Machinery Regulation (EU) 2023/1230

Not as a retrofit obligation. Regulation (EU) 2023/1230 is a product law. It sets out how manufacturers design, test and place machinery on the market, and on 20 January 2027 it replaces the Machinery Directive 2006/42/EC. What counts is the moment of placing on the market, meaning the first making available on the Union market. A machine placed on the market under the old law before that date may continue to be made available and used, and Article 52 bars member states from obstructing it.

The order date does not matter. A machine delivered in December 2026 falls under the old law, the same machine delivered in February 2027 under the new one. If you are ordering now, put in the contract which law the manufacturer will use when placing the machine on the market and by when it will deliver.

In Germany, the risk assessment and the Industrial Safety Ordinance (BetrSichV) remain the basis for operation. The German Machinery Regulation Implementation Act supplements the Regulation on matters such as the language of documents and fines, and under its section 12 those parts apply from 20 January 2027.

Operators and service providers are mostly affected through modifications. If a machine is substantially modified after the cut-off date, it has to meet the new Regulation before it goes back into operation, even if it was originally placed on the market under the old law.

Article 3(16) sets several conditions that must all be met. The modification is not foreseen or planned by the manufacturer and is made after the machine was placed on the market or put into service. It affects safety by creating a new hazard or increasing an existing risk. And it requires one of two follow-up measures: guards or protective devices whose integration means changing the existing safety control system, or additional measures for stability or mechanical strength.

An example: a press gets an automatic parts feeder that creates a new danger zone. A light curtain protects it and is wired into the safety controller. All conditions are met. If a worn drive is replaced with an equivalent part, there is no new hazard to begin with. A change the manufacturer foresaw itself, for instance as an option in its manual, does not meet the first condition either.

The definition is abstract, so each project is worth a written rationale: which hazards are added, which protective measures are needed and whether the safety control system has to be adapted. If the modification affects the safety of only one machine in an assembly of machinery, as shown in the risk assessment, the manufacturer duties under Article 18 apply to that machine alone. A bare note saying there is no substantial modification is no substitute for the risk assessment.

As a rule, no. Recital 26 says expressly that repair and maintenance operations which do not affect the machine's compliance with the essential health and safety requirements are not substantial modifications. Replacing a wear part with an equivalent one, restoring a defined condition or readjusting to the manufacturer's specification all remain ordinary maintenance. A recital is not operative text, though, and only helps with interpretation. The line runs where a repair turns into something else: a safety component of a different design, a new control generation, changed safety logic.

Operators have to answer two questions separately. Under the Machinery Regulation, you have to establish whether anyone becomes a manufacturer. In Germany, the Industrial Safety Ordinance (BetrSichV) asks whether the change requires an inspection. Under section 2(9), a modification requiring inspection is any measure that affects the safety of work equipment, and repair work can be one. Many interventions therefore require an inspection without being substantial in the sense of the Machinery Regulation.

Both assessments belong in the asset file, with date, reasoning and name. That is the record an authority, an insurer or a court will ask for first. vi assigns service reports and retrofit quotes to the asset and keeps the change history together.

Yes, the definition expressly covers digital modifications. A new software version, changed parameters or a newly set up remote access can have the same effect as a mechanical retrofit if they meet the conditions of Article 3(16). An update the manufacturer foresaw and released fails the first condition. Changed logic in the safety controller that the manufacturer did not foresee and that requires new protective measures is a case for assessment.

What the machine itself must do is also new. Annex III, point 1.1.9 requires it to identify the software needed for safe operation and to collect evidence of legitimate and illegitimate interventions in software and configuration. Under point 1.2.1(f), the tracing log and the uploaded versions of safety software must be available to an authority on a reasoned request. The German text says “up to five years” (“bis zu fünf Jahre”), the English text says “five years”.

These duties fall on the manufacturer, and in a substantial retrofit that includes the person who modified the machine. For service technicians it follows that changing something in a safety controller will leave a trace. They should record version, date, reason and approval themselves before anyone asks, and set up remote access so that interventions are logged.

Article 18 attaches to the act, not to the contract. Whoever carries out a substantial modification is considered a manufacturer and takes on the duties in Article 10. Who that is does not appear in the Regulation: it can be the operator who rebuilds the machine, the service company hired to do it, or a third party. A contract clause alone does not change who actually carries out the modification.

The person who modifies the machine must declare conformity on their own responsibility and apply the appropriate conformity assessment procedure under Article 25. Add the technical documentation, EU declaration of conformity, CE marking and instructions for use. Under Article 10(3), the documentation and the declaration must be kept at the disposal of market surveillance authorities for at least ten years.

The contract between customer and contractor should therefore settle: who carries out and documents the test under Article 3(16), who becomes the manufacturer and declares conformity if the modification is substantial, who obtains software, circuit diagrams and the original manufacturer's documents, who keeps the files for ten years and who gives clearance before restart. Liability belongs there too, because anyone who substantially modifies a product without the manufacturer's consent is the manufacturer of the modified product under section 5 of the new German Product Liability Act.

Stricter rules apply to safety functions that learn. Annex I, Part A of the Machinery Regulation lists safety components and embedded systems with fully or partially self-evolving behavior that ensure safety functions. For these categories the manufacturer must choose, under Article 25(2), EU-type examination, full quality assurance or unit verification, and all three routes involve a notified body. Under Article 18 this applies to the person who modifies the machine as well. Anyone retrofitting a camera-based person detection with a learning component, for example, cannot avoid a notified body. A controller without machine learning does not fall into these categories.

Regulation (EU) 2026/1744 of July 2026 changed how this fits with the AI Act. It moves the Machinery Regulation to Section B of Annex I to the AI Act, so only a few provisions of the AI Act remain applicable to machinery. Requirements for AI as a safety component are to arrive instead through delegated acts amending Annex III of the Machinery Regulation, which are to apply by 2 August 2028 according to the English text (the German text says “ab”, from).

Until then the existing requirements remain, such as those in Annex III, point 1.2.1 for control systems with self-evolving behavior. AI in a safety function is not something to slip in with an interim update. It is a project with a notified body and its own risk assessment.