Machinery Regulation 2023/1230: T-6 Months, the Countdown to the Digital Technical File

On January 20, 2027, Machinery Regulation (EU) 2023/1230 will become applicable and will replace Machinery Directive 2006/42/EC, which for twenty years had governed the placing of machinery on the market in Europe. As we write, six months remain. Six months during which every manufacturer of machinery, robots, partly completed machinery, and interchangeable equipment intended for the European market must bring its organization, its documentation, and its products into compliance with a text that changes both the form and the substance of how conformity is demonstrated.

Six months, in industrial time, is tomorrow morning. This article takes stock of what actually changes, of the traps in the timeline, and of why the real question posed by the regulation is not "have we updated our documents?" but "is our documentation capable of living at the pace of our products?".

From a directive to a regulation: more than a legal nuance

The first change is legal in nature, and it carries heavy practical consequences. A directive had to be transposed by each member state, with all the national divergences that implied. A regulation applies directly and uniformly across the whole Union, with no transposition.

For manufacturers, this means the end of the gray areas between national interpretations, but also the end of local flexibility. The market surveillance authorities of all member states will work from a single text, and the cooperation between them, reinforced by the new framework, will make compliance gaps more visible and more quickly sanctioned.

The second contextual change is the absence of a coexistence period: unlike other European texts, the Machinery Regulation provides no soft transition during which both regimes would be valid. On January 20, 2027, the directive expires, the regulation applies. A machine placed on the market on January 19 falls under the old conformity; the same machine placed on the market on January 21 must comply with the new text. For manufacturers whose sales cycles stretch over several months, managing this switchover is a project in itself.

What changes in substance: four work streams

Beyond the form, the regulation introduces or reinforces four families of requirements that concern engineering directly.

First work stream: cybersecurity as a safety requirement. The regulation introduces essential requirements for protection against corruption: a connected machine must be protected against malicious, accidental, or intentional alterations liable to create a hazardous situation. Software and data critical to safety must be identified, and the machine must be able to trace software interventions. For manufacturers, this means that the boundary between functional safety and cybersecurity disappears: both now fall within the same technical file, with links to document between the machine risk analysis and the cyber risk analysis.

Second work stream: systems with evolving behavior. The regulation explicitly addresses machines that integrate machine learning systems whose behavior may evolve after being placed on the market. The manufacturer must define and document the limits of this evolving behavior, guarantee that the evolution remains within the assessed safety perimeter, and provide for the corresponding means of supervision. Combined with the Omnibus agreement of May 2026, which refers industrial AI back to sectoral legislation, this work stream makes the Machinery Regulation the true compliance framework for AI embedded in industrial equipment.

Third work stream: substantial modifications. The regulation clarifies a point that had been poisoning practice for years: who is responsible when a machine is modified after being placed on the market? From now on, anyone who makes a substantial modification to a machine becomes a manufacturer, with all the associated obligations, including a new conformity assessment. For manufacturers as well as for integrators and end users, this makes it essential to know precisely what constitutes the reference definition of a machine and to trace any deviation from it.

Fourth work stream: digital documentation. The regulation finally allows the instructions for use to be supplied in digital form, under conditions, and modernizes the requirements relating to technical documentation. It is an opportunity for efficiency, but also a new responsibility: digital documentation must remain available, up to date, and consistent with the actual configuration of each machine delivered, for at least ten years.

The trap of the last six months

Six months from the deadline, manufacturers fall into three categories.

The first group has finished: gap analysis done, requirements integrated, technical files updated, declarations of conformity ready to switch over. They are a minority.

The second group is in progress, and is discovering the real difficulty of the exercise: the gap analysis between the directive and the regulation is not a comparison of texts, it is a comparison between a text and their own technical file. For each new or modified essential requirement, they must determine whether the product is concerned, whether the current design covers the requirement, what evidence demonstrates it, and what needs to be added. This mapping requires being able to connect each requirement to concrete elements of design and verification. When the technical file is a stack of PDFs inherited from several product generations, this work of connecting the dots represents the bulk of the effort.

The third group is counting on a hypothetical leniency from the authorities, or on the harmonized standard that has not yet been published, to justify waiting. It is a losing bet: the absence of harmonized standards under the new regulation does not suspend the applicability of the essential requirements, it simply obliges the manufacturer to demonstrate conformity by other means, which is more costly, not less.

The underlying question: a file or a repository?

The Machinery Regulation, like the revision of the MDR on the medtech side or the growing demands of the defense sector, is pushing all manufacturers toward the same structural question. Compliance is traditionally conceived as the production of a file: a set of frozen documents, assembled for a milestone (the placing on the market), and then archived.

Yet everything in the new regulatory landscape contradicts this model. Cybersecurity requires regular software updates, and therefore regular changes to the definition. Evolving systems require continuous monitoring of behavior. The substantial modification regime requires knowing the reference configuration and the deviations at any moment. Digital documentation requires a permanent and consistent availability.

Compliance ceases to be an event and becomes a state, one that must be maintained continuously throughout the product's life. And a continuous state cannot be maintained with discontinuous artifacts. This is the structural limit of the file-based technical file: every change to the product requires manually finding all the impacted documents, revising them, and guaranteeing the consistency of the whole, machine by machine, variant by variant.

The alternative is to make the technical file a generated view of a structured repository. In this model, the essential requirements of the regulation, the internal requirements, the safety functions, the components, the software versions, the risk analyses, and the verification evidence exist as linked objects in a graph. The conformity of a given machine, in a given configuration, at a given date, is the result of a query. The gap analysis toward a new regulatory text is the addition of a set of requirements into the graph and the examination of their coverage. The impact of a software update on the safety perimeter is a traversal of links, not a crisis meeting.

This is the approach Koddex offers to manufacturers of regulated equipment: an Engineering OS that centralizes requirements, bills of materials, impact analyses, and compliance traceability, and whose technical file is nothing more than an extract, always up to date, always consistent.

Action plan for the six remaining months

Concretely, here is the sequence we recommend to manufacturers approaching the final stretch.

Month 1: map the portfolio. List the products that will be placed on the market after January 2027, identify those that integrate connectivity or evolving functions, and prioritize by volume and by risk.

Months 2 and 3: structure the requirements. Integrate the essential requirements of the regulation into a repository, product by product, and establish the coverage matrix: which requirement is covered by which design element, demonstrated by which piece of evidence. This is the moment to shift from a documentary logic to a graph logic, because this work of connecting the dots is precisely what a structured repository capitalizes on.

Months 4 and 5: close the gaps. Launch the studies, tests, and modifications needed on the identified gaps, giving priority to cybersecurity and evolving behavior, which are the longest work streams.

Month 6: switch over the documentation. Generate the new technical files and EU declarations of conformity, organize the commercial switchover around January 20, and train the teams on the substantial modification regime.

Conclusion

Machinery Regulation 2023/1230 is not a simple regulatory update, it is the text that brings the European machine into the era of the connected, evolving product documented on a continuous basis. Manufacturers who approach it as one more documentary exercise will spend January 2027 in pain and will relive the same pain with every evolution of their products. Those who use it to structure their engineering into a traceable repository will turn every new requirement into one more query, and their compliance into a commercial argument. Six months is short for a documentary project. It is enough for an architecture decision.

Sources

- Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023 on machinery (full text) (EUR-Lex, CELEX 32023R1230, 14 June 2023)
- Machinery safety requirements (official summary of Regulation (EU) 2023/1230) (EUR-Lex, European Union)
- New Machinery Regulation EU 2023/1230: Important Changes at a Glance (TUV Rheinland)
- EU Machinery Regulation 2023/1230: OEM Checklist for 2027 (SOPX, updated 7 June 2026)
- Machinery Regulation (EU) 2023/1230: Compliance, AI & Cybersecurity Requirements for EU Market Access (Intertek)
- EU agrees to amend AI Act, clarifies overlap with machinery rules (IAPP, 7 May 2026)

Koddex supports manufacturers of machinery and robots in structuring their technical file into a traceable repository. Request our standard gap analysis for Machinery Regulation 2023/1230.