Product Safety & Market Access Certifications
Mandatory application date, no transition period
Regulation that repeals Directive 2006/42/EC
Categories that always require a notified body
Regulation Overview
The EU Machinery Regulation 2023/1230 sets the essential health and safety requirements for machinery, related products, safety components, and partly completed machinery placed on the EU market. It repeals Directive 2006/42/EC and, as a regulation, applies directly in all Member States without national transposition.
From 20 January 2027 it becomes the only basis for placing machinery on the market, with no transition period. It expands the categories that require a notified body, treats cybersecurity of safety functions as a safety requirement, addresses safety components with self-evolving machine-learning behaviour, and permits digital instructions for use.
Conformity remains the manufacturer's responsibility. The technical documentation and the EU declaration of conformity depend on current supplier evidence: component declarations, substance data, and cybersecurity documentation. When obligations or standards change, that evidence has to be refreshed.
Manufacturers of machinery, related products, and partly completed machinery placed on the EU market
Importers placing machinery from outside the EU on the market
Distributors making machinery available on the EU market
Authorised representatives acting for non-EU manufacturers
Suppliers of safety components, including software-based safety components
Machine builders integrating components, controllers, or embedded software into finished machinery
Key Thresholds
20 January 2027 is a hard date. Machinery placed the day before follows the Directive; machinery placed the day after must meet the Regulation, reference 2023/1230 on the declaration, and carry a complete technical file. There is no phase-in. Supplier evidence collected for the Directive often does not cover the Regulation's expanded cybersecurity and documentation requirements, and a centralized compliance data backbone makes the gap visible early.
Annex I Part A always requires a notified body, and Part B requires one unless harmonised standards are applied in full. Notified-body capacity is expected to tighten before 2027, as it did under the Medical Device Regulation. Machine builders need component and supplier evidence complete before booking assessment, which depends on multi-tier supply chain transparency into who supplies each safety-relevant part.
For the first time, Annex III treats protection of control systems and safety functions against corruption as a safety requirement. Component suppliers are being asked for cybersecurity evidence such as IEC 62443 documentation and software bills of materials. An industry request to defer these provisions to December 2027, to align with the Cyber Resilience Act, has not been adopted, so regulatory intelligence and horizon scanning matters here.
Safety components with fully or partially self-evolving machine-learning behaviour, and the machinery that embeds them, fall under Annex I Part A and require third-party assessment. Self-declaration is no longer available for those categories. AI-specific requirements are to be written into the Regulation by a delegated act due 2 August 2028, leaving a gap that machine builders must plan around.
Certivo In Action
Certivo in Action — Machinery Regulation Workflow
Features Tabs
From Chasing to Validated Evidence
CORA's Liaison collects and Examiner validates supplier evidence, so your team manages exceptions instead of compiling the technical file by hand through AI-native compliance automation.
Technical-File Evidence on Demand
Registrar assembles component declarations, cybersecurity evidence, and an audit trail into an audit-ready record for market surveillance authorities and customers.
Evidence That Stays Current
Scout watches for harmonised-standards lists, the cybersecurity deferral decision, and the delegated act, then reopens the affected evidence before it goes stale.
Frequently Asked Questions
When does the EU Machinery Regulation 2023/1230 apply, and is there a transition period?
Regulation (EU) 2023/1230 applies from 20 January 2027, when it repeals Directive 2006/42/EC. There is no transition period after that date. The application date was corrected from 14 January 2027 to 20 January 2027 by a corrigendum published in Official Journal L 169 on 4 July 2023.
Does machinery already on the market need re-certification?
No. Machinery lawfully placed on the market before 20 January 2027 under the Machinery Directive stays lawful and can continue to be made available. Machinery placed on the market from that date must conform to the Regulation and carry a declaration of conformity that references 2023/1230.
Which machines need a notified body?
Machinery and safety components in Annex I Part A always require a notified body. Annex I Part B requires one unless harmonised standards or common specifications are applied in full. Safety components with self-evolving machine-learning behaviour also require third-party assessment. Certivo helps assemble the supplier evidence these routes depend on.
Has the Machinery Regulation cybersecurity deadline been postponed?
Not as of this page's verified date. An industry coalition asked the Commission in January 2026 to defer the cybersecurity provisions in Annex III to 11 December 2027, to align with the Cyber Resilience Act. That request has not been adopted, so the provisions apply from 20 January 2027. CORA's Scout monitors this decision.
How does the Machinery Regulation overlap with the Cyber Resilience Act?
A machine that is also a product with digital elements must meet the Machinery Regulation's safety requirements and the CRA's cybersecurity requirements. The CRA applies in full from 11 December 2027, with reporting obligations from 11 September 2026. Certivo collects one cybersecurity evidence set that supports both frameworks.