The Machinery Regulation's cybersecurity requirements

Last updated: October 19, 2026

Regulation (EU) 2023/1230 adds cybersecurity-related essential safety requirements to machinery, treating a cyberattack that could create a physical hazard as a safety matter the manufacturer must address. It replaces the Machinery Directive 2006/42/EC and applies from 14 January 2027. Regulation (EU) 2023/1230, Art. 54

Repeal and application, the same date

Article 54: “It shall apply from 14 January 2027.”

Article 51(2): “Directive 2006/42/EC is repealed with effect from 14 January 2027.”

Article 52(1): “Member States shall not impede the making available on the market of products which were placed on the market in conformity with Directive 2006/42/EC before 14 January 2027.”

The old Directive is repealed and the new Regulation applies from the same date, with no gap between the two. Source: Regulation (EU) 2023/1230, Art. 54, checked 19 October 2026

What's new

The regulation adds cybersecurity-related essential health and safety requirements for machinery. See the official text linked above for the specifics.

It's a Regulation, not a Directive

Unlike NIS2 (a Directive, transposed differently by each member state, as the Netherlands', Belgium's, and Luxembourg's different dates show), this is a Regulation: directly binding in all EU member states at once, with no national transposition step.

How this differs from the Cyber Resilience Act

The Machinery Regulation is a safety regulation, newly extended to cover cyberattacks that create a physical hazard. The CRA is a cybersecurity regulation for products with digital elements generally. A connected machine can be covered by both, for different reasons, at the same time.

Related guides

The Cyber Resilience Act for machine builders and NIS2, the CRA, the Machinery Regulation, and IEC 62443.

This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.