EU Compliance 6 min read
EU Machinery Regulation 2023 1230 Guide: Practical Compliance Steps
Regulation (EU) 2023/1230 replaces the Machinery Directive with direct EU-wide rules for software, digital instructions, autonomous functions, and substantial modifications. This guide explains who must act, what evidence to keep, and how to prepare for the 20 January 2027 application date.
Regulation (EU) 2023/1230 replaces the Machinery Directive 2006/42/EC. It entered into force on 19 July 2023 and applies from 20 January 2027. This EU machinery regulation 2023 1230 guide focuses on what design teams, importers, and authorised representatives need to do before that date. The regulation keeps the core CE marking logic but adds obligations for software, digital documentation, autonomous functions, and substantial modifications.
What Regulation (EU) 2023/1230 Changes
The new regulation is not a simple renumbering. It is a regulation, not a directive, so it applies directly in all EU member states without national transposition. That reduces divergence but increases the need to read the legal text itself. Key changes include:
- A broader definition of machinery, covering assemblies, safety components, and related products.
- Explicit coverage of software that performs a safety function.
- Rules for machinery with autonomous or partially autonomous behaviour.
- Digital instructions permitted under conditions, with paper instructions available on request.
- A clearer concept of substantial modification, which can turn a used machine into a new product requiring conformity assessment.
- Stronger market surveillance and traceability duties.
Annex I lists high-risk machinery categories. For these, a notified body usually must be involved. Examples include certain woodworking machines, presses, injection moulding machines, and machinery with AI-based safety functions. If your product falls in Annex I, plan early.
Who Must Comply and What They Owe
Manufacturers, importers, distributors, and authorised representatives all have duties. The manufacturer owns the technical file, risk assessment, EU declaration of conformity, and CE marking. Importers must verify that the manufacturer has done this work and that the marking and documents are present. Distributors must act with due care and not make machinery available if they know it is non-compliant.
This EU machinery regulation 2023 1230 guide uses a role-based view: each economic operator needs evidence that the product meets the essential health and safety requirements. For a practical compliance system, align product engineering with ISO 9001 quality controls, ISO 14001 environmental controls where applicable, and ISO 45001 occupational health and safety controls. These management standards do not replace the regulation, but they create the records and corrective-action discipline that market surveillance authorities expect.
The EU declaration of conformity must identify the regulation, the manufacturer, the product, and any notified body. Keep it with the technical file. If you use a Conformity Assessment Module Selection Guide For EU CE Marki, map the module to the risk category before you design the test plan.
Technical File and Risk Assessment Under the New Rules
The technical file must show how the machinery meets the essential health and safety requirements. It should include drawings, calculations, test reports, component certificates, and instructions. For structural parts, material certificates may reference ASTM A36 or equivalent grades. For transport and packaging validation, ASTM D4169 can support shock and vibration testing. The point is traceability: each claim in the file should link to evidence.
Risk Assessment and Standards
Start with ISO 12100 for risk assessment and risk reduction. Then apply type-B and type-C standards. For safety-related control systems, ISO 13849-1 and IEC 62061 are common. For robots, ISO 10218-1 and ISO 10218-2 may apply. A standard gives a presumption of conformity only when it is harmonised and listed in the Official Journal. Always check the current list.
The risk assessment must cover reasonably foreseeable misuse, maintenance, cleaning, and cyber-related hazards. If the machine uses machine learning, document the training data boundaries, failure modes, and validation. The file should be available to authorities for at least 10 years after the last unit is placed on the market. See EU CE Marking Technical File: A Practical Guide for a file structure you can adapt.
Conformity Assessment, CE Marking, and Notified Bodies
Most machinery can follow the internal production control route. The manufacturer performs the risk assessment, builds the technical file, signs the EU declaration of conformity, and affixes the CE marking. No notified body is needed for non-Annex I products.
When a Notified Body Is Required
Annex I machinery generally requires EU type-examination or a full quality assurance route. The notified body examines the design or the production system. If the product changes after approval, assess whether the change is substantial. A new safety function, a change in control logic, or a new operating mode can trigger a new assessment. Do not treat a notified body certificate as a one-time purchase.
CE marking must be visible, legible, and indelible. It goes on the machinery or on a data plate. If the machine is partly completed, the manufacturer issues a declaration of incorporation instead of a CE mark. That declaration must travel with the partly completed machinery and state which essential requirements are not yet met.
Digital Instructions, Cybersecurity, and Software
The regulation allows digital instructions, but not as a way to hide information. The manufacturer must provide a paper copy free of charge on request. Digital instructions must be accessible, downloadable, and usable offline where needed. They must also remain available for the expected life of the machine.
Cybersecurity is now part of machinery safety. If a machine connects to a network, the risk assessment must address unauthorised access, data integrity, and software updates. If the machine processes personal data, GDPR obligations apply in parallel. A GDPR Data Processing Agreement Clauses: A Practical Guide helps when machinery data includes personal data from operators or maintenance logs.
Software that performs a safety function must be developed under controlled processes. Version control, validation, and change management are essential. Keep evidence that a software update does not create a new hazard. If the update changes the safety function, it may be a substantial modification.
Deadlines, Transition, and Practical Action Plan
The regulation applies from 20 January 2027. Machinery placed on the market before that date under Directive 2006/42/EC can generally continue to be made available. But new products and substantial modifications after the application date must meet Regulation (EU) 2023/1230.
A practical action plan:
- Classify each product against the regulation and Annex I.
- Gap-assess the technical file, risk assessment, and instructions.
- Update contracts with suppliers for component evidence and change notification.
- Train engineering, quality, and service teams on digital instructions and cybersecurity.
- Select conformity assessment modules and engage a notified body early if needed.
- Align document control with ISO 9001, ISO 14001, and ISO 45001 where relevant.
- Audit the CE marking, EU declaration of conformity, and traceability records.
Use this EU machinery regulation 2023 1230 guide as a starting map, not a substitute for the legal text. Read the articles and annexes, check harmonised standards, and document every decision. That approach keeps the CE marking defensible and reduces the risk of market withdrawal.
Key facts
Machine-readable statements extracted from the sources above. Each fact keeps the same identifier across all six language versions.
Regulation (EU) 2023/1230
El Reglamento (UE) 2023/1230 regula la comercialización de máquinas en la Unión Europea.
Fact ID:
regulation_number2023-07-19
El reglamento entró en vigor el 19 de julio de 2023.
Fact ID:
entry_into_force2027-01-20
The regulation applies from 20 January 2027.
Fact ID:
application_dateDirective 2006/42/EC
It repeals Directive 2006/42/EC.
Fact ID:
repealed_directiveCE
Compliant machinery must bear the CE marking.
Fact ID:
CE_markingAnnex I
El anexo I enumera categorías que requieren organismo notificado.
Fact ID:
high_risk_annexdigital technical documentation
La documentación técnica puede mantenerse en formato digital.
Fact ID:
digital_documentationcybersecurity
Incluye requisitos de ciberseguridad para software con función de seguridad.
Fact ID:
cybersecurity_requirementGDPR
El GDPR se aplica cuando la máquina trata datos personales.
Fact ID:
GDPR_interactionISO 12100
ISO 12100 sigue siendo la referencia para evaluación de riesgos.
Fact ID:
ISO_risk_standard
Frequently asked questions
When does Regulation (EU) 2023/1230 apply?
It applies from 20 January 2027. It entered into force on 19 July 2023, but the main obligations begin on the later application date.
Does the regulation replace the Machinery Directive 2006/42/EC?
Yes. Regulation (EU) 2023/1230 repeals Directive 2006/42/EC. Because it is a regulation, it applies directly across the EU without national transposition.
Are digital instructions allowed under the new machinery rules?
Yes, digital instructions are permitted, but the manufacturer must provide a paper copy free of charge on request. The digital version must remain accessible for the expected life of the machine.
When is a notified body required for machinery?
Annex I high-risk machinery generally requires a notified body. Most other machinery can use internal production control, where the manufacturer completes the technical file and signs the EU declaration of conformity.
How long must the technical file be kept?
Keep the technical documentation and EU declaration of conformity for at least 10 years after the last unit is placed on the market.
Does cybersecurity fall under machinery compliance?
Yes. If machinery connects to a network or uses software for safety functions, the risk assessment must address unauthorised access, data integrity, and software updates. GDPR may also apply if personal data is processed.
Sources and licencing
Every claim in this article traces back to the sources listed below. Links open the publisher directly.