for each interface to prevent unauthorized or potentially dangerous access.
Protection of critical hardware
“A hardware component transmitting signal or data, relevant for connection or access to software that is critical for the compliance of the machinery or related product with the relevant essential health and safety requirements shall be designed so that it is adequately protected against accidental or intentional corruption. The machinery or related product shall collect evidence of a legitimate or illegitimate intervention in that hardware component, when relevant for connection or access to software that is critical for the compliance of the machinery or related product.”
Hardware components that handle safety-relevant signals or data must be adequately protected against accidental or intentional corruption. The machine must be able to provide evidence of interventions in these components.
For a machine, this could mean that the control unit sits in a locked enclosure and only executes cryptographically signed code or commands.
Protection of critical software and data
“Software and data that are critical for the compliance of the machinery or related product with the relevant essential health and safety requirements shall be identified as such and shall be adequately protected against accidental or intentional corruption.”
Safety-relevant software and data must be identified as such and adequately protected against corruption and tampering.
In an automated production line, this could be implemented with encrypted, digitally signed control software that runs in a protected memory area.
Identification of safety-relevant software
“The machinery or related product shall identify the software installed on it that is necessary for it to operate safely, and shall be able to provide that information at all times in an easily accessible form.”
The machine must identify the installed software it needs to operate safely and be able to provide this information in an easily accessible form at all times.
For example, a panel on the machine can show the version number and checksum hash of its safety-critical firmware at every start and on request in the operator menu. This lets operating staff check the integrity of the software quickly.
Recording of changes
“The machinery or related product shall collect evidence of a legitimate or illegitimate intervention in the software or a modification of the software installed on the machinery or related product or its configuration.”
The machine must be able to collect evidence of legitimate or illegitimate interventions in the installed software or its configuration.
For this purpose, a machine could, for example, keep a cryptographically secured change log that records all updates, configuration changes, and access attempts.
These requirements protect machinery and related products against unauthorized intervention and tampering. Both hardware and software must be protected against corruption, and changes must be traceable.
The full requirements are set out in Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023 on machinery. The exact wording of the cybersecurity requirements is in Annex III, section 1.1.9.
How do these requirements apply to your machines?
Many requirements in Annex III leave room for interpretation, especially where safety, security, and established practice meet. If you want to clarify how they apply to your machines, a short call is a good place to start.
Link with the Cybersecurity Act
The Machinery Regulation also takes existing EU cybersecurity rules into account. In particular, it links to the Cybersecurity Act (Regulation (EU) 2019/881). Under Article 20(9) of the Machinery Regulation, machinery and related products are presumed to meet certain requirements if they are certified under a cybersecurity certification scheme adopted under the Cybersecurity Act, or if a statement of conformity has been issued under such a scheme.
This concerns the requirements on protection against corruption (Annex III, section 1.1.9) and on safety and reliability of control systems (Annex III, section 1.2.1). The presumption of conformity applies insofar as these requirements are covered by the cybersecurity certificate or statement of conformity.
This rule creates synergies between the two regulations and avoids unnecessary double certification. Manufacturers that already hold certifications under the Cybersecurity Act find it easier to meet the requirements of the Machinery Regulation. It also supports a consistent approach to cybersecurity across EU legislation.
Link with the Cyber Resilience Act
The Machinery Regulation is also closely linked to the Cyber Resilience Act (CRA). For products that fall under both the Machinery Regulation and the CRA, manufacturers must meet the requirements of both. The CRA recognizes that the cybersecurity requirements can overlap (Recital 53 of the CRA).
Meeting the essential cybersecurity requirements of the CRA can make it easier to comply with certain requirements of the Machinery Regulation. This applies in particular to protection against corruption (section 1.1.9) and safety and reliability of control systems (section 1.2.1). Manufacturers must demonstrate these synergies, however, for example by applying harmonized standards or other technical specifications following a risk assessment.
To ensure consistency, the European Commission and the European standardization organizations intend to promote a consistent approach to assessing and treating risks under both regulations when preparing standards. The Commission also plans to provide guidance to help manufacturers comply with both regulations.
The harmonized standard EN 50742
The Machinery Regulation defines the requirements. For manufacturers, the practical question is how to implement them. The answer is EN 50742, “Safety of machinery – Protection against corruption”, which is being developed as a harmonized standard.
EN 50742 addresses the cybersecurity requirements in Annex III of the Machinery Regulation: protection against corruption (section 1.1.9) and safety and reliability of control systems (section 1.2.1). It gives manufacturers a structured way to meet these requirements.
A distinctive feature of the standard is that it offers two equivalent approaches:
- Approach A, standalone: For manufacturers without IEC 62443 expertise. It is based on a threat assessment and on determining safety-related security levels (SRSL). It suits less complex machinery and companies that are new to cybersecurity.
- Approach B, based on IEC 62443: For manufacturers that already work with the IEC 62443 series. It lets them reuse existing processes and measures and integrate the standard into their existing security management systems.
The standard has not been published yet. The current version is the final draft FprEN 50742:2026 of July 2026, prepared under standardization request M/605 and now in the formal vote. Once its reference is published in the Official Journal of the EU, it is intended to give a presumption of conformity with the Annex III requirements it covers (sections 1.1.9 and 1.2.1). Manufacturers can then demonstrate compliance with the cybersecurity requirements by applying EN 50742.
Our overview of EN 50742 covers the standard in detail, with all requirements and implementation options.
What the Machinery Regulation means for manufacturers
For machine builders, the new requirements mean more work at first. You will need to adapt your development processes and may need to build additional cybersecurity expertise. In particular, you should:
- carry out risk analyses that also cover cybersecurity
- build cybersecurity into the design of your products from the start
- document the security measures you have implemented in full
- develop mechanisms for regular security updates
- provide training and information material for users
In the long term, the regulation also brings opportunities. It creates uniform standards within the EU and can strengthen trust in European products. Companies that invest in cybersecurity early can also gain a competitive advantage.
For users of machinery, the regulation means a higher level of security. They can rely on the products they buy meeting basic cybersecurity standards.
Dates and transition period
The Machinery Regulation (EU) 2023/1230 was adopted on June 14, 2023. Its provisions apply from different dates.
The most important date is January 20, 2027. Until then, the current Machinery Directive (Directive 2006/42/EC) continues to apply. Products placed on the market before that date can still be supplied with a declaration of conformity under the old directive. From January 20, 2027, all products newly placed on the market must meet the requirements of the regulation.
You can already take requirements of the new regulation into account now, such as those on cybersecurity. Since July 2024, the European Commission has also allowed a combined EC/EU declaration of conformity to ease the transition.
Some parts of the regulation already apply. The rules on conformity assessment bodies have applied since January 20, 2024. The Commission's powers to adopt delegated acts have applied since July 20, 2024.
Companies should familiarize themselves with the changes early. This lets them meet all requirements when the transition period ends and continue to make their products available in the EU.
Outlook: cybersecurity in machine building
The Machinery Regulation marks a turning point for connected industry. For the first time, it sets binding cybersecurity requirements for machinery and related products. This will considerably strengthen safety and integrity in increasingly connected manufacturing.
Addressing cybersecurity early matters not only for the Machinery Regulation. It also matters for the Radio Equipment Directive (RED) and the Cyber Resilience Act (CRA). Because these acts overlap, companies can combine their cybersecurity work and prepare efficiently for the regulatory requirements.
Companies should use the time until the regulation applies on January 20, 2027 to adapt their processes, build expertise, and develop new solutions. This puts them in a position to make full use of the opportunities of the new rules and to prepare for future challenges.
How much are your products affected?
The Machinery Regulation brings binding cybersecurity requirements to machine building for the first time. If you want to understand how much your products are affected and which next steps make sense, we can assess this together in a no-obligation call.