The EU Machinery Regulation (EU) 2023/1230 and its technical file requirements

Regulation (EU) 2023/1230, known as the Machinery Regulation, is the new European framework for placing machinery and related products on the EU market. It replaces the long-standing Machinery Directive 2006/42/EC and, because it is a regulation rather than a directive, it applies directly and uniformly across all Member States without national transposition. For hardware teams, the most consequential shifts concern the technical documentation, the acceptance of digital instructions for use, and the explicit treatment of cybersecurity as a safety matter.

What changed compared with Directive 2006/42/EC

The move from a directive to a regulation removes the divergence that came from 27 national transpositions: the same text now applies everywhere in the Union. Beyond the legal instrument, the substance was modernised to reflect how machinery is actually built and operated today.

Key changes include:

• Digital documentation is explicitly permitted. Instructions for use and, under conditions, the EU declaration of conformity may be provided in digital form rather than only on paper.
• Cybersecurity is addressed as a safety requirement. Where a security vulnerability could lead to a hazardous situation, it falls within the essential health and safety requirements.
• A dedicated category of high-risk machinery is listed in an annex, with a stricter conformity assessment route than the general self-assessment path.
• Emerging technologies such as machinery embedding artificial intelligence systems and evolving (self-learning) behaviour are taken into account.
• Clearer allocation of duties across the chain of economic operators (manufacturers, authorised representatives, importers and distributors).

Key dates

The Machinery Regulation entered into force on 19 July 2023. After a transition period, it becomes applicable on 20 January 2027. From that date, machinery placed on the market must comply with the Regulation and the Directive 2006/42/EC regime ceases to apply to new products. The transition window exists precisely so manufacturers can adapt their documentation, conformity assessment and instructions before the switch, so preparation should not wait until the application date approaches.

The technical file and technical documentation

At the heart of compliance is the technical documentation (the technical file). It is the evidence base that demonstrates a machine meets the essential health and safety requirements, and it must be assembled before the product is placed on the market.

The technical documentation typically covers:

• A general description of the machinery and its intended use.
• Design and manufacturing drawings, diagrams and specifications, including the relevant bill of materials and component data.
• The risk assessment, describing the hazards identified and the protective measures applied.
• The standards applied and other technical specifications, showing which essential requirements they cover.
• Test reports and results, whether performed by the manufacturer or a third party.
• A copy of the instructions for use and the EU declaration of conformity.

Because this evidence is spread across CAD, requirements, risk analyses, supplier data and test records, the practical challenge is keeping every element consistent and current as the design evolves. This is where audit-ready traceability matters: linking each requirement, part and change to the evidence that justifies it, so the file can be produced on demand rather than reconstructed under pressure.

Digital documentation and digital instructions for use

One of the most visible modernisations is that instructions for use may be provided digitally. Manufacturers can publish instructions online or supply them electronically, provided users can access, store and print the information they need, and provided a paper version is made available free of charge on request.

In practice this means:

• The digital instructions must remain accessible for the expected lifetime of the machinery.
• Safety-critical information must reach the user even where digital access cannot be assumed.
• Version control matters: users must be able to identify which revision of the instructions corresponds to their machine.

Digital delivery is an opportunity as much as an obligation. Instructions that are generated from the same structured source as the design stay aligned with the as-built configuration, which is a recurring difficulty in advanced manufacturing where variants and options multiply.

Cybersecurity treated as a safety requirement

The Regulation recognises that a connected machine can be compromised, and that such a compromise can create a physical hazard. Cybersecurity is therefore folded into the essential health and safety requirements: machinery must be designed and constructed so that a reasonably foreseeable attempt to corrupt its safety-related control does not lead to a dangerous situation.

For documentation, this means the technical file should reflect the security-relevant design decisions, the protective measures taken and how safety functions resist corruption, in the same way it already documents mechanical and functional safety.

Substantial modification

The Regulation clarifies the concept of substantial modification: a change to a machine, after it has been placed on the market, that was not foreseen by the manufacturer and that affects safety by creating a new hazard or increasing an existing risk. A person who carries out such a modification can take on the obligations of a manufacturer for the modified machine, including a new conformity assessment and updated technical documentation for the parts affected.

This is why change history is not a formality: knowing exactly what changed, when and why is what distinguishes a routine maintenance operation from a substantial modification that reopens conformity obligations.

Obligations of economic operators and record retention

The Regulation assigns clear duties along the supply chain:

• Manufacturers carry out the conformity assessment, draw up the technical documentation and the EU declaration of conformity, and affix the CE marking.
• Authorised representatives act within a written mandate and keep documentation available for the authorities.
• Importers verify that the manufacturer has met its obligations before placing machinery on the market.
• Distributors act with due care regarding the requirements.

A central obligation is retention: the technical documentation and the EU declaration of conformity must be kept available for the market surveillance authorities for 10 years after the machinery has been placed on the market. Ten years of retained, coherent evidence is difficult to guarantee with scattered files and departed employees, which again points back to a single, traceable source of record.

How to prepare

Preparation is mostly about closing the gap between how evidence is created and how it must be presented:

1. Map your current documentation to the Regulation's requirements and identify what is missing or inconsistent.
2. Structure the technical file as living data, not a document assembled at the end, so that requirements, bill of materials, risk assessment and test evidence stay linked.
3. Plan digital instructions with proper versioning and long-term accessibility.
4. Treat cybersecurity as part of the safety case and document the protective measures.
5. Define what counts as a substantial modification for your products and make change history auditable.
6. Confirm retention: ensure the file and declaration remain retrievable for at least 10 years.

For a timeline-oriented walkthrough of the switch, see the related article on European Machinery Regulation 2027 preparation.