Does a machine need to meet both the Machinery Regulation and the Cyber Resilience Act?
Yes. A machine that is also a product with digital elements must meet Regulation (EU) 2023/1230 on machinery from 20 January 2027 and Regulation (EU) 2024/2847, the Cyber Resilience Act, from 11 December 2027, under one EU declaration of conformity.
Key takeaways
- Regulation (EU) 2023/1230 on machinery applies from 20 January 2027 and replaces Directive 2006/42/EC. Machinery placed on the market under the directive before that date can stay on the market (Article 52(1)).
- Two essential health and safety requirements of the Machinery Regulation cover cybersecurity. Annex III, section 1.1.9 requires protection against corruption, and section 1.2.1 requires control systems that withstand reasonably foreseeable malicious attempts.
- Compliance with the Cyber Resilience Act gives no presumption of conformity with sections 1.1.9 and 1.2.1. CRA recital 53 leaves the manufacturer to demonstrate the overlap.
- A certificate or statement of conformity under a cybersecurity certification scheme of Regulation (EU) 2019/881, whose references are published in the Official Journal, gives a presumption of conformity with sections 1.1.9 and 1.2.1 for the requirements it covers (Machinery Regulation Article 20(9)).
- The Cyber Resilience Act lists no machinery category in Annex III or Annex IV, so most machines are default-class CRA products, while some machinery categories need a notified body under Machinery Regulation Article 25.
When do the Machinery Regulation and the CRA apply?
The Machinery Regulation applies in full from 20 January 2027 (Article 54). The Cyber Resilience Act applies in full from 11 December 2027, and its Article 14 reporting obligations apply from 11 September 2026 (CRA Article 71(2)).
| Date | Act | What applies |
|---|---|---|
| 19 July 2023 | Machinery Regulation | Enters into force. Article 6(7) and Articles 48 and 52 apply. |
| 20 January 2024 | Machinery Regulation | Articles 26 to 42 on notified bodies apply. |
| 20 July 2024 | Machinery Regulation | Article 6(2) to (6), (8) and (11), Article 47 and Article 53(3) apply. |
| 11 June 2026 | Cyber Resilience Act | Chapter IV on notified bodies (Articles 35 to 51) applies. |
| 11 September 2026 | Cyber Resilience Act | Article 14 reporting applies, also to products placed on the market earlier (Article 69(3)). |
| 20 October 2026 | Machinery Regulation | Article 50(1) on penalties applies. |
| 20 January 2027 | Machinery Regulation | Applies in full. Directive 2006/42/EC is repealed (Article 51(2)). |
| 11 December 2027 | Cyber Resilience Act | Applies in full (Article 71(2)). |
| 11 June 2028 | Cyber Resilience Act | Cybersecurity certificates issued under other Union harmonisation legislation stop counting for the CRA, unless they expire earlier (Article 69(1)). |
The first Official Journal text of 29 June 2023 gave 14 January 2027. A corrigendum in OJ L 169 of 4 July 2023 changed it to 20 January 2027, together with every other date that depends on the publication date.
Which Machinery Regulation requirements cover cybersecurity?
Annex III, section 1.1.9 on protection against corruption and section 1.2.1 on the safety and reliability of control systems. Both protect the safety of persons, so they treat a cyberattack as a cause of a hazardous situation.
| Topic | Section | What the machine must do |
|---|---|---|
| Connected devices | 1.1.9 | The connection of another device, directly or through a remote device, does not lead to a hazardous situation. |
| Hardware | 1.1.9 | A hardware component that transmits signals or data relevant for access to safety-critical software is adequately protected against accidental or intentional corruption. The machine collects evidence of legitimate or illegitimate intervention in that component. |
| Software and data | 1.1.9 | Software and data critical for compliance are identified and adequately protected against accidental or intentional corruption. The machine identifies the software it needs to operate safely and can provide that information at all times. |
| Evidence of change | 1.1.9 | The machine collects evidence of legitimate or illegitimate intervention in its software, of a modification of that software, and of a change to its configuration. |
| Malicious attempts | 1.2.1(a) | Control systems withstand reasonably foreseeable malicious attempts from third parties leading to a hazardous situation. |
| Tracing log | 1.2.1(f) | A tracing log of interventions and of the safety software versions uploaded after placing on the market is enabled for five years after each upload. |
| Self-evolving behaviour | 1.2.1 | Machinery with fully or partially self-evolving behaviour records data on safety-related decisions and keeps it for one year, and stays within its defined task and movement space. |
The logs of section 1.2.1 serve only to demonstrate conformity after a reasoned request from a competent national authority. Article 10(3) also lets that authority ask for the source code or the programming logic in the technical documentation, where it needs them to check compliance.
Does CRA compliance count toward the Machinery Regulation?
Only where the manufacturer demonstrates it. CRA recital 53 states that compliance with the CRA could facilitate compliance with sections 1.1.9 and 1.2.1, and that the manufacturer has to demonstrate those synergies, for example by applying harmonised standards after a risk assessment that covers those risks.
The Commission CRA FAQs, version 1.4 of 4 September 2026, take the same position. Compliance with one act does not automatically satisfy the other, and conformity is assessed under each act separately. One cybersecurity risk assessment can serve both acts, as long as compliance with each can be demonstrated.
Two routes do carry formal weight. A certificate or statement of conformity under a cybersecurity certification scheme of Regulation (EU) 2019/881, whose references are published in the Official Journal, gives a presumption of conformity with sections 1.1.9 and 1.2.1, for the requirements the certificate or statement covers (Machinery Regulation Article 20(9)). In the other direction, an EU type-examination certificate issued for cybersecurity requirements under the Machinery Regulation counts for the CRA until 11 June 2028, for the risks it covers (CRA Article 69(1)).
Commission guidance C(2026) 5252, points 248 to 250, limits that CRA validity to the cybersecurity risks of the legislation the certificate was issued under. Vulnerability handling, security updates and Article 14 reporting stay CRA work in every case.
How do the two regulations compare?
The Machinery Regulation treats cybersecurity as a cause of hazards to people. The Cyber Resilience Act treats cybersecurity as a product property that the manufacturer maintains for the whole support period.
| Topic | Machinery Regulation (EU) 2023/1230 | Cyber Resilience Act (EU) 2024/2847 |
|---|---|---|
| What it protects | The health and safety of persons, and where appropriate domestic animals, property and the environment (Article 1). | The cybersecurity of products with digital elements (Article 1). |
| Cybersecurity requirements | Annex III, sections 1.1.9 and 1.2.1. | Annex I, Part I on product properties and Part II on vulnerability handling. |
| Vulnerability handling and security updates | Not in the Machinery Regulation. | Annex I, Part II, for the whole support period (Article 13(8)). |
| Reporting to CSIRTs and ENISA | Not in the Machinery Regulation. | Actively exploited vulnerabilities and severe incidents, from 11 September 2026 (Article 14). |
| Notified body | Annex I, Part A always. Annex I, Part B unless the harmonised standards or common specifications for the category are fully applied (Article 25). | Class II and critical products always need a notified body or a European cybersecurity certification scheme. Class I unless a harmonised standard, a common specification or a certification scheme is fully applied (Article 32). |
| Substantial modification | A physical or digital change, not foreseen by the manufacturer, that creates a new hazard or increases an existing risk so that new guards or protective measures are needed (Article 3(16)). The person who makes it becomes the manufacturer (Article 18). | A change that affects compliance with Annex I, Part I or changes the intended purpose (Article 3(30)). The person who makes it becomes the manufacturer (Article 22(1)). |
| Keeping documentation | At least 10 years after placing on the market (Article 10(3)). | At least 10 years after placing on the market, or the support period if that is longer (Article 13(13)). |
| Declaration of conformity | One declaration for every applicable Union act (Article 21(3)). | One declaration for every applicable Union act (Article 28(3)). |
Which machinery needs a notified body?
The six categories in Annex I, Part A of the Machinery Regulation always need a notified body (Article 25(2)). The categories in Annex I, Part B need one unless the machine is built to the harmonised standards or common specifications for its category, covering all relevant requirements (Article 25(3)). Every other machine uses internal production control, module A (Article 25(4)).
Annex I, Part A
- Removable mechanical transmission devices including their guards.
- Guards for removable mechanical transmission devices.
- Vehicle servicing lifts.
- Portable cartridge-operated fixing and other impact machinery.
- Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions.
- Machinery that has embedded systems with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions, for those systems only.
The Cyber Resilience Act classifies by core functionality (CRA Article 7(1)), and its Annex III and Annex IV list no machinery category. Most machines are therefore default-class products that can use module A for the CRA, even where the same machine needs a notified body under the Machinery Regulation. See CRA product classes or run the free classification check.
What did Regulation (EU) 2026/1744 change?
Regulation (EU) 2026/1744 of 8 July 2026 added rules for high-risk AI systems to the Machinery Regulation, in force in the consolidated text from 27 July 2026.
- A new third paragraph in Article 8 requires the Commission to add health and safety requirements to Annex III by delegated act for AI systems that are high-risk under Article 6(1) of the AI Act, Regulation (EU) 2024/1689, because they are a safety component of machinery or are machinery.
- A new Article 20(10) presumes conformity with Annex III as regards high-risk AI systems when the AI system complies with the harmonised standards or common specifications of the AI Act, until the Machinery Regulation has its own.
What should a machinery manufacturer do before 20 January 2027?
Plan one compliance file that answers both acts, because the machine carries one CE marking and one declaration of conformity.
- Check whether the machine has a data connection to a device or network. If it has, the CRA applies to it as a product with digital elements (CRA Article 2(1)).
- Classify the machine under both acts, against Annex I of the Machinery Regulation and Annexes III and IV of the CRA.
- Run one risk assessment that covers sections 1.1.9 and 1.2.1 and the CRA Annex I requirements, and record which evidence serves which act.
- Build the software identification of section 1.1.9 and the tracing log of section 1.2.1(f) into the control system.
- Plan each conformity assessment and draw up one EU declaration of conformity that names both acts.
- Run vulnerability handling and Article 14 reporting now. Article 14 applies from 11 September 2026, also to products placed on the market before 11 December 2027.
Frequently asked questions
When does the EU Machinery Regulation apply?
Regulation (EU) 2023/1230 applies from 20 January 2027 (Article 54) and repeals Directive 2006/42/EC from that date (Article 51(2)). Machinery placed on the market in conformity with the directive before 20 January 2027 can still be made available (Article 52(1)). EC type-examination certificates issued under the directive stay valid until they expire (Article 52(2)).
Does CRA compliance give a presumption of conformity under the Machinery Regulation?
No. CRA recital 53 says that compliance with the CRA could facilitate compliance with Annex III, sections 1.1.9 and 1.2.1 of the Machinery Regulation, and that the manufacturer has to demonstrate those synergies. A presumption of conformity with sections 1.1.9 and 1.2.1 comes from a certificate or statement of conformity under a cybersecurity certification scheme of Regulation (EU) 2019/881 whose references are published in the Official Journal, for the requirements it covers (Machinery Regulation Article 20(9)).
Is software a safety component under the Machinery Regulation?
Yes, when it is placed on the market on its own. Article 3(3) defines a safety component as a physical or digital component, including software, that fulfils a safety function, is independently placed on the market, and whose failure endangers the safety of persons. Safety components with self-evolving behaviour that use machine learning to ensure safety functions are in Annex I, Part A and always need a notified body.
Is a machine or a robot an important product under the CRA?
Usually not. CRA Article 7(1) makes a product important only when its core functionality matches a category in Annex III, and Annex III lists no machinery or robot category. Integrating an Annex III component, such as an operating system or a switch, does not by itself make the machine important.
Are agricultural tractors covered by the Machinery Regulation?
No. Article 2(2)(i) excludes agricultural and forestry tractors within the scope of Regulation (EU) No 167/2013, except machinery mounted on them. Regulation (EU) No 167/2013 is not among the acts excluded by CRA Article 2(2), so the CRA can still apply to the digital elements of a tractor.
Sources
- Regulation (EU) 2023/1230 on machinery, EUR-Lex CELEX:32023R1230. Official Journal L 165, 29 June 2023.
- Regulation (EU) 2023/1230, consolidated text of 27 July 2026, EUR-Lex CELEX:02023R1230-20260727. Includes the corrigendum of 4 July 2023 and Regulations (EU) 2024/2748 and 2026/1744.
- Regulation (EU) 2024/2847, the Cyber Resilience Act, EUR-Lex CELEX:32024R2847. Recital 53 and Articles 7, 28, 32, 69 and 71.
- Cyber Resilience Act implementation, frequently asked questions, European Commission Version 1.4, 4 September 2026. Not binding.
- Cyber Resilience Act implementation, European Commission Commission guidance C(2026) 5252, points 248 to 250.
This page summarises the text of Regulation (EU) 2023/1230 and Regulation (EU) 2024/2847. It is not legal advice.
Last updated on 2026-10-26.
Prepare the CRA half of the declaration
CVD Portal keeps the CRA classification, the Annex I risk assessment, the technical file and Article 14 reporting for each product in one place. It does not assess conformity with the Machinery Regulation.