If you supply safety components, control systems, drives, sensors, or hydraulic parts to machine builders selling into the EU, expect a steady flow of documentation requests through late 2026 and 2027. Regulation (EU) 2023/1230, the EU Machinery Regulation, applies from 20 January 2027, and machine builders need supplier inputs to complete their own conformity work before that date.

This guide explains what a Machinery Regulation component supplier is legally obligated to provide, what is simply a customer request, and how to tell the two apart. It is written for suppliers sitting in the middle of a buyer’s compliance cycle, not for the machine builders assembling the final product.

If customer requests are already arriving faster than your team can answer them, a short compliance review can help you separate legal duties from contractual asks before the deadline.

Key Takeaways

📌 Regulation (EU) 2023/1230 applies from 20 January 2027 and replaces the Machinery Directive 2006/42/EC. No deferral has been adopted.
📄 Your documentation duties depend on classification: safety component, partly completed machinery, or ordinary part.
⚠️ Safety components listed in Annex II that are placed on the market separately need their own EU Declaration of Conformity and CE marking.
🔗 Partly completed machinery requires an EU Declaration of Incorporation, Annex IV Part B technical documentation, and Annex XI assembly instructions, not a CE mark.
🤖 Cybersecurity is now a safety requirement (Annex III §1.1.9 and §1.2.1). Control, drive, and sensor suppliers should expect evidence requests.
📊 RoHS declarations must cite the specific exemptions relied upon and track their expiry dates.
📌 Many requests are contractual, not legal. Scoping each one protects your margin and timelines.

Why machine builders are requesting documentation now

The Machinery Regulation applies in full from 20 January 2027, and there is no grace period for new placements. Machinery placed on the EU market on or after that date must meet Regulation (EU) 2023/1230 and reference it in its EU Declaration of Conformity. You can confirm the application date directly in the official text on EUR-Lex.

Builders cannot complete their conformity assessment, technical file, or declaration without current evidence from their supply base. That is why requests are landing in Q4 2026: the builder’s legal deadline cascades down to you as a customer request.

Two further pressures accelerate this. Notified Body capacity for the new high-risk categories is expected to tighten as 2027 approaches, so builders are starting early. And many are running gap analyses against the new essential health and safety requirements, which surfaces missing supplier data. For context on the sector, see Certivo’s industrial machinery and heavy equipment overview.

The practical point for suppliers: a request arriving now is often driven by the builder’s timeline, not by a new legal duty on you. Both matter, but they carry different obligations.

Are your products “safety components” under Annex II?

Classification decides almost everything about what you must issue. The Regulation treats several product types differently, and suppliers frequently misread which one applies to them.

Safety components placed on the market separately

A “safety component” is a component that fulfils a safety function, is placed on the market independently, and whose failure or malfunction endangers safety. Annex II of the Regulation sets out an indicative list, which now includes logic units ensuring safety functions and safety components with self-evolving behaviour using machine-learning approaches. The list is confirmed in the EUR-Lex text, Annex II.

Under the Regulation, a safety component sold on its own is a product in its own right. You, as its manufacturer, carry out the conformity assessment, draw up an EU Declaration of Conformity, and apply CE marking. The machine builder then incorporates your declared component.

Partly completed machinery

If you supply an assembly that performs no function on its own and is intended for incorporation (for example, a drive unit or a hydraulic power pack), it is likely partly completed machinery. This track does not carry a CE mark for machinery. Instead, Article 11 and Article 22 require you to draw up an EU Declaration of Incorporation, Annex IV Part B technical documentation, and Annex XI assembly instructions.

Ordinary components and parts

A sensor, fitting, or mechanical part that is neither a listed safety component nor partly completed machinery has no standalone machinery conformity obligation. What you provide (ratings, test data, a certificate of conformance) is usually a contractual input to the builder’s file.

Machinery Regulation component supplier classification: safety component, partly completed machinery, or part

Click on image to view full

Declarations and technical-file inputs machine builders actually need

Once classification is clear, the documents follow. The table below separates what the Regulation legally requires from what is a typical customer request. This distinction protects your engineering and quality teams from treating every ask as a statutory duty.

For control, drive, and safety-component suppliers, the most valuable inputs are the safety ratings and the standards applied. Builders need the performance level or safety integrity level, the relevant safety manual, and third-party certificates where they exist. A clear certificate of conformance reduces back-and-forth, and a structured supplier documentation workflow keeps versions aligned with each builder’s declaration.

Keep each declaration tied to the exact model and version supplied. Builders incorporating your product reference your declaration in their own file, so a mismatched revision creates a gap in their conformity chain.

Cybersecurity evidence under Annex III §1.1.9 and §1.2.1

The Regulation makes cybersecurity a machine safety requirement for the first time. Two essential health and safety requirements in Annex III drive this: §1.1.9, protection against corruption, and §1.2.1, safety and reliability of control systems. These are set out in the Annex III of Regulation (EU) 2023/1230.

Section 1.1.9 requires that safety-relevant software, data, and connectivity hardware be protected against accidental and intentional corruption, with evidence of legitimate and illegitimate intervention. Section 1.2.1 requires control systems to withstand reasonably foreseeable malicious attempts by third parties that could create a hazardous situation. The scope is safety, not corporate IT or data privacy.

If you supply control systems, safety controllers, drives, sensors with connectivity, or embedded software, builders will ask for cybersecurity evidence. Commonly requested inputs include secure-development evidence aligned to IEC 62443 (particularly 62443-4-1 for the process and 62443-4-2 for component security capabilities), a software bill of materials where software is involved, and your vulnerability-handling and secure-configuration documentation.

There is also an important interaction with the Cyber Resilience Act, Regulation (EU) 2024/2847. Its reporting obligations have applied since 11 September 2026, and its essential requirements and CE marking apply in full from 11 December 2027, per the CRA text on EUR-Lex. A product with digital elements that meets CRA essential requirements and declares so benefits from a presumption of conformity with Machinery Regulation Annex III §1.1.9 and §1.2.1, to the extent those requirements are covered.

Based on currently available regulatory guidance, a harmonised standard dedicated to these machinery cybersecurity requirements was still pending as of late 2026, with work underway on a European standard for protection against corruption. Treat CRA alignment and IEC 62443 evidence as the most credible bridge in the interim. Certivo’s analysis of why the CRA is not just a cyber law and why engineering and compliance must work together explain the overlap in practical terms, and the EU Cyber Resilience Act framework tracks the dates.

Machinery Regulation 2027 and CRA cybersecurity compliance timeline for component suppliers

Click on image to view full

RoHS and substance declarations that cite current exemptions

Electrical and electronic components supplied to machine builders remain in scope of the RoHS Directive 2011/65/EU. Builders need your substance evidence to support their own product compliance and customer audits. You can confirm the directive and its restricted substances in the RoHS text on EUR-Lex.

The common failure point is the exemption. Where a restricted substance is present under a permitted exemption (for example, specific lead applications in Annex III or Annex IV), your declaration should cite the exact exemption number relied upon, not simply state “RoHS compliant.” Exemptions carry expiry dates, and a declaration that references an expired exemption transfers risk straight to the builder.

Track the status of each exemption you depend on, and flag upcoming sunset dates to your customers. REACH substances of very high concern and SCIP notification obligations often travel alongside RoHS requests, so coordinate the two. Certivo’s materials and environmental compliance view and the RoHS framework page outline how substance evidence maps to product declarations. For restricted-substance scope and SVHC status, the ECHA portal is the authoritative reference.

What is engineering work versus documentation

Not every request costs the same to answer, and conflating the two erodes margin. Distinguishing documentation from engineering is one of the most useful things a supplier can do before 2027.

Documentation work means producing declarations, certificates, and evidence from design data you already hold. Updating a declaration template to reference 2023/1230, issuing a performance level certificate, or supplying an existing test report are documentation tasks.

Engineering work means changing the product to meet a requirement. Re-architecting a control system to satisfy §1.2.1, adding tamper-evidence logging to satisfy §1.1.9, or re-validating a safety function to a higher performance level are engineering tasks. They carry test, design, and timeline cost.

When a builder’s request implies a design change, say so early and scope it separately. This protects your delivery schedule and gives the builder an accurate view of their own readiness. Treating a design change as if it were paperwork is the fastest route to a missed 2027 commitment on both sides.

How component suppliers respond at scale

The volume of requests is the real challenge. A supplier serving dozens of machine builders, each with its own questionnaire, deadline, and template, cannot manage this through spreadsheets and email without errors and delays.

This is where a compliance system of record helps. Certivo acts as a centralized backbone for declarations, certificates, and substance data, so the right version of each document is tied to the right product and revision. Its supplier and customer workflows support faster, consistent responses to customer RFQs and keep your team audit-ready across frameworks rather than scrambling per request.

CORA, Certivo’s regulatory intelligence layer, supports horizon scanning for changes that affect your declarations, such as RoHS exemption expiries and the emergence of harmonised standards for the machinery cybersecurity requirements. AI-assisted document parsing and certificate validation reduce manual review when evidence arrives from your own sub-suppliers. The goal is not to eliminate compliance risk, which no software can do, but to reduce surprises, speed evidence retrieval, and keep your responses defensible. Explore how this works for supplier and contractor management, cybersecurity and digital compliance, and the broader Certivo platform.

If your documentation requests are outpacing your team ahead of the 20 January 2027 deadline, book a compliance risk assessment to map your obligations and response workload before the busiest period hits.