From 20 January 2027, the EU Machinery Regulation (Regulation (EU) 2023/1230) will replace the Machinery Directive 2006/42/EC. For the first time, cybersecurity is included amongst the essential health and safety requirements – and is therefore a prerequisite for CE marking. There is no general transition period: the date of placing on the market is decisive.
Swiss companies are also affected. Anyone placing machinery or related products on the EU market must comply with the new requirements – regardless of where the company is based. In parallel, the completely revised Swiss Machinery Ordinance (MaschV) is set to adopt the EU requirements on an equivalent basis and come into force at the same time. Swiss Infosec AG combines cyber security with sound legal advice – precisely the combination required for the implementation of the Machinery Ordinance. We support you from the initial impact assessment right through to demonstrable compliance.
Would you like us to assist you with your specific project relating to the Machinery Regulation? Click this button to go directly to the no-obligation enquiry form. Simply describe your request and submit the form.
The key deadlines
19 July 2023
Already in force – since 19 July 2023 and 20 January 2024 respectively
The Regulation has been in force since 19 July 2023. The provisions relating to conformity assessment bodies have been in force since 20 January 2024. Switzerland has partially revised its Machinery Ordinance to take effect on the same date, so that recognised Swiss conformity assessment bodies can obtain accreditation under the new EU Regulation at an early stage.
20 January 2027
The crucial deadline
From that date, Regulation (EU) 2023/1230 will apply in full and will replace the Machinery Directive 2006/42/EC. There is no general transition period: machinery placed on the market from that date must comply with the new requirements. At the same time, the completely revised Swiss Machinery Ordinance is due to come into force. EU type-examination certificates that have already been issued remain valid until their expiry date.
11. Dezember 2027
Cyber Resilience Act
The Cyber Resilience Act will come into full effect. The obligation to report actively exploited vulnerabilities has been in force since 11 September 2026. Anyone manufacturing machinery with digital components must take both sets of regulations into account – otherwise, this will result in double the processes and costs.
Who is affected? Does the Machinery Regulation apply to your business?
The Machinery Regulation applies to machinery and related products placed on the EU market or put into service – regardless of the manufacturer’s place of business. It also covers partly completed machinery, safety components, load-handling attachments, as well as chains, ropes and straps.
01 – Manufacturers of machinery and safety components
Mechanical and plant engineering, component manufacturers, robotics, intralogistics and medical technology involving machinery. Anyone manufacturing networked, remotely maintainable or AI-supported machinery must demonstrate security as part of their compliance. For the categories set out in Annex I, Part A of the MR, it is also mandatory to involve a notified body.
02 – Importers, distributors and authorised representatives
With the alignment with the EU’s New Legislative Framework (Decision No 768/2008/EC) – which was still pending under the Machinery Directive 2006/42/EC – importers and distributors are now also subject to specific testing, reporting and documentation obligations. Manufacturers without an establishment in the EU must also appoint an economic operator established in the EU in accordance with Article 4 of the Market Surveillance Regulation (EU) 2019/1020; in practice, this means the EU importer, a representative authorised in writing (authorised representative) or a fulfilment service provider, whose name and contact details must be indicated on the machinery or its packaging. For Swiss manufacturers, this applies until the Machinery chapter of the MRA has been updated to reflect the new Regulation.
03 – Operators, conversions and retrofits
The Regulation explicitly defines the term ‘substantial change’ for the first time. Anyone who modifies, retrofits, networks or installs new software on an existing machine may, in legal terms, become the manufacturer themselves – with all the associated obligations, including a new conformity assessment.
The specific changes
- Cybersecurity as a CE requirement: Annex III, section 1.1.9 of the MR ‘Protection against corruption’ stipulates that neither the connection of other devices nor remote access must lead to hazardous situations. Safety-critical hardware, software and data must be protected against unintentional and deliberate corruption; any intervention in safety-critical software must be recorded in a traceable manner.
- Robust control systems: According to section 1.2.1, control systems must also be capable of withstanding reasonably foreseeable malicious attempts by third parties.
- Artificial intelligence and self-adaptive behaviour in safety functions are explicitly addressed for the first time.
- New structure: The list of machinery with increased risk potential is now set out in Annex I, divided into Part A and Part B, with different conformity assessment procedures.
- Digital instruction manuals and digital EU declarations of conformity are now permitted, with clear requirements regarding their availability. Extended post-market obligations: product monitoring, corrective actions and notifications to the authorities; technical documentation and the EU declaration of conformity must be retained for at least ten years.
This shifts the focus of machine compliance from being purely a safety issue to one of both safety and security. We work precisely at this interface.
Our services – from impact assessment to demonstrable compliance
We support you every step of the way: from the initial assessment of whether and how the MR applies to you, through to technical implementation, and on to full documentation and preparation for the conformity assessment.
1. MR impact assessment and gap analysis
We will review your product portfolio, determine which products fall within the scope of the Regulation and which conformity assessment procedure applies, and highlight any gaps in relation to the new security requirements. The result will be a concrete action plan setting out priorities and deadlines, aligned with the deadline of 20 January 2027.
- Classification of products, including Annex I, Parts A and B
- Gap analysis of Annex III, sections 1.1.9 and 1.2.1, and alignment with the Cyber Resilience Act
- Roadmap with prioritised measures by 20 January 2027
2. Security engineering: Implementing protection against corruption
We expand your existing machine risk assessment to include the security aspect and translate the general requirements of the Regulation into specific technical measures.
- Threat and risk analysis as a complement to risk assessment
- Hardening of control systems, interfaces and remote access, authentication and authorisation concepts
- Secure development processes and component requirements in accordance with IEC 62443-4-1 and 62443-4-2, aligned with prEN 50742
3. Technical documentation and record-keeping
The proof of cyber security is provided in the technical documentation and forms part of the standard conformity assessment. We prepare or review the necessary documentation.
- Cybersecurity section of the technical documentation
- Concepts for recording and tracking changes to security-critical software
- Vulnerability and update management throughout the product lifecycle
4. Legal classification and contract drafting
This is where the combination of law and technology really comes into its own. We integrate the Machinery Regulation into your overall regulatory framework and contractually secure your obligations.
- The interplay between the Machinery Regulation, the Cyber Resilience Act, NIS2, the AI Act and product liability
- Obligations of economic operators, authorisation and the scenario without an updated MRA
- Security obligations in supplier and procurement contracts
5. Operators, modification and retrofitting
Modernisation, networking and retrofitting are legally tricky matters. We clarify in advance whether a change constitutes a material alteration – and what the implications are.
- Assessment of ‘substantial change’ on a case-by-case basis
- Clarification of the manufacturer’s role in retrofitting, networking and software updates
- Procedure for linked systems and phased modernisation
6. Awareness, training and ongoing support
Compliance is not a one-off project. We train your teams and support you well beyond the deadline.
- Training courses and workshops for development, product management, legal and quality management
- External Product Security Officer and the establishment of lean PSIRT structures
- Ongoing monitoring of standards and regulations
EU Machinery Regulation – the key questions
When does the EU Machinery Regulation come into force – and is there a transition period?
Regulation (EU) 2023/1230 has been in force since 19 July 2023 and will apply in full from 20 January 2027. There is no general transition period, and the Machinery Directive and the Machinery Regulation may not be applied selectively. The date of placing on the market is decisive: the Machinery Directive 2006/42/EC applies until 19 January 2027, and the Regulation applies from 20 January 2027. EC type-examination certificates that have already been issued remain valid until their expiry date.
Does the EU Machinery Regulation also apply to Swiss companies?
Yes, as soon as you place machinery or related products on the EU market – regardless of where your company is based. This applies not only to manufacturers but also to importers, distributors and authorised representatives. Manufacturers without an establishment in the EU also require an economic operator established in the EU (an EU importer, authorised representative or fulfilment service provider) to fulfil the obligations under Article 4 of the Market Surveillance Regulation (EU) 2019/1020; this operator must be indicated on the product. Within Switzerland, the previous Machinery Ordinance (MaschV, SR 819.14), which is based on the Machinery Directive 2006/42/EC, is currently still in force. It is undergoing a complete revision and is intended to transpose the requirements of the EU Regulation into Swiss law in an equivalent manner. It is scheduled to come into force at the same time as the EU Regulation on 20 January 2027; the formal decision is still pending.
What changes will the complete revision of the MaschV bring about in Switzerland?
The Swiss Machinery Ordinance is undergoing a complete revision and will incorporate the EU requirements on an equivalent basis, including those relating to cyber security and machine learning. The consultation period ran from 19 September 2025 to 19 December 2025. The aim is for the Ordinance to come into force at the same time as in the EU, on 20 January 2027; the formal decision is still pending.
What does the MRA mean for Swiss exporters?
The simplified market access is based on the Agreement between Switzerland and the EU on the Mutual Recognition of Conformity Assessments (MRA). The chapter on machinery needs to be updated; this forms part of the Switzerland–EU package. Without a timely update, Swiss manufacturers will have to appoint an economic operator based in the EU (an EU importer, authorised representative or fulfilment service provider) and obtain certification from bodies based in the EU. This makes exporting significantly more expensive and is a risk factor in its own right that needs to be taken into account in planning.
What exactly does ‘protection against corruption’ entail?
Annex III, section 1.1.9, requires that neither the connection of another device nor remote access should lead to a hazardous situation. Safety-critical hardware, software and data must be identified and adequately protected against unintentional and deliberate corruption; any modifications to this software must be recorded in a traceable manner. In addition, section 1.2.1 requires control systems to withstand even reasonably foreseeable malicious attempts by third parties. Evidence of this must be provided in the technical documentation and forms part of the regular conformity assessment.
Is a notified body absolutely essential for cybersecurity?
No, there is no blanket requirement for third-party verification based solely on cybersecurity requirements. For most machines, self-assessment based on an internal risk assessment remains an option. A notified body must be involved for certain categories listed in Annex I, Part A – regardless of whether the issue concerns safety or security.
Which standards help with implementation?
With prEN 50742 ‘Safety of machinery – Protection against corruption’, CENELEC is developing a dedicated standard that specifies the requirements set out in Annex III, sections 1.1.9 and 1.2.1. The draft underwent public consultation in early 2026; publication is scheduled for late 2026. Until the standard is finalised and listed in the Official Journal of the EU, it does not confer a presumption of conformity. In addition, the IEC 62443 series of standards serves as a technical guide, in particular 62443-4-1 for secure development processes and 62443-4-2 for component requirements.
How does the Machinery Regulation relate to the Cyber Resilience Act and the AI Act?
The regulatory frameworks overlap, but do not replace one another. The Machinery Regulation addresses machine safety and makes security part of safety. The Cyber Resilience Act regulates the cyber security of products containing digital elements throughout their entire life cycle, including software bills of materials and reporting obligations; its reporting obligations have applied since 11 September 2026, with full implementation following on 11 December 2027. The AI Act sets out requirements for AI systems. In practice, risk analysis, documentation and vulnerability management can be developed jointly – this saves effort and prevents contradictory evidence.
Will the deadline of 20 January 2027 be postponed?
Several European industry associations have asked the European Commission to align the cybersecurity requirements of the Machinery Regulation with the Cyber Resilience Act. As things stand, this is a request, not a confirmed change. You should therefore plan on the current implementation date. Anyone who waits for a postponement will miss out on the development cycles required for ‘security by design’.
We are operators, not manufacturers. Does the regulation still apply to us?
Yes. If you modify, retrofit or network an existing machine, or make significant changes to its software, this may constitute a ‘substantial change’. Legally, this means you may become the manufacturer yourself – with the corresponding obligations, including the need for a new conformity assessment. It is particularly worth clarifying this before starting the project, especially in the case of interlinked systems.
What role does data protection play?
The Machinery Regulation itself governs cybersecurity in the context of machinery safety and does not contain any standalone data protection requirements. However, as soon as a machine processes personal data – for example, via access and operating logs, camera systems, access control solutions or telemetry from remote maintenance and predictive maintenance – the Swiss Data Protection Act and the GDPR also apply. We assess both aspects together to ensure that security measures do not fail due to data protection requirements, and vice versa.
Why Swiss Infosec AG? Your benefits at a glance
- Legal and technical expertise from a single source – the combination required by the Machinery Regulation
- Over 35 years’ experience in information security
- A Swiss perspective: assessing the Machinery Regulation, the Mutual Recognition Agreement (MRA) and EU law in context
- Experience from projects relating to the Cyber Resilience Act, NIS2 and AI governance – you avoid duplication of effort
- Flexible collaboration: from an ad hoc second opinion to an external Product Security Officer
- Offices in Sursee, Zurich, Bern and Berlin
Ready for the MR impact assessment?
During a free initial consultation, we will identify which of your products are affected, which deadlines are a priority for you, and what an efficient implementation would look like.