EN 50742: Safety of Machinery – Protection against Corruption

EN 50742 is a European standard currently under development. It aims to protect machinery against intentional and unintentional corruption. It is directly linked to the Machinery Regulation (Regulation (EU) 2023/1230) and gives manufacturers clear requirements and guidance for designing machinery that is secure and compliant.

Contents

1. Objectives and scope
2. Link to the Machinery Regulation
3. Structure of EN 50742
4. Two approaches to implementation
   1. Approach A: standalone approach
   2. Approach B: approach based on IEC 62443
5. Current status: final draft FprEN 50742
6. What manufacturers should do now

Objectives and scope

EN 50742 is being developed to protect machinery against corruption that could affect safety-related functions. Its goal is that machinery is designed, manufactured, and operated so that both unintentional and intentional corruption that could lead to a hazardous situation is prevented. This covers in particular protection against security risks that arise from data connections.

EN 50742 applies to machinery and its components that include safety-related functions. It covers:

• Hardware components, including interfaces to remote devices and control systems that transmit signals or data.
• Software and data, where they can affect the safety of the machinery.

The requirements cover the entire lifecycle of the machinery: development, manufacturing, commissioning, operation, maintenance, and decommissioning. Functional safety requirements, as addressed in standards such as ISO 13849-1 or IEC 62061, are not part of EN 50742.

Link to the Machinery Regulation

EN 50742 addresses the following requirements of Annex III of the Machinery Regulation:

Protection against corruption (Annex III, section 1.1.9)

Connecting another device to the machinery must not lead to a hazardous situation, neither through a feature of the connected device nor through remote access. Safety-relevant hardware, software, and data must be protected against accidental and intentional corruption.

Safety and reliability of control systems (Annex III, section 1.2.1)

Control systems must withstand intended and unintended external influences, including reasonably foreseeable malicious attempts from third parties. The tracing log of interventions must remain available to the competent authority for five years after the upload.

The standard is a tool for implementing these requirements of the Machinery Regulation and addressing security risks. With it, manufacturers can show that they address protection against corruption systematically and that their machinery is compliant.

Structure of EN 50742

The standard is divided into several sections that cover the relevant topics systematically:

Introduction and scope

Introduces the objectives and scope of the standard. EN 50742 applies to hardware components, software, and data that can affect the safety of machinery. It covers all lifecycle phases: development, manufacturing, commissioning, operation, maintenance, and decommissioning.

Terms and definitions

Clarifies the central terms, such as “corruption”, “intervention”, “vulnerability”, “security context”, and “safety-related security level (SRSL)”.

Protection against corruption

Basic principles and requirements: identify all data connections and carry out a security risk assessment after the risk assessment according to EN ISO 12100. Then define the security context and apply the three-step principle (elimination, mitigation, information).

Process requirements

Approach A: a standalone approach with a security risk assessment and systematic implementation of protective measures, intended for manufacturers without IEC 62443 expertise. Approach B: a full reference to IEC 62443-4-1 for the secure product development lifecycle, security management, specification, verification, and validation. It is intended for manufacturers that already work with the IEC 62443 series.

Technical requirements

Approach A: requirements for authentication, authorization, integrity, and authenticity, graded by safety-related security levels (SRSL0 to SRSL3). In addition, requirements for logging and software identification that apply equally to all levels. Approach B: a distinction between machinery (according to IEC 62443-3-3) and machinery components (according to IEC 62443-4-2) with specific foundational requirements.

Information for use

Documentation requirements: information about the security context, software versions, and configuration, instructions on how to access this information, and details of permitted and prohibited modifications.

Annexes supplement the requirements. Some are informative, some normative. They contain examples of logging formats, recommendations for the security risk assessment, and an overview of how the standard relates to the requirements of the Machinery Regulation.

Two approaches to implementation

A defining feature of EN 50742 is that it offers manufacturers two equivalent approaches. Which one fits depends on whether your company already works with the IEC 62443 series or prefers a standalone route.

Approach A: standalone approach

Approach A was designed for manufacturers that develop their machinery without reference to the IEC 62443 series. It suits companies without IEC 62443 expertise and less complex use cases.

The approach follows three steps:

1. Eliminate vulnerabilities that can lead to hazardous situations.
2. Use protective measures to mitigate vulnerabilities that cannot be eliminated.
3. For remaining risks, the manufacturer must inform the user so that the user can take compensating measures.

A central concept is the safety-related security level (SRSL), from 0 to 3. You determine and document an SRSL for each safety-relevant interface, based on the risk reduction and the likelihood that a threat is exploited successfully. The higher the SRSL, the stricter the requirements for authentication, authorization, integrity, and authenticity. The requirements for logging and software identification, by contrast, are the same for all levels.

Traceability is another important aspect. Interventions in safety-relevant software must be logged. The entries in the tracing log must be kept for at least five years. Protecting the logs against tampering is recommended.

Approach B: approach based on IEC 62443

Approach B is for manufacturers that already use IEC 62443-3-3, IEC 62443-4-1, and IEC 62443-4-2 or plan to use them. It integrates with existing processes and lets you reuse measures you have already implemented.

For process requirements, the standard refers entirely to IEC 62443-4-1. This covers systematic security management, the specification of security requirements, and verification and validation, including vulnerability testing.

For technical requirements, Approach B distinguishes between machinery and machinery components:

• For the safety-related functions of the machinery, a fixed minimum selection of requirements from IEC 62443-3-3 applies.
• For components, a fixed minimum selection from IEC 62443-4-2 applies.

You therefore do not have to implement either standard in full. If a component cannot meet a requirement on its own, compensating measures outside the component are allowed. In that case, the instructions of the component must state that such measures are needed and which requirements the component does not meet itself.

Here too, security-relevant audit records must be stored for at least five years.

Current status: final draft FprEN 50742

So far, EN 50742 exists only as a draft. The current version is the final draft FprEN 50742:2026 of July 2026, prepared by CLC/TC 44X under standardization request M/605 for the Machinery Regulation. It is in the formal vote and has not been adopted yet.

Once the standard is final and its reference is published in the Official Journal of the European Union, the presumption of conformity applies. If you apply the standard, you can assume that your machinery meets the requirements of the Machinery Regulation that it covers. Until then, the draft gives orientation but is no proof of conformity.

What manufacturers should do now

EN 50742 closes an important gap in the security requirements for modern, connected machinery. Its two equivalent approaches give you flexibility: Approach A offers a direct entry, while Approach B builds on proven IEC 62443 structures.

You should review the draft now and, where the standardization process still allows it, submit comments through your national standards body. This is also the right time to decide which approach suits your company and to start preparing for implementation.