Machine modifications from 20 January:
no transition period for ongoing projects

A supplier plant retrofits a 2008 forming press with an automatic parts feeder. The feeder creates a new danger zone that a light curtain is meant to protect, and the light curtain must be integrated into the safety control system. The press is due to restart in February, and so under the new law. From 20 January 2027, the EU Machinery Regulation (EU) 2023/1230 applies. It replaces Machinery Directive 2006/42/EC.

The retrofit is a substantial modification within the meaning of Article 3(16) of the regulation. Under Article 18, whoever carries it out counts as the manufacturer, whether operator or commissioned service provider. The regulation provides no separate transition period for modifications already begun, the law firm RSM Ebner Stolz points out. Article 52 protects only machines that were placed on the market under the old directive before the cutoff date. If the modification goes into operation in February, the modified machine must meet the requirements of the new regulation.

The threshold for a substantial modification is now in the regulation text

The definition has three conditions. The change is not foreseen by the manufacturer and occurs after placing on the market, physically or digitally. It creates a new hazard or increases an existing risk. And it requires new protective measures: guards or protective devices for which the existing safety control system must be adapted, or additional measures for stability and strength. Repair and maintenance that do not change conformity are not a substantial modification under recital 26. If the existing protective measures are sufficient for the new risk, a modification likewise stays below the threshold.

For interlinked installations, Article 18 contains a limit. If the risk assessment shows that only one machine in an assembly of machines is affected, the manufacturer obligations apply only to that machine. The modifier declares conformity on its own responsibility and goes through the conformity assessment procedure under Article 25. According to RSM Ebner Stolz, the actual role is what counts, not the project name in the contract, and a brief note “no substantial modification” does not replace the analysis.

For software, what counts is whether safety functions are affected

Because the definition includes digital changes, even an intervention without tools can cross the threshold. According to RSM Ebner Stolz, updates that the original manufacturer foresaw and covered generally do not fall under it. Changed logic in the safety PLC, new remote access or parameters outside the manufacturer's approval, by contrast, require a new assessment.

For machines that go into operation new or substantially modified from the cutoff date, Annex III also regulates how interventions stay provable. Under point 1.1.9, the machine must identify the software required for safe operation and collect evidence of every legitimate or illegitimate intervention in software or configuration. Point 1.2.1 requires a log of the uploaded versions of the safety software. On 5 November, the Machinery Expert Group approved a chapter of the Commission guide on this. Under it, every event must be stored for at least five years, and it does not matter who made the change. According to the guide, remote access points should be delivered in a safe state, for example deactivated, and the instructions describe how the operator enables them safely.

Learning safety functions need a notified body

It gets stricter when a modification introduces safety functions with machine learning, for example camera-based person detection that evolves in operation. Safety components and embedded systems with “fully or partially self-evolving behavior” are listed in Annex I, Part A. For them, Article 25(2) allows only procedures involving a notified body, meaning a testing body designated by a member state: type examination, full quality assurance or unit verification. This expressly applies to the modifier under Article 18 as well. Software that does not learn and only executes fixed functions is not meant, according to recital 55.

How far the term reaches is unclear. According to the DGUV Test FAQ, DGUV Test being the testing and certification body of the statutory accident insurance, the Federal Institute for Occupational Safety and Health (BAuA) apparently prefers a literal reading that covers only systems that keep learning after being placed on the market. The Commission is said to favor a broader interpretation that focuses on unpredictable results. There is no guide chapter on this. The Digital Omnibus on AI, adopted in July, moves machinery into the sectoral part of the AI Act. Its requirements for high-risk AI as a safety component will in future come through Annex III of the Machinery Regulation, by delegated act from 2 August 2028.

For existing equipment, the Industrial Safety Ordinance remains decisive

Machines placed on the market under the Machinery Directive before 20 January 2027 may continue to be made available under Article 52, and for German law the implementing act (MaschinenDG, the German Machinery Regulation Implementation Act) repeats this in § 11. The regulation does not create an obligation to retrofit, DGUV Test stresses. For operation, the hazard assessment and the Industrial Safety Ordinance (BetrSichV) count, including for modifications below the threshold of a substantial modification. For networked safety technology, DGUV Test refers to Technical Rule TRBS 1115 Part 1 on the cybersecurity of safety-related measurement, control and regulation equipment.

BetrSichV has its own threshold. Under § 2(9), a change that requires inspection is any measure that affects the safety of work equipment, including a repair. After that, a person competent to perform the inspection checks the work equipment before its next use, according to § 14(3). In addition, under § 10(5), the employer must assess whether a change triggers manufacturer obligations under other legislation. From 20 January, that is the Machinery Regulation. Many interventions require inspection without being substantial. Both questions belong in the documentation separately.

Standards and the guide arrive late, but the start date stays

The most convenient proof comes from harmonized standards whose references in the Official Journal trigger a presumption of conformity. Under the new regulation, no standard is listed there yet. The Commission is preparing an implementing decision and expects the first list before the end of the year. According to a report by the construction equipment association CECE on the April meeting of the expert group, the Commission wants to carry over most standards from the old directive and cite them with restrictions where new requirements, for example on cybersecurity or AI, are missing.

The complete guide to the Machinery Regulation is due to be finished during 2027. The four chapters approved in advance cover corruption, seats, vibrations and overhead power lines. Nothing on substantial modification is available yet. Neither of the two omnibus procedures changes the application date. Omnibus IV is meant, among other things, to make the EU declaration of conformity digital. According to the Legislative Observatory, the European Parliament is expected to vote on 23 November, and under the negotiated text, the changes to the Machinery Regulation apply only 30 months after entry into force.

Counting as the manufacturer means instructions and a technical file

Under Article 18, the modifier takes on the obligations from Article 10. These include the technical documentation and declaration of conformity, which must be kept for at least ten years, and instructions for use. They may be supplied digitally if the machine states how to retrieve them, if they can be printed and saved, and if they stay online for at least ten years. If the user asks for paper at the time of purchase, the manufacturer must deliver it free of charge within one month. In Germany, under § 2 MaschinenDG, the instructions, the declaration of conformity and the notice about digital access must be available in German. Violations of these obligations cost up to €10,000 under § 9, and a missed corrective action up to €100,000.

What operators and service providers should settle before the next modification

• For every project that restarts after 19 January 2027, justify the assessment under Article 3(16) with a risk assessment, not with a one-liner.
• Record in the contract who becomes the manufacturer, who issues the declaration of conformity and who obtains the original manufacturer's software and technical data.
• Install updates to safety controllers only with the original manufacturer's approval, or assess them as a possible modification and document them with the version status.
• Record remote maintenance access points and clarify who enables them and how interventions are logged.
• Check every change for an inspection obligation under BetrSichV as well, and plan the inspection by a competent person before recommissioning.

For the press in the example, the date decides. If it restarts before 20 January, the previous law applies. If it restarts in February, it is measured against Annex III of the new regulation, possibly before the matching standards appear in the Official Journal. Anyone still planning the modification should therefore settle the roles first and then the date.