EU Machinery Regulation 2027: Connecting Functional Safety and Cybersecurity
Machinery is becoming increasingly digital and connected. This creates new opportunities, but also new safety risks. With the EU Machinery Regulation (EU) 2023/1230, the EU is responding to this change. The Regulation sets out the safety requirements machinery must meet before it can be made available on the European market or put into service for the first time. From 20 January 2027, it replaces the existing Machinery Directive 2006/42/EC and applies directly in all EU Member States.
For manufacturers, this means reviewing existing safety concepts, identifying potential vulnerabilities and closing any gaps. As technical foundations such as standards are revised and new requirements are clarified, the deadline continues to approach. This makes it a good time to take stock: Where do we currently stand on functional safety, cybersecurity and harmonised standards? And what should OEMs and technology suppliers already be considering?
Automatically Successful
The MOBA Tech Podcast
1. Standards in Transition: Adapting the Technical Framework
The European Commission, the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) are working on an extensive standardisation programme to support the new Machinery Regulation.
The main priorities include:
- Reviewing existing harmonised standards against the new essential health and safety requirements.
- Identifying regulatory and technical gaps.
- Developing requirements for safety-related cybersecurity.
- Addressing emerging technologies, including AI-enabled safety functions.
- Maintaining continuity for existing machinery standards wherever technically and legally appropriate.
The challenge is substantial: hundreds of existing standards need to be assessed, transferred or revised. At the same time, established standards should remain usable wherever technically and legally appropriate.
2. Considering Functional Safety and Cybersecurity Together
For machinery manufacturers, compliance with standards such as EN ISO 13849-1 or IEC 62061 remains essential. When assessing digital risks, however, they must also consider whether cyber threats could compromise a machine’s safety functions.
The new Machinery Regulation explicitly addresses this connection. Particularly relevant are the requirements in Annex III, Section 1.1.9 on protection against corruption and Section 1.2.1 on the safety and reliability of control systems. These include protection against changes to software, data or hardware that could lead to hazardous situations.
A technical gap analysis is therefore a useful starting point for manufacturers. It shows which requirements are already covered and where action is needed. Particular attention should be given to the following questions:
- Software and firmware: How is safety-related software protected against unauthorised changes?
- Parameters: How are unauthorised changes to safety-related settings prevented?
- Remote access and diagnostics: How are access points to the machine secured?
- Software versions: Can versions and changes be clearly traced?
- Interfaces and communication: Which digital interventions could cause hazardous situations?
- Evidence: How are changes and interventions involving safety-related software documented?
3. Cybersecurity: EN 50742 and the Work of CENELEC
How can protection against digital interference be implemented technically? This is the question addressed by the prEN 50742 standardisation project on protection against corruption, being developed within the CENELEC TC 44X technical committee. The draft addresses the relationship between cyber threats and machinery safety, particularly the requirements of Annex III, Sections 1.1.9 and 1.2.1.
It is intended to provide manufacturers with a structured basis for assessing these risks and identifying protective measures. One important distinction remains: a draft standard does not establish a presumption of conformity. This requires publication of the reference to the relevant harmonised standard in the Official Journal of the European Union. The presumption of conformity then applies to the requirements covered by that standard.
4. Harmonised Standards: The Transition Is Not Yet Complete
Alongside the development of new standards, transferring existing harmonised standards to the legal framework of the Machinery Regulation plays an important role. The European Commission is preparing the necessary framework for this.
Nevertheless, manufacturers must distinguish between:
- Standards currently harmonised under Directive 2006/42/EC.
- Standards intended to be carried over to the new Regulation (EU) 2023/1230.
- Standards undergoing revision or development.
- Standards whose references have been officially published under the new Regulation.
This distinction helps manufacturers assess the relevance of existing evidence. An existing standard does not automatically cover all new requirements, particularly in the area of safety-related cybersecurity. Manufacturers should therefore check which requirements are addressed by the standards they use and where additional assessments are needed.
5. The Cyber Resilience Act: An Additional Legal Framework for Digital Products
The Machinery Regulation is not the only legal framework that needs to be considered for connected machinery and components. The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces additional cybersecurity requirements for products with digital elements.
For manufacturers of electronic control units, programmable controllers, sensors, gateways and connected machinery systems, understanding the interaction between the two regulations is therefore becoming increasingly important.
The Machinery Regulation and the CRA have different scopes and application timelines. Companies must therefore determine which requirements apply to their respective products and how these can be addressed together.
What Should OEMs and Technology Suppliers Do Now?
For the cranes and lifting equipment sectors, as well as mobile off-highway machinery, the priority should now be clear: start the technical gap analysis rather than waiting for the final harmonised standards. Manufacturers should review their safety architectures, software lifecycle processes, remote connectivity, cybersecurity controls and technical documentation.
The key question goes beyond the machine’s functional safety: can the machine remain safe when its digital control environment is exposed to foreseeable cyber threats?
The next generation of machinery compliance will require much closer integration of functional safety, cybersecurity and systems engineering. January 2027 is not the beginning of this transition. It is the deadline for completing the preparations.