When a Machinery Retrofit Makes You the Manufacturer

You add a new robot to an existing machine, replace the old control system with a connected one, or increase the cycle rate. To you, this is a modernization. Legally, it can be something else entirely. If your modification creates a new hazard or increases an existing risk, you become the manufacturer of the machine, with all the obligations that come with that role. In effect, the retrofit turns into a new build.

The new EU Machinery Regulation (Regulation (EU) 2023/1230) writes this principle into law explicitly for the first time. It applies from January 20, 2027, and replaces the Machinery Directive (Directive 2006/42/EC) on that date. If you modify or upgrade existing machinery, you should understand the term “substantial modification” before you pick up the first wrench.

Contents

1. What counts as a substantial modification of machinery?
2. Repair, maintenance, or substantial modification: where is the line?
3. When does a modification make you the manufacturer, and what follows?
   1. Which obligations apply to you?
4. Why are software changes assessed differently from hardware?
5. What applies to existing machinery and legacy plants?
6. What does a retrofit mean for the support period?
7. How do you check in practice whether your retrofit is affected?
8. Your modification decides your role

What counts as a substantial modification of machinery?

The Machinery Regulation defines a substantial modification as a physical or digital modification of machinery after it has been placed on the market or put into service. The modification is not foreseen or planned by the manufacturer, and it affects safety by creating a new hazard or increasing an existing risk.

What matters is the consequence. Under the regulation, a modification only becomes substantial if it requires one of two things:

• adding guards or protective devices whose integration requires a change to the existing safety control system, or
• taking additional protective measures to ensure the stability or mechanical strength of the machine.

So the definition does not cover every change. It covers changes that call for new safety solutions.

Two points stand out. First, digital modifications count explicitly, not only mechanical conversions. Second, the assessment is tied to your risk assessment: anything the original manufacturer had already foreseen and planned for is not a substantial modification.

Repair, maintenance, or substantial modification: where is the line?

Not every intervention makes you the manufacturer. The Commission's Blue Guide on the implementation of EU product rules 2022 describes the test that also underlies the Machinery Regulation. A modified product can count as a new product if three conditions are met together:

1. Its original performance, purpose, or type was changed, and the original risk assessment did not foresee this.
2. The nature of the hazard has changed or the level of risk has increased.
3. The product is made available or put into service.

Whether this threshold is reached must always be decided case by case.

Pure maintenance does not count. Under the Blue Guide, replacing a defective or worn part with an identical or at least similar spare part does not make the machine a new product. This holds even if the new part performs slightly better due to technical progress. Machinery repaired in this way does not need a new conformity assessment.

The following overview shows where the line runs in typical retrofit situations. It does not replace an assessment of your specific case, but it makes the logic easier to grasp.

As a rule, does not trigger manufacturer obligations	As a rule, counts as a substantial modification
Replacing a sensor or motor with a part of identical design and performance	Adding a robot cell or handling system that creates new hazards
Repair after a defect without changing the function	Increasing power, speed, or cycle rate beyond the intended range
Software security update that only closes a vulnerability	Removing or bypassing a guard so that the safety control system must be changed
Cosmetic or purely operational adjustment	Modification that introduces a new type of hazard (for example, remote control for the first time)

When does a modification make you the manufacturer, and what follows?

The Machinery Regulation is clear on this point. A natural or legal person who carries out a substantial modification of machinery is considered a manufacturer for the purposes of the regulation. That person is then subject to the manufacturer's obligations for that machine. If the risk assessment shows that the modification affects only one machine within an assembly of machinery, the obligations are limited to the affected machine.

This change of role does not only affect classic retrofitters. An importer or distributor also becomes the manufacturer if it modifies a product already placed on the market in a way that may affect compliance. There is only one exception: non-professional users who modify their own machine for their own use are not considered manufacturers.

Which obligations apply to you?

If you become the manufacturer, you must declare on your sole responsibility that the machine concerned meets the applicable requirements of the regulation. You must also carry out the relevant conformity assessment procedure. In practice, you take the same steps as an original manufacturer:

• Update the risk assessment and apply the essential health and safety requirements of Annex III of the regulation to the modified machine.
• Prepare or update the technical documentation. The Blue Guide makes clear that you only need to reassess and document the aspects affected by the modification, not the entire machine from scratch.
• Carry out the conformity assessment using the procedure that applies to the machine.
• Issue the EU declaration of conformity and affix the CE marking for the modified machine.

The limited scope is the good news. You do not have to repeat tests and documents that the modification does not touch. The responsibility for the compliance of the modified result, however, is yours.

Why are software changes assessed differently from hardware?

Once a machine is connected and controlled by software, a second layer comes into play. Products with digital elements fall under the Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA. The CRA has its own concept of substantial modification, and it targets software specifically.

Under the CRA, a substantial modification is a change to a product with digital elements after its placing on the market. The change either affects compliance with the essential cybersecurity requirements or changes the intended purpose. Here, too, whoever carries out such a substantial modification and makes the product available counts as the manufacturer. This applies to the part of the product affected by the modification or, if the cybersecurity of the whole product is affected, to the entire product.

The original manufacturer's obligations do not end. According to the Commission's guidance, the original manufacturer remains responsible for the parts that your modification does not touch, in particular for vulnerability handling. Responsibility is shared, not transferred. This is also the difference from integration. If you assemble components into a new product and place it on the market under your own name, you are not modifying someone else's product. You are the manufacturer of the new product, and of all of it.

The decisive difference lies in how updates are assessed. According to the recitals of the CRA, a pure security update is generally not a substantial modification if it only reduces the cybersecurity risk and does not change the purpose of the machine. This typically applies when you close a known vulnerability. Minor functional adjustments, such as a new language or a visual update, are usually not critical either. Conversely, a feature update that changes the originally intended functions or the performance can well be a substantial modification. New features usually enlarge the attack surface and so increase the cybersecurity risk.

The Commission's guidance sharpens this line at a point that is often overlooked in practice. A security update remains non-critical even if it is technically far-reaching, as long as it does not change the intended purpose and does not introduce new risks. This explicitly covers cases in which functions are restricted or reworked only to close a vulnerability. Conversely, a security-driven update can also tip over. Take an update that moves a previously local function to a remote service, substantially changes data flows, or creates new externally reachable interfaces that the risk assessment did not foresee. Such an update is a substantial modification, even though it was made for security reasons.

The Blue Guide draws the same line for classic product safety. Software updates are treated like maintenance as long as they do not affect compliance. Only when an update changes the intended functions, type, or performance, shifts the nature of the hazard, or raises the level of risk is the product substantially modified.

Change to the machine	Assessment logic	New assessment required?
Hardware modification that creates a new hazard (Machinery Regulation)	Substantial modification if additional guards or stability measures become necessary	Yes, manufacturer obligations for the affected machine
Security update without a change of purpose and without new risks (CRA)	Fixes a vulnerability and only reduces risk; applies even to technically far-reaching changes	No, as a rule not a substantial modification
Security update that moves data flows or creates new external interfaces (CRA)	Despite the security purpose, new or increased risks outside the risk assessment	Yes, manufacturer obligations for the affected part
Feature update that changes purpose or performance (CRA)	Enlarges the attack surface, increases the cybersecurity risk	Yes, manufacturer obligations for the affected part
Minor adjustment (new language, user interface)	No effect on purpose or security	No

The two frameworks interlock. In Annex III, the Machinery Regulation sets its own requirements for protection against corruption and for the safety and reliability of control systems. We explain how these cybersecurity requirements of the Machinery Regulation and the obligations of the CRA work together in our article on how the Cyber Resilience Act and the Machinery Regulation interact. For more on protection against tampering, see EN 50742, “Safety of machinery – Protection against corruption”.

What applies to existing machinery and legacy plants?

A common misconception is that older machines are not affected by any of this. For continued operation as is, that is often true. Once they are substantially modified, however, the new obligations apply.

Legally, this is real progress. The old Machinery Directive 2006/42/EC did not define substantial modification explicitly. Until now, the concept was derived mainly from guidance documents and national interpretation. The Machinery Regulation now codifies it directly in the legal text for the first time. It applies from January 20, 2027, and Directive 2006/42/EC is repealed on the same date.

On the cybersecurity side, the CRA has a clear transitional rule. Products with digital elements placed on the market before December 11, 2027, are subject to the CRA requirements only if they undergo a substantial modification after that date. The exception is the reporting obligation for actively exploited vulnerabilities and severe incidents, which applies earlier to all affected existing products. A retrofit can therefore pull an existing product that was initially outside the scope fully into it. For an overview of the new cybersecurity obligations in machine building, see our page on the cybersecurity requirements of the Machinery Regulation.

What does a retrofit mean for the support period?

If a retrofit amounts to a substantial modification and you make the result available, the Commission's guidance treats this as a new placing on the market. That raises the question of the support period again.

The support period is not automatically extended or reset. What matters is still the expected period of use of the modified product, which you reassess using the criteria of the CRA. The deciding question is whether the modification affects exactly the factors that determined the original period of use.

In a retrofit, this is often not the case. If the expected period of use depended mainly on the physical durability of the machine and you only change software or a service behind it, the original frame remains. The support period of the modified product then follows the remaining expected period of use. If the modification does shift the period of use itself, for example because major assemblies are replaced, you must set the support period again accordingly.

How do you check in practice whether your retrofit is affected?

Before you carry out a modification, a short, structured check pays off. Three questions usually lead to the right classification:

1. Does the modification create a new hazard or increase an existing risk? Did the original risk assessment foresee the change? If not, and if guards or stability measures become necessary, everything points to a substantial modification.
2. Are you changing hardware or software? For software, the question is whether you only close a vulnerability (usually not critical) or change the purpose, function, or performance (then, as a rule, substantial).
3. Will you make the result available or put it into service? According to the Blue Guide, the manufacturer obligations only apply once the machine is made available or put into service; Article 18 of the Machinery Regulation, by contrast, ties the manufacturer role to the substantial modification alone.

For software changes, the Commission's guidance specifies the second question with four checkpoints:

• Does the update introduce new threat vectors, such as additional interfaces, communication channels, or external dependencies?
• Does it enable new attack scenarios?
• Does it change the likelihood of known scenarios, for example because exploiting them requires less effort or knowledge?
• Does it change their possible impact, meaning the extent of affected data and functions or your ability to detect and contain an incident?

If the answer is no four times and the assumptions of your risk assessment still hold, this speaks against a substantial modification.

Document this check. Keep the risk assessment up to date and, if in doubt, treat the machine like a new machine. That is the safer route, because you bear the responsibility for the compliance of the modified result.

Whatever the final classification, you must keep the risk assessment and technical documentation up to date on an ongoing basis. This obligation does not depend on whether a change counts as substantial.

Your modification decides your role

A retrofit is rarely just engineering. It may shift your legal role from operator to manufacturer, with conformity assessment, technical documentation, a declaration of conformity, and CE marking. From 2027, the Machinery Regulation makes this transition explicit in law for the first time. For connected machinery, the CRA adds a second check: whether a software change alters the cybersecurity risk. If you consider both layers early, you can plan modifications on solid ground instead of fixing them afterward.