Machinery Regulation 2023/1230: what changes for software.
The two Annex III requirements that cover interventions and safety software versions, what they mean in practice, and how they connect to the Cyber Resilience Act.
In short. Regulation (EU) 2023/1230 replaces Machinery Directive 2006/42/EC and applies from 20 January 2027. Among the essential requirements of Annex III, two concern software directly: protection against corruption (section 1.1.9) and logging of interventions and safety software versions (section 1.2.1, point f).
Key dates
| Date | What happens |
|---|---|
| 11/09/2026 | Cyber Resilience Act: reporting obligations for actively exploited vulnerabilities and severe incidents apply. |
| 20/01/2027 | The Machinery Regulation 2023/1230 applies to machinery placed on the market from this date. |
| 11/12/2027 | The Cyber Resilience Act applies in full to products with digital elements. |
The rules are not retroactive: machinery placed on the market before 20 January 2027 remains under the directive it was marked to. The models you ship in January, however, are being designed today.
Section 1.1.9 — Protection against corruption
The machine must be designed so that connecting another device to it, including remotely, does not lead to a hazardous situation. Safety-relevant hardware and software must be protected against accidental or intentional corruption.
Where an intervention cannot be prevented, the regulation requires that it can be detected: legitimate interventions and attempts must leave evidence. This is where firmware integrity, checks against expected versions and logging of service sessions come in.
Section 1.2.1(f) — Log of interventions and versions
Among the safety and reliability requirements for control systems, section 1.2.1 requires that data generated in relation to an intervention, and the versions of safety software uploaded after the machine has been placed on the market or put into service, are logged.
This data must be kept for five years after upload, solely to demonstrate the conformity of the machine, including on a reasoned request from a competent national authority.
What this means in practice
- knowing which safety software version runs on each machine, and since when;
- having a trace of every intervention: who, when, by which method, what changed;
- being able to show that the trace was not edited afterwards;
- keeping it in order for five years and being able to produce it.
Harmonised standards
For machinery cybersecurity, the prEN 50742 standard is in preparation and is expected to give a presumption of conformity for protection against corruption. Until it is published, many machine builders refer to the IEC 62443 series for components and processes.
And the Cyber Resilience Act?
Regulation (EU) 2024/2847, the Cyber Resilience Act, covers products with digital elements, including many machine components: gateways, HMIs, controllers, software. Among other things it requires vulnerability handling, security updates and a software bill of materials (SBOM).
For a machine builder the two regulations meet on the same questions: what software is on board, who can change it, how you prove what happened. Ormatrace also collects device SBOMs and checks them daily against published vulnerabilities.
Where Ormatrace fits
| Requirement | Evidence collected by Ormatrace |
|---|---|
| 1.1.9 · make interventions evident | Evidence chain, expected-firmware check, file integrity, attributed remote sessions |
| 1.2.1(f) · log interventions | Intervention events with user, method, before and after, safety relevance, authorisation |
| 1.2.1(f) · safety software versions | History of firmware versions and hashes, kept for five years |
| Retention and authority requests | Append-only log, signed daily roots, exportable per-machine report |
| CRA · software components | CycloneDX SBOM checked daily against known vulnerabilities |
Ormatrace supports these requirements with technical evidence. It does not certify the machine: conformity remains with the manufacturer and its risk assessment.