Introduction

From January 20, 2027, the EU’s Machinery Regulation (EU) 2023/1230 will fully replace the existing Machinery Directive (2006/42/EC). This new regulation brings critical changes, especially for manufacturers and developers who integrate Artificial Intelligence (AI) into machinery and for importers and distributors of these systems.

As AI continues to reshape industrial automation, robotics, and smart manufacturing, understanding its implications for compliance is no longer optional, it’s essential. In particular, older products that have undergone “substantial modifications” may now fall within the requirements of the new regulations.

What’s Changing?

The latest Machinery Regulation reflects a broader EU strategy to regulate emerging technologies in tandem with safety, security, and ethical concerns. Key shifts include:

• Direct applicability (as a Regulation, not a Directive) across EU Member States, reducing fragmentation.
• Expanded definitions to include software, digital components, and AI-driven systems.
• Enhanced focus on cybersecurity, human-machine interaction, and self-learning behaviour of AI components.
• Alignment with the EU AI Act creates a convergence between safety legislation and trustable AI requirements.
• Together with the upcoming Cyber Resilience Act (CRA), there is now a tripartite regulatory framework.

Machinery with embedded AI, especially those capable of autonomous decision-making, will potentially be subject to compliance under the Machinery Regulation, the EU AI Act and the EU CRA.

AI and ‘High-Risk’ Machinery

The regulation introduces a new category – “high-risk machinery products.” This includes machines using self-evolving AI algorithms where outcomes may not be fully predictable at design time. Such systems are likely to require third-party conformity assessment rather than self-declaration.

Example affected sectors:

• Industrial robots with adaptive control systems
• Autonomous mobile machinery (e.g. AGVs)
• Collaborative robots (CoBots)
• AI-driven predictive maintenance systems that trigger physical actions

Key AI-Related Requirements

1. Human Oversight and Control
   Machinery must allow humans to override or shut down AI-based functions when needed. “Safe fallback” modes are essential.
2. Explainability and Transparency
   Operators must understand how decisions are made by AI components, which is especially relevant for maintenance, training, and incident analysis.
3. Cybersecurity
   AI systems that can be updated (e.g. via remote learning or patching) must demonstrate protection against cyber threats, including tampering and data manipulation.
4. Documentation and Traceability
   AI-based components, including software updates and training data versions, must be documented. This aligns with the Trustable AI Bills of Materials (TAIBOM) and other versioning systems.

The CRA’s Role in Machinery Compliance

The Cyber Resilience Act, expected to apply by mid-2026, sets baseline cybersecurity requirements for all products with digital elements — including machinery with software, firmware, connectivity, or digital interfaces.

Key obligations under the CRA

1. Secure-by-Design
   Manufacturers must ensure protection against exploitation of vulnerabilities from development through the entire lifecycle and ensure that a product is free of exploitable vulnerabilities when it is placed on the market.
2. Vulnerability Handling
   A coordinated vulnerability disclosure (CVD) process must be in place. Relevant security patches must be developed and made available promptly.
3. Software Update Management
   Secure and documented mechanisms for deploying patches, including over-the-air (OTA) updates, must be provided.
4. Declaration of Conformity & CE Marking
   Machinery that includes digital components now requires additional documentation under the CRA, alongside the Machinery Regulation and AI Act, where applicable.
5. Cybersecurity Risk Assessment
   Like a functional safety assessment, but focused on attack vectors, data integrity, encryption, and access control.

Practical Steps to Prepare Before 2027

To meet the upcoming requirements, manufacturers and developers should begin preparations now. Here are six essential steps:

1. Identify AI Usage in Machinery

Audit your product portfolio to determine where AI or ML is used — especially in control loops, monitoring systems, or autonomous functions. Distinguish between:

• Static AI (pre-trained models)
• Adaptive AI (self-learning after deployment)

2. Assess the Risk Classification

Check if your machinery falls under the Annex I high-risk list of the Regulation. If AI enables behaviour that may not be fully predictable, your product may require notified body involvement for conformity assessment.

Assess risks across

• Safety (Machinery Regulation)
• AI impact and transparency (AI Act)
• Cybersecurity vulnerabilities (CRA)

Consider using combined risk methodologies that cover physical, digital, and algorithmic risks in one framework.

3. Alignment

While the AI Act, CRA and Machinery Regulation are separate laws, they overlap. Ensure your AI systems meet:

• Risk classification and mitigation
• Data governance and training requirements
• Human oversight mechanisms

Start mapping your processes to AI Act Article 9 (Risk Management System) and Article 11 (Technical Documentation).

Create an Inventory of AI and Software Components

• Identify AI/ML features (e.g. adaptive control, autonomous behaviour)
• Identify networked and updatable components (e.g. HMIs, IoT sensors)
• Create Software Bills of Materials (SBOMs) and consider TAIBOMs for traceability and integrity protection

4. Update Technical Documentation and CE Marking

Ensure that your technical construction file includes specific information, such as:

• Model architecture
• Training data provenance
• Safety fallbacks
• SBOMs / TAIBOMs
• Cybersecurity measures
  Update CE declarations to reference compliance with the Machinery Regulation, the CRA and (where relevant) the AI Act.

5. Implement Secure Development Practices

• Adopt secure software development lifecycles (SSDLC)
• Integrate automated testing, code reviews, and threat modelling

6. Plan for Post-Market Surveillance

Under both the CRA and AI Act, you must monitor how your machinery behaves in the field:

• Detect and report vulnerabilities or AI/ML performance issues

• Track the impact of software updates on safety and compliance

• Provide clear update mechanisms and rollback options

Who Is Responsible?

This isn’t just a job for compliance teams. The new framework affects multiple roles:

• Product Managers – must account for AI and cybersecurity from concept phase
• Design Engineers – must ensure hardware/software interfaces are secure and explainable
• Quality & Safety Officers – must verify alignment with all three frameworks
• Legal & Regulatory – must oversee documentation and conformity assessment

Conclusion

The 2027 Machinery Regulation marks a significant shift in how AI and automation are regulated in the EU. By recognising AI as a core part of modern machinery, the EU is raising the bar for safety, transparency, and accountability.

Acting early, by auditing their AI use, aligning with the AI Act, the CRA and the Machinery Regulation, and investing in robust documentation is essential to ensure compliance and build trust.