Cybersecurity of Machinery: Machinery Regulation (EU) 2023/1230 and the Cybersecurity Act (EU) 2019/881
Cybersecurity of machinery is now directly a safety issue for modern machines that operate with networked control systems, remote access and software updates. An unauthorised intervention, corrupted software or a manipulated signal can cause a machine to behave unexpectedly, disable protective functions and create hazardous situations for the operator.
With the Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027, the European Union has for the first time made this risk part of the essential health and safety requirements (EHSRs). This article summarises the cybersecurity requirements of the Machinery Regulation, how it relates to the Cybersecurity Act (EU) 2019/881 and the Cyber Resilience Act (EU) 2024/2847, and the main points manufacturers need to consider.
Why Is Cybersecurity Now a CE Issue?
The Machinery Directive 2006/42/EC did not explicitly address cyber threats. The Machinery Regulation (EU) 2023/1230 includes malicious interventions among the foreseeable risks to be taken into account in the design of machinery. The aim is not to impose a general information security requirement, but to prevent a cyber intervention from leading to a hazardous situation on the machine. Cybersecurity should therefore be treated as a natural part of the risk assessment and the technical file.
What Does the Machinery Regulation Require?
Annex III – 1.1.9 Protection against corruption
- The connection of another device to the machine, or a device communicating remotely with it, must not lead to a hazardous situation.
- Hardware components that transmit signals or data relevant for connection or for access to safety-critical software must be adequately protected against accidental or intentional corruption.
- Software and data that are critical for compliance with the Regulation must be identified and protected.
- The software installed on the machine must be identifiable; it must be possible to collect evidence of legitimate or illegitimate interventions in the software or its configuration.
Annex III – 1.2.1 Safety and reliability of control systems
- Control systems must be designed to withstand internal and external influences, including reasonably foreseeable malicious attempts by third parties, without leading to a hazardous situation.
- Data on interventions in the control system, and the versions of safety software uploaded after the machine has been placed on the market, must be capable of being recorded for five years from the date of upload, exclusively for the purpose of demonstrating conformity.
Relationship with the Cybersecurity Act (EU) 2019/881
The Cybersecurity Act, which entered into force in June 2019, strengthened the mandate of the European Union Agency for Cybersecurity (ENISA) and established an EU-wide cybersecurity certification framework for ICT products, services and processes.
The Machinery Regulation provides that a certificate or statement of conformity issued under a relevant cybersecurity certification scheme adopted within this framework may give a presumption of conformity with requirements 1.1.9 and 1.2.1 of Annex III, in so far as those requirements are covered by the scheme. The two acts therefore meet at a critical point where safety and cybersecurity of machinery intersect.
Complementary Legislation: the Cyber Resilience Act (EU) 2024/2847
The Cyber Resilience Act (CRA), which covers products with digital elements, also directly concerns manufacturers of connected machinery and components:
- 10 December 2024 – Entry into force
- 11 September 2026 – Start of reporting obligations for actively exploited vulnerabilities and severe incidents
- 11 December 2027 – Full application of the essential cybersecurity requirements
In short: the Machinery Regulation addresses the effect of a cyber threat on machinery safety, while the CRA regulates the cybersecurity of the product throughout its life cycle (vulnerability handling, updates, software bill of materials, etc.). For connected machinery, the two must be considered together.
Relevant Standards
- prEN 50742 Safety of machinery – Protection against corruption: the draft standard prepared for requirements 1.1.9 and 1.2.1 of Annex III; it is expected to be published as a harmonised standard. It also provides an alternative route for manufacturers applying the IEC 62443 series.
- IEC 62443 series: Cybersecurity of industrial automation and control systems (e.g. 62443-3-3 system requirements, 62443-4-1 secure product development, 62443-4-2 component requirements).
- EN ISO 12100, EN ISO 13849-1 and EN IEC 62061: Risk assessment and safety-related control systems; cyber threat scenarios should be addressed together with this work.
Key Measures for Manufacturers
- Risk assessment: Including cyber threat scenarios in the risk assessment of the machine.
- Authentication and access control: Securely authenticating users and devices before they access the system, and defining authorisation levels.
- Network security: Firewalls, network segmentation and control of remote access.
- Data integrity and encryption: Protecting safety-critical data and signals in transit and at rest.
- Secure software updates: Signed software/firmware, version tracking and logging of updates.
- Physical protection: Protecting service ports, control cabinets and servers against unauthorised access.
- Logging and incident response: Keeping intervention logs and preparing response procedures for cyber incidents and failures.
- Technical file: Documenting all measures taken and the verification results in the technical file.
Conclusion
For machinery placed on the market from 20 January 2027, cybersecurity is a safety requirement that must be met for CE marking. Manufacturers of connected machinery should consider the Machinery Regulation, the Cybersecurity Act and the Cyber Resilience Act together and start updating their design, risk assessment and technical file processes to these requirements now.
The technical team of TESTPLUS (Notified Body NB 2908) closely follows developments in the cybersecurity of machinery and the transition to the Machinery Regulation (EU) 2023/1230. For conformity assessment requests and questions, please contact our technical team.
