EU Compliance 6 min read

EU Machinery Regulation 2023 1230 Guide: Practical Compliance Steps

Regulation (EU) 2023/1230 replaces the Machinery Directive with direct EU-wide rules for software, digital instructions, autonomous functions, and substantial modifications. This guide explains who must act, what evidence to keep, and how to prepare for the 20 January 2027 application date.

Published
Updated
Illustration for the guide “EU Machinery Regulation 2023 1230 Guide: Practical Compliance Steps”

Regulation (EU) 2023/1230 replaces the Machinery Directive 2006/42/EC. It entered into force on 19 July 2023 and applies from 20 January 2027. This EU machinery regulation 2023 1230 guide focuses on what design teams, importers, and authorised representatives need to do before that date. The regulation keeps the core CE marking logic but adds obligations for software, digital documentation, autonomous functions, and substantial modifications.

What Regulation (EU) 2023/1230 Changes

The new regulation is not a simple renumbering. It is a regulation, not a directive, so it applies directly in all EU member states without national transposition. That reduces divergence but increases the need to read the legal text itself. Key changes include:

  • A broader definition of machinery, covering assemblies, safety components, and related products.
  • Explicit coverage of software that performs a safety function.
  • Rules for machinery with autonomous or partially autonomous behaviour.
  • Digital instructions permitted under conditions, with paper instructions available on request.
  • A clearer concept of substantial modification, which can turn a used machine into a new product requiring conformity assessment.
  • Stronger market surveillance and traceability duties.

Annex I lists high-risk machinery categories. For these, a notified body usually must be involved. Examples include certain woodworking machines, presses, injection moulding machines, and machinery with AI-based safety functions. If your product falls in Annex I, plan early.

Who Must Comply and What They Owe

Manufacturers, importers, distributors, and authorised representatives all have duties. The manufacturer owns the technical file, risk assessment, EU declaration of conformity, and CE marking. Importers must verify that the manufacturer has done this work and that the marking and documents are present. Distributors must act with due care and not make machinery available if they know it is non-compliant.

This EU machinery regulation 2023 1230 guide uses a role-based view: each economic operator needs evidence that the product meets the essential health and safety requirements. For a practical compliance system, align product engineering with ISO 9001 quality controls, ISO 14001 environmental controls where applicable, and ISO 45001 occupational health and safety controls. These management standards do not replace the regulation, but they create the records and corrective-action discipline that market surveillance authorities expect.

The EU declaration of conformity must identify the regulation, the manufacturer, the product, and any notified body. Keep it with the technical file. If you use a Conformity Assessment Module Selection Guide For EU CE Marki, map the module to the risk category before you design the test plan.

Technical File and Risk Assessment Under the New Rules

The technical file must show how the machinery meets the essential health and safety requirements. It should include drawings, calculations, test reports, component certificates, and instructions. For structural parts, material certificates may reference ASTM A36 or equivalent grades. For transport and packaging validation, ASTM D4169 can support shock and vibration testing. The point is traceability: each claim in the file should link to evidence.

Risk Assessment and Standards

Start with ISO 12100 for risk assessment and risk reduction. Then apply type-B and type-C standards. For safety-related control systems, ISO 13849-1 and IEC 62061 are common. For robots, ISO 10218-1 and ISO 10218-2 may apply. A standard gives a presumption of conformity only when it is harmonised and listed in the Official Journal. Always check the current list.

The risk assessment must cover reasonably foreseeable misuse, maintenance, cleaning, and cyber-related hazards. If the machine uses machine learning, document the training data boundaries, failure modes, and validation. The file should be available to authorities for at least 10 years after the last unit is placed on the market. See EU CE Marking Technical File: A Practical Guide for a file structure you can adapt.

Conformity Assessment, CE Marking, and Notified Bodies

Most machinery can follow the internal production control route. The manufacturer performs the risk assessment, builds the technical file, signs the EU declaration of conformity, and affixes the CE marking. No notified body is needed for non-Annex I products.

When a Notified Body Is Required

Annex I machinery generally requires EU type-examination or a full quality assurance route. The notified body examines the design or the production system. If the product changes after approval, assess whether the change is substantial. A new safety function, a change in control logic, or a new operating mode can trigger a new assessment. Do not treat a notified body certificate as a one-time purchase.

CE marking must be visible, legible, and indelible. It goes on the machinery or on a data plate. If the machine is partly completed, the manufacturer issues a declaration of incorporation instead of a CE mark. That declaration must travel with the partly completed machinery and state which essential requirements are not yet met.

Digital Instructions, Cybersecurity, and Software

The regulation allows digital instructions, but not as a way to hide information. The manufacturer must provide a paper copy free of charge on request. Digital instructions must be accessible, downloadable, and usable offline where needed. They must also remain available for the expected life of the machine.

Cybersecurity is now part of machinery safety. If a machine connects to a network, the risk assessment must address unauthorised access, data integrity, and software updates. If the machine processes personal data, GDPR obligations apply in parallel. A GDPR Data Processing Agreement Clauses: A Practical Guide helps when machinery data includes personal data from operators or maintenance logs.

Software that performs a safety function must be developed under controlled processes. Version control, validation, and change management are essential. Keep evidence that a software update does not create a new hazard. If the update changes the safety function, it may be a substantial modification.

Deadlines, Transition, and Practical Action Plan

The regulation applies from 20 January 2027. Machinery placed on the market before that date under Directive 2006/42/EC can generally continue to be made available. But new products and substantial modifications after the application date must meet Regulation (EU) 2023/1230.

A practical action plan:

  1. Classify each product against the regulation and Annex I.
  2. Gap-assess the technical file, risk assessment, and instructions.
  3. Update contracts with suppliers for component evidence and change notification.
  4. Train engineering, quality, and service teams on digital instructions and cybersecurity.
  5. Select conformity assessment modules and engage a notified body early if needed.
  6. Align document control with ISO 9001, ISO 14001, and ISO 45001 where relevant.
  7. Audit the CE marking, EU declaration of conformity, and traceability records.

Use this EU machinery regulation 2023 1230 guide as a starting map, not a substitute for the legal text. Read the articles and annexes, check harmonised standards, and document every decision. That approach keeps the CE marking defensible and reduces the risk of market withdrawal.

Key facts

Machine-readable statements extracted from the sources above. Each fact keeps the same identifier across all six language versions.

  • Regulation (EU) 2023/1230

    El Reglamento (UE) 2023/1230 regula la comercialización de máquinas en la Unión Europea.

    Fact ID: regulation_number

  • 2023-07-19

    El reglamento entró en vigor el 19 de julio de 2023.

    Fact ID: entry_into_force

  • 2027-01-20

    The regulation applies from 20 January 2027.

    Fact ID: application_date

  • Directive 2006/42/EC

    It repeals Directive 2006/42/EC.

    Fact ID: repealed_directive

  • CE

    Compliant machinery must bear the CE marking.

    Fact ID: CE_marking

  • Annex I

    El anexo I enumera categorías que requieren organismo notificado.

    Fact ID: high_risk_annex

  • digital technical documentation

    La documentación técnica puede mantenerse en formato digital.

    Fact ID: digital_documentation

  • cybersecurity

    Incluye requisitos de ciberseguridad para software con función de seguridad.

    Fact ID: cybersecurity_requirement

  • GDPR

    El GDPR se aplica cuando la máquina trata datos personales.

    Fact ID: GDPR_interaction

  • ISO 12100

    ISO 12100 sigue siendo la referencia para evaluación de riesgos.

    Fact ID: ISO_risk_standard

Frequently asked questions

When does Regulation (EU) 2023/1230 apply?

It applies from 20 January 2027. It entered into force on 19 July 2023, but the main obligations begin on the later application date.

Does the regulation replace the Machinery Directive 2006/42/EC?

Yes. Regulation (EU) 2023/1230 repeals Directive 2006/42/EC. Because it is a regulation, it applies directly across the EU without national transposition.

Are digital instructions allowed under the new machinery rules?

Yes, digital instructions are permitted, but the manufacturer must provide a paper copy free of charge on request. The digital version must remain accessible for the expected life of the machine.

When is a notified body required for machinery?

Annex I high-risk machinery generally requires a notified body. Most other machinery can use internal production control, where the manufacturer completes the technical file and signs the EU declaration of conformity.

How long must the technical file be kept?

Keep the technical documentation and EU declaration of conformity for at least 10 years after the last unit is placed on the market.

Does cybersecurity fall under machinery compliance?

Yes. If machinery connects to a network or uses software for safety functions, the risk assessment must address unauthorised access, data integrity, and software updates. GDPR may also apply if personal data is processed.

Sources and licencing

Every claim in this article traces back to the sources listed below. Links open the publisher directly.

  1. Regulation (EU) 2023/1230 on machinery(opens in a new tab)

    Publisher: European Union© European Union, 1998–2024; reutilización autorizada con condiciones

  2. Directive 2006/42/EC on machinery(opens in a new tab)

    Publisher: European Union© European Union, 1998–2024; reutilización autorizada con condiciones

  3. Machinery - European Commission(opens in a new tab)

    Publisher: European CommissionCC BY 4.0

Reference Packs

Complete reference packs

Every article in the domain, reorganised into one professionally typeset PDF with a table of contents and cross-references.

All reference packs
EU Compliance Complete Pack — CE Marking Technical Files and GDPR Data Processing Agreements: A Practical Guide Bundle

Instant download 150 pages 2 articles

EU Compliance Complete Pack

CE Marking Technical Files and GDPR Data Processing Agreements: A Practical Guide Bundle

EU Compliance Complete Pack brings together two practical guides for professionals who need to build, review, and maintain essential EU regulatory documentation. The first guide, EU CE Marking Technical File: A Practical Guide, walks through the purpose and structure of a technical file, product scope, applicable harmonised standards, risk assessment, declaration of conformity, authorised representative requirements, retention, and market surveillance readiness. The second guide, GDPR Data Processing Agreement Clauses: A Practical Guide, explains when Article 28 applies, how to draft and negotiate core DPA clauses, and how to handle sub-processors, international transfers, audits, breach notification, liability, and termination. Transitioning from product compliance to data protection, this pack connects two areas that often sit in different departments but share the same regulatory logic: documented accountability, traceability, and evidence. Each guide uses plain-language explanations, clause-by-clause commentary, checklists, and practical examples so you can move from understanding requirements to producing defensible documents. Whether you are preparing for a notified body review, responding to a customer due diligence request, or negotiating a vendor agreement, the material is designed to be used directly in your compliance workflow. In summary, EU Compliance Complete Pack is a focused, ready-to-use resource for compliance officers, legal teams, product managers, and consultants. It combines CE marking technical file guidance with GDPR DPA clause analysis, giving you a single reference for two high-priority EU compliance workstreams. Use it to train teams, build templates, audit existing documentation, and reduce the risk of costly gaps before regulators, customers, or auditors find them.

$9.90 Read article

Related articles

Domain overview · EU Compliance