Machinery Regulation vs. Machinery Directive: What changes for EU manufacturers by 2027?

The Machinery Regulation ((EU) 2023/1230) replaces the Machinery Directive (2006/42/EC) on 20 January 2027, applying directly and uniformly across all EU member states. It keeps roughly the same structure as the old directive but adds new requirements for cybersecurity, AI-based safety components, digital instructions and a restructured high-risk machinery list.

What is the Machinery Directive and who needs it?

The Machinery Directive is a European Union legislative framework designed to regulate the health and safety requirements for the design and construction of machinery. Its primary dual objectives are to ensure a high level of protection for worker and consumer safety while promoting the free movement and circulation of machinery within the EU internal market.

The requirements of the Machinery Directive apply to several key groups involved in the lifecycle and commercialisation of industrial equipment within the European Economic Area, such as manufacturers, importers, distributors, assemblers and modifiers.

Why the Machinery Directive needs replacing

The short answer: the Machinery Directive has governed machinery safety in the EU since 2009, but it was written before AI-driven systems and self-evolving software were part of everyday machine design. The Machinery Regulation was adopted specifically to close that gap.

The Machinery Regulation was published in the Official Journal on 29 June 2023, and entered into force on 19 July 2023. But it does not become mandatory until 20 January 2027, at which point the Machinery Directive is repealed and CE marking of machinery can only be carried out under the new regulation.

Machinery Regulation vs. Machinery Directive: The structural difference

	Machinery Directive	Machinery Regulation
National variation	Allows for national variation and discretion	Applies directly and uniformly across all EU member states
Scope	Applies to seven specific product categories: (1) complete machinery; (2) partly completed machinery; (3) interchangeable equipment; (4) safety components; (5) lifting accessories; (6) chains, ropes and webbing; (7) removable mechanical transmission devices.	Expands and modernises the scope, for the categories to include: digital safety components/ software performing a safety function; autonomous systems and AI-based technologies; and, interconnected and updatable machinery.
Essential health and safety requirements	Primarily physical/mechanical safety requirements.	Updates, expands and makes several requirements more specific, particularly for digital technologies, cybersecurity, AI, autonomous machinery and connected products.
High-risk machinery list	Lists 23 categories of high-risk machinery requiring special conformity assessment	Restructures the list into Part A and Part B, with different conformity-assessment requirements. Also adds new categories/ technologies to high-risk machinery including AI-enabled, autonomous and other newer technologies.
Instructions for use	Paper documentation required	Allows digital instructions; paper only if requested by buyer or for non-professional users. Also adds information requirements for software, connectivity, AI and autonomous machinery.
Cybersecurity	Not addressed	Cybersecurity is expressly linked to machinery safety
AI / self-evolving behaviour	Not addressed	New essential requirements, including ergonomics for human interactions with self-evolving systems.

What are the new requirements introduced by the machinery regulation?

The majority of substantive requirements, an estimated 90%, remain materially unchanged from the directive, which means this is best understood as a targeted modernisation of the existing framework rather than a wholesale rewrite of machinery safety law. The changes that have been introduced are concentrated in a specific, identifiable set of areas:

The changes concentrate in a specific set of areas:

Cybersecurity as an essential requirement: For the first time, manufacturers must factor cyber threats into the risk assessment. Machinery with digital or networked elements must demonstrate resilience against manipulation or cyberattack. Cybersecurity obligations scale with consequence: if no dangerous event can result from a cyber intrusion, the requirement does not apply in the same way, though the machine may still fall under the separate Cyber Resilience Act.
Safety components now include software: The definition of "safety component" is extended to cover software and digital elements essential to machinery safety. These components are subject to the same conformity assessment and CE marking obligations as physical safety components.
New provisions for AI and self-evolving behaviour: Machinery incorporating AI-based safety functions or self-learning behaviour must be designed so the AI system's operation stays within defined limits and does not behave unpredictably. Ergonomics requirements now explicitly cover how operators interact with machinery that has fully or partially self-evolving behaviour.
Digital instructions by default: Instructions for use may now be provided digitally rather than on paper, except where a professional buyer requests paper at the point of purchase, or where the machinery is intended for non-professional/consumer use.
A formal definition of "substantial modification.": The Machinery Regulation defines, for the first time in the regulation itself, when a physical or digital modification is significant enough to transfer manufacturer responsibility (including CE marking and liability) to whoever made the change.A substantial modification occurs when a machine is physically or digitally altered (such as through a major software change or safety-system overhaul) in a way that introduces new hazards or increases existing risks, potentially requiring a brand-new CE conformity assessment.
A restructured high-risk machinery list: The list of machinery categories considered high-risk has been reorganised into two tiers: one where a notified third-party body must formally assess the machinery before it can be placed on the market, and one where the manufacturer can self-certify as long as it follows the relevant harmonised standards. Some products that previously sat in a grey area are now explicitly in scope, and some products face third-party assessment for the first time.
Expanded conformity assessment and stronger market surveillance: The documentation manufacturers must keep on file, the declarations they issue when supplying machinery or components meant to be built into other machinery, and the assessment procedures used to verify compliance before a CE mark is applied are all more detailed and more tightly defined than under the directive. Market surveillance authorities also get clearer grounds to request evidence and act on gaps, rather than relying on the more general enforcement powers under the old regime.

How the Machinery Regulation Handles AI in Machinery

The regulation is often shorthanded online as "the EU's AI rules for machines," and that description overstates it. It does not regulate AI as such, and it does not pull every analytics dashboard, predictive-maintenance model or general software update into CE marking. The actual trigger is narrower and more technical: does software, data, connectivity, a remote update, or self-changing behaviour affect a safety function in a way that could put a person in a hazardous situation? If the answer is no, the system stays outside this framework, even if it's marketed as "AI." If the answer is yes, machinery safety law applies, whether or not anyone calls it AI.

Where that trigger is met, two categories are pulled directly into mandatory third-party assessment by a notified body, with no self-certification option available:

Safety components with fully or partially self-evolving behaviour using machine learning that ensure a safety function, for example, a vision system that decides whether it's safe to keep a robotic arm moving
Machinery with embedded systems of the same kind, in respect of those specific systems, even where the machinery as a whole was not previously classified as high-risk

For these systems, the regulation adds obligations that go beyond a standard risk assessment:

The system's intended behaviour, its operating limits and its level of autonomy must be explicitly declared in documentation
The system must be designed so it cannot cause the machinery to act beyond a defined task and movement boundary, even as it evolves or is retrained.
Risk assessment becomes an ongoing exercise rather than a one-off design-phase exercise: manufacturers must document safety proofs for plausible future operational states
Retraining or updating a model in a way that changes machine behaviour can itself qualify as a substantial modification, which can shift manufacturer responsibility, including CE marking, onto whoever performed that update.

One practical nuance worth flagging: some legal commentary reads the "self-evolving" language broadly enough to cover models that are frozen before deployment, on the basis that a model trained on data could in principle be retrained later, even if it isn't in practice. That reading isn't universally settled, but it's a reason not to assume a "static" AI model is automatically out of scope just because it doesn't update itself in the field. Finally, this framework sits alongside, not instead of, the EU AI Act. Machinery with AI-driven safety components can be in scope of both laws at once — the Machinery Regulation governing the safety-component conformity assessment, and the AI Act governing the AI system's own risk classification and obligations where it qualifies as high-risk. Manufacturers integrating AI into safety-relevant machine functions should expect to map both frameworks against the same product, not treat one as a substitute for the other.

New Compliance Obligations for Manufacturers and Cross-border Importers

As global supply chains feed machinery components into Europe, importers and manufacturers face heightened operational responsibilities:

High-Risk Equipment Categories: The updated framework revises classifications for high-risk machinery, expanding the scope of devices that require mandatory involvement from third-party Notified Bodies during conformity assessments.
Software Version Control and Safety Logs: Systems utilizing continuous learning or smart software updates must maintain verifiable safety logs, proving that safety performance remains uncompromised throughout the lifecycle of the machinery.
Strict Economic Operator Liabilities: Importers placing machinery on the EU market under their own brand assume full manufacturer-level legal accountability, demanding absolute transparency from international tier-1 and tier-2 vendors.

Do existing certificates under the Machinery Directive remain valid?

This matters directly for the high-risk classification changes described above: since some machinery is moving into a stricter assessment tier for the first time, manufacturers need to know whether they have to redo certification work they've already paid for and completed. The transition rules give a clear answer. Machinery already placed on the market in conformity with the directive before 20 January 2027 can continue to be made available afterwards without being pulled back for re-assessment.

Under the directive, high-risk machinery that required third-party assessment received an EC type-examination certificate. A document issued by a notified body confirming that a specific machinery type had been examined against a representative sample or technical file and met the essential health and safety requirements. Existing EC type-examination certificates remain valid until they expire, so manufacturers are not forced to restart certification the moment the regulation takes effect.

Going forward, the regulation replaces this with the EU type-examination certificate. The same underlying concept and the same role in the conformity assessment process, but issued under the regulation's own module-based assessment procedures and aligned with the naming convention used across other EU product legislation (mirroring the shift from "EC" to "EU" terminology seen in areas like medical devices regulation). In practice, once a manufacturer needs a new or renewed certificate for high-risk machinery, it will be an EU type-examination certificate rather than an EC one, issued against the restructured high-risk categories rather than the old Annex IV list.

How Artem simplifies compliance across global supply chains

Artem acts as the central compliance orchestration platform for global industrial networks:

Automated Technical File Ingestion: Artem’s platform directly collects risk assessments, software validation files, and conformity declarations from international suppliers, verifying them against EU standards.
Cross-Border Component Traceability: The system maps multi-tier industrial supply chains, verifying that sub-assemblies, hardware components, and safety-critical software meet regulatory thresholds prior to EU port arrival.
Digital Documentation and Modification Tracking: Artem centralizes digital manuals, version control histories, and audit trails while monitoring modifications that could trigger a re-assessment.
Unified Decision-Maker Dashboards: Industrial operators and compliance teams use Artem to maintain a continuous, audit-ready compliance posture across global manufacturing operations.

Key takeaways

The Machinery Directive 2006/42/EC applies until 20 January 2027, when it is fully repealed, there is no parallel-application period
The Machinery Regulation (EU) 2023/1230 is directly binding across all 27 EU member states, removing the national transposition variation that existed under the directive
Roughly 90% of substantive requirements carry over unchanged
The main new areas are cybersecurity, software as a safety component, AI/self-evolving machinery, and digital instructions by default
Annex references shift: essential requirements move from Annex I to Annex III; the high-risk machinery list moves from Annex IV to a restructured Annex I (Part A / Part B)
Manufacturers can voluntarily comply with the new regulation ahead of 2027, and existing certificates remain valid until they expire
Given 12–24 month compliance lead times for complex machinery, technical file reviews should start well before the 2027 deadline
ArtemLEX supports this transition through guided annex re-mapping and structured risk assessment, with every output reviewed by our team before it's relied on

Conclusion

The shift from the Machinery Directive to the Machinery Regulation is best understood as an update, not an overhaul, most of what manufacturers already do to achieve CE marking stays the same. What changes is where new categories of risk, particularly cybersecurity and AI-driven behaviour, now sit inside a framework that used to only cover mechanical and electrical hazards. With no transition period once 20 January 2027 arrives, and with high-risk classification and annex structures shifting in ways that affect documentation across the board, manufacturers are better served treating this as a project with a fixed lead time than as a routine annual compliance update. ArtemLEX's role in this transition is to make that project manageable: guiding technical file re-mapping across a full product portfolio, structuring risk assessments so cybersecurity and AI-related requirements are properly addressed, and keeping human compliance review at the centre of every decision rather than treating any part of it as automatic. Starting that work now is what turns this from a last-minute scramble into a manageable transition.