Source Code, Five-Year Logs and a Hard Cut-Off: Europe's Machine Builders Face 2027 Without a Grace Period
Published on 10/20/2026 at 11:41 | Editorial boerse-global.de
Machine manufacturers supplying the European Union have a fixed date to work towards: 20 January 2027. From that day the new Machinery Regulation (EU) 2023/1230 applies in every member state, replacing Directive 2006/42/EC outright. Because it takes the form of a regulation rather than a directive, it carries direct legal force and needs no separate national transposition.
What makes the deadline unusually sharp is the absence of a classic transition period. Equipment first placed on the market before 20 January 2027 remains governed by the old directive. Anything placed on the market from that date onward falls mandatorily under the new regime.
Connected machinery moves to the centre
Annex III sets out revised safety and health requirements, and the conformity assessment procedures have been reworked. The regulation also establishes legal rules for supplying digital operating instructions. Its heaviest emphasis, though, lands on networked machines and on protection against corruption.
Manufacturers must now justify every protective measure they take in a traceable way and systematically assess the risks posed by self-learning logic. Safety-relevant software has to be disclosed in the technical documentation, including its source code and update practices.
Antti Laatikainen of the consultancy Gofore puts the overlap between the Cyber Resilience Act (CRA), the Machinery Regulation, NIS2 and the General Data Protection Regulation (GDPR) at roughly 85%. Secure software development and structured security management form the shared core of that overlap.
A 66-point checklist for tamper protection
Practical guidance is already available in the form of testing guideline GS-IFA-M25 from DGUV Test, published under the title "Principles for the testing and certification of protection against corruption." It gives concrete shape to section 1.1.9 of Annex III and applies from 20 January 2027.
The document lists 66 specific test criteria, numbered T01 to T66. It draws on the draft standard prEN 50742:2025, with its approaches A and B, and on the security integrity levels SRSL0 to SRSL3, covered by criteria T52 to T60.
Among its demands is a threat analysis under criterion T09. It also addresses the protection of interfaces and remote access (T23, T24), defences against physical manipulation (T31, T32, T34) and requirements for cryptographic methods with reference to BSI guideline TR-02102-1 (T48, T49).
Installed software must be clearly identifiable (T46), and relevant events must be logged (T35, T36, T42). Those log records carry a minimum retention period of five years (T39).
Turkey aligns, Germany tightens liability
The regulatory push extends beyond the EU single market. In October 2026 Turkey's Ministry of Industry and Technology published Machinery Safety Regulation 2023/1230/AB in the Official Gazette, aligning national rules with EU standards. It covers the design and construction of machinery, safety components, interchangeable equipment, lifting equipment, ropes, chains and removable mechanical transmission devices, while excluding areas such as nuclear installations, firearms and vehicles used purely for competition. Some provisions took effect immediately; the main body also applies from 20 January 2027.
Technical rules are being accompanied by stiffer liability in Germany. On 8 October 2026 the Bundestag passed the Act on the Modernisation of Product Liability Law, transposing EU Directive 2024/2853. It applies to products placed on the market or put into service from 9 December 2026.
Software and AI systems will explicitly count as products. Caps on liability for personal injury and the deductible for property damage are both dropped.
Against that background, machine builders are advised to assess current and upcoming development projects strictly by their planned market-entry date. Internal CE processes and risk assessments need aligning with the new connectivity and cybersecurity criteria, and staff training should follow promptly to avoid delays in future conformity assessments.
