Europe's Machinery Makers Face a 24-Hour Clock as Two Overlapping Tech Laws Reshape Factory Safety
Published on 11/03/2026 at 15:01 | Editorial boerse-global.de
Industrial equipment designers gathered in Würzburg on 28 October 2026 for the SPOTLIGHT forum, where the central question was how two European rulebooks — the Machinery Regulation (EU) 2023/1230 and the Cyber Resilience Act (CRA) — will together rewrite the duties of anyone building or running industrial plant.
The two regimes do not arrive at once. The Machinery Regulation becomes legally binding across the EU from January 2027, while the CRA applies in full at the end of 2027. Manufacturers and operators alike must rework their processes or face steep penalties. According to the Dekra testing and certification body, breaches can bring sales bans plus fines of up to 15 million euros or 2.5 percent of worldwide annual turnover.
A reporting duty that is already live
Some obligations are no longer a planning exercise. Since 11 September 2026, the CRA (EU) 2024/2847 has required manufacturers to report actively exploited vulnerabilities and serious security incidents within 24 hours through the platform run by ENISA, the EU cybersecurity agency. Products already shipped to customers fall within that duty.
Then comes the turnover in machinery law. On 20 January 2027, the Machinery Regulation (EU) 2023/1230 replaces the existing Machinery Directive 2006/42/EG with no transition period. The essential health and safety requirements move into Annex III.
Fresh provisions cover protection against corruption and set out rules for artificial intelligence. Operating instructions may now be supplied digitally — via a QR code, for instance — but a paper copy must still be provided free of charge within one month of a request.
The final deadline lands on 11 December 2027, when digital products and connected machinery may only enter the EU market with full CRA conformity and CE marking. Experts point out that comprehensive implementation programmes typically run 12 to 18 months, meaning work needs to be under way well before that date.
Where safety engineering meets IT security
Cybersecurity is becoming an integral part of machine safety rather than a separate discipline. The bridge is the forthcoming harmonised standard EN 50742, which links classic machinery-safety requirements with the IT security standards of the IEC 62443 series.
At the conference, the Fraunhofer IEM urged continuous compliance instead of purely manual one-off evidence. What is needed, its experts said, are software bills of materials (SBOM) in formats such as CycloneDX and systematic management of known vulnerabilities (CVEs).
The TĂśV SĂśD inspection body made clear that practice still lags. Among the typical failings found in audits, it said, are missing software bills of materials for components and risk analyses written in generic, blanket terms.
Industry bodies push back on the declaration rules
As manufacturers prepare, criticism is building over specific requirements. The European Federation of Materials Handling (FEM) and five other industry associations have jointly called on the European Commission to align the CRA's provisions with the Machinery Regulation as amended by the Omnibus IV initiative.
At the heart of the dispute is legal uncertainty over issuing a single EU declaration of conformity for products that fall under several pieces of legislation at once. The CRA currently demands a physical declaration of conformity attached directly to the product, whereas the revised Machinery Regulation permits a purely digital version. The associations want one uniform digital solution — via a marking on the machine, on the packaging or in the accompanying documents — without the need for an additional simplified paper declaration.
