The New EU Machinery Regulation 2023/1230: What Must Be Ready Before 20 January 2027

The Machinery Directive is twenty years old. It was written for a world in which a machine is a mechanism, software is auxiliary, and “update” means changing a bearing. Since then collaborative robots, remote diagnostics and algorithms that keep learning have arrived on the shop floor.

On 20 January 2027 Directive 2006/42/EC stops applying and Regulation (EU) 2023/1230 takes its place. For machine builders, integrators and any company that modifies its own machines, this is not a change of reference number — it is a new technical file, a new declaration and, in some cases, a new route to CE marking.

Directive versus regulation: why the difference matters

A directive sets an objective that each Member State transposes into its own law; a regulation applies directly. In Bulgaria, Directive 2006/42/EC lived through the national Ordinance on the essential requirements and conformity assessment of machinery. From 20 January 2027 there is no such intermediary — the text that binds you is the Regulation itself.

There are three practical consequences: national differences in interpretation disappear; references in your contracts and technical documentation to the national ordinance become obsolete; and market surveillance — carried out in Bulgaria by the State Agency for Metrological and Technical Surveillance (DAMTN) — works from the same text as its counterparts elsewhere in the EU.

The timeline

What falls within scope

The Regulation covers machinery, related products and partly completed machinery. The “related products” group consolidates what the old Directive listed separately:

• interchangeable equipment;
• safety components;
• lifting accessories;
• chains, ropes and webbing;
• removable mechanical transmission devices.

Partly completed machinery remains a separate category — it does not receive CE marking under this Regulation but is accompanied by a declaration of incorporation and assembly instructions. If you are a subcontractor building an assembly for someone else’s line, this is your case, and it is exactly where most documentation errors occur.

What is new: software, self-evolving systems and cybersecurity

The most significant substantive extension is the recognition that machine safety now also depends on software. The Regulation addresses digital risks in three directions:

• Software performing a safety function. Where software carries out a protective function, it is treated as a safety component with all the consequences that follow.
• Self-evolving behaviour. Systems that change their behaviour through machine learning fall under a special regime — something with no counterpart in the old Directive.
• Protection against intentional interference. The machine must be designed so that malicious interference with its control system does not lead to a hazardous situation. Cybersecurity enters the risk assessment rather than remaining an IT matter.

For companies already running an information security management system, the last point is familiar ground. For classic mechanical engineering it is usually the hardest part of the preparation.

“Substantial modification”: when you become the manufacturer

A substantial modification is a change to a machine — physical or in software — after it has been placed on the market, not foreseen by the manufacturer, which affects its safety characteristics. When that happens, the modified machine is treated as new, and the party that carried out the modification takes on the obligations of a manufacturer.

This is the provision that affects the largest number of companies — and not the machine builders. It affects machine users:

The consequences are not theoretical: a new risk assessment, an updated technical file, a new declaration of conformity and new CE marking — in the name of the company that made the change. After an accident on such a machine, the question “who is the manufacturer” gets a very clear answer. This is why the topic connects directly to workplace risk assessment.

Annex I: when you need a notified body

The logic of the rule is unchanged, but the list is new. For most machinery the manufacturer applies internal production control — that is, self-declares conformity, provided the essential requirements in Annex III are met and a technical file exists.

The exceptions sit in Annex I, which is split into two parts:

The two most discussed categories in Part A are the new ones: safety components with self-evolving behaviour and machinery with embedded systems exhibiting self-evolving behaviour that perform safety functions. If your product uses machine learning in a protective function, the route to CE marking now runs through a notified body by default — and their capacity is booked months ahead.

Documentation: file, declaration, instructions

1. Technical file. Risk assessment, drawings, standards applied, test results, description of intended use and of reasonably foreseeable misuse. A digital format is permitted.
2. EU declaration of conformity. Drawn up to the model in the Regulation and accompanying the machine. The reference is Regulation (EU) 2023/1230, not the old Directive.
3. Instructions for use. These may be digital — but the buyer has the right to request a paper copy at purchase, and for machinery intended for non-professional users the safety-related information is provided on paper. Digital instructions must remain accessible online for the expected lifetime of the machine.

And the obligatory point on language: instructions and the declaration are supplied in the language of the Member State where the machine is placed on the market. Selling in Bulgaria means documentation in Bulgarian — and that is a finding a market surveillance inspector makes in the first five minutes.

Still under negotiation: the Omnibus IV package

A legislative debate runs in parallel with your preparation. The Omnibus IV proposal would make digital solutions — an electronic declaration of conformity and QR-code access to the documentation of the individual machine — mandatory from January 2027. The dispute is over the transition period: other product sectors are given 24 months to adapt, while machinery would have to be ready immediately.

Industry contests this, citing long development cycles, significant first-time investment and cybersecurity risks from direct QR-code access. The proposal is currently still under negotiation between the Commission, the Council and Parliament and is not final. Plan against the Regulation, but keep this file in view — it may add requirements in the final year.

An eight-step preparation plan

1. Inventory your products. Which items will be placed on the market after 20 January 2027 — including those built against older orders.
2. Check whether you fall under Annex I. This decision has the longest lead time and must come first.
3. Map your risk assessment against Annex III. The essential requirements have been renumbered and extended; copying the old file across does not work.
4. Add the digital risks. Software with a safety function, remote access, protection against intentional interference.
5. Update your templates. EU declaration of conformity, declaration of incorporation, technical file structure, marking.
6. Settle the instructions question. Digital format, method of publication, languages and the procedure when a paper copy is requested.
7. Review contracts with customers and subcontractors. Who carries responsibility for conformity in assemblies of machinery and after modifications.
8. Train your people. Designers, the quality manager and the sales team — the last because commitments made in a quotation also bind the manufacturer.

How ISO 9001 helps (and what it does not cover)

A working ISO 9001 system does not give you conformity with the Regulation — it gives you the mechanism by which conformity is maintained: control of documented information, change control, traceability of software versions, designer competence and design validation. These are precisely the elements missing in companies that treat CE marking as a one-off project before an export order.

Add to that the fact that ISO 9001 is itself in transition — the new version of the standard is published in September 2026. If a system upgrade is also on your horizon, it is sensible to plan both projects together rather than make the same documentation changes twice. The details are in our article on the transition to ISO 9001:2026.

Conclusion

The Machinery Regulation is not a revolution in safety — the essential requirements remain recognisable to any design engineer. The revolution lies in two other things: software is now part of safety, and modifying a machine is a manufacturing act with legal consequences.

20 January 2027 looks distant. It is not. If you fall under Annex I Part A, months separate the decision from the available capacity of a notified body. And if you are a company that regularly retrofits its own machines, the most useful thing you can do today is check how many of those retrofits would qualify as a substantial modification — and who currently stands as their manufacturer.