EU Machine Regulation 2027 Raises Cybersecurity and Risk Assessment Demands for Manufacturers

The EU Machine Regulation (EU) 2023/1230 becomes mandatory on 20 January 2027, establishing safety requirements for machines, their components and incomplete equipment. Industry experts highlight substantial uncertainty about how to meet the new rules, especially regarding cybersecurity, risk assessment, essential changes to machines, and harmonised standards.

Key technical issues include the draft EN 50742 standard for protection against corruption and the ongoing revision of EN 12100, the principal norm for risk assessment. The regulation introduces the concept of “essential change,” making operators responsible as manufacturers when they alter hardware or software, which triggers new conformity‑assessment procedures. Certain high‑risk product groups now require involvement of a Notified Body.

A new VDE publication offers practical guidance, checklists, templates and case studies to help manufacturers, operators and safety managers integrate the requirements of the regulation, the Cyber Resilience Act and related German technical rules such as TRBS 1115 Part 1.