Machinery Regulation (EU)

Contents

What changed with the Machinery Regulation?
Why cybersecurity matters
A practical Defense-in-Depth approach
Start with the risk assessment
FAQ section
Contact us

Protecting machines in a connected world

Industrial automation is changing rapidly.

Machines are no longer isolated systems. They communicate with engineering workstations, factory networks, remote service platforms, cloud systems and external equipment.
These new capabilities create tremendous opportunities for productivity and flexibility. At the same time, they require machine builders to carefully consider how machine safety is maintained throughout the machine lifecycle.

From 20 January 2027, the EU Machinery Regulation (EU) 2023/1230 becomes applicable and introduces updated requirements for machinery placed on the European market. The Regulation places increased focus on software, connected systems, digital documentation, traceability and protection against corruption, while maintaining its core objective:

Protecting people through safe machinery.

At Mitsubishi Electric, we help machine builders combine:

• Functional safety
• Industrial cybersecurity
• Automation technology
• Defense-in-Depth concepts
• Practical machine architectures

to build machines that remain safe, productive and future-ready throughout their lifecycle.

The goal is to protect the complete machine

A machine is much more than a controller. It includes the automation system, connected infrastructure, engineering environment and the people who operate and maintain it.

• Controllers and safety controllers
• Drives and motion systems
• HMIs
• Remote I/O
• Networks
• Engineering workstations
• Maintenance access
• Operators and maintenance personnel

The real question is: "Can the complete machine remain safe when connected, configured, serviced, maintained or modified?"

Compliance is increasingly influenced by machine architecture, risk assessment and system integration rather than by individual product features alone.

What changed with the Machinery Regulation?

More than cybersecurity	Cybersecurity is one of the most discussed topics, but the Machinery Regulation introduces several important changes beyond cybersecurity.
Digital documentation	Documentation may now be provided digitally under defined conditions. Customers retain the right to request printed documentation when required.
Greater importance of software	Software and software-related safety functions play a more prominent role than under the previous Machinery Directive. Software modifications, updates and functional changes must be properly considered throughout the machine lifecycle.
Protection against corruption	The Regulation introduces explicit requirements addressing situations where software manipulation, communication systems or connected devices could affect machine safety.
Traceability	Safety-relevant interventions and modifications should be identifiable and traceable. Logging and evidence of interventions become increasingly important elements of compliance.
Substantial modification	Significant modifications may result in a machine being regarded as a new machine and may require a new conformity assessment. This can apply to both hardware and software changes that affect safety.

Why cybersecurity matters

The Machinery Regulation is fundamentally a machine safety regulation.

Cybersecurity becomes relevant whenever a cyber-related event could create a hazardous situation or impair a safety function. This can include unauthorised changes to safety programs or parameters, unauthorised remote access, manipulated safety-related communication, compromised engineering systems or software-related loss of safety functionality.

The key principle is simple:

Communication with a machine must not lead to a hazardous situation.

This principle forms the foundation for modern machine protection concepts and aligns closely with Mitsubishi Electric's approach to machine safety and cybersecurity.

A practical Defense-in-Depth approach

There is no single feature that makes a machine secure.The most effective protection is achieved through multiple complementary layers working together.

This concept is commonly known as Defense-in-Depth.Rather than relying on a single device or technology, protection is distributed across the complete machine environment.

Physical protection

Protect access to critical equipment. Examples include: • Controlled access to production areas • Locked cabinets and enclosures • Protection of safety controllers • Controlled handling of removable media

Users and processes

Ensure that only authorised persons can influence safety-related functions. Examples include: • User training • Administrator assignment • Change-management procedures • Controlled maintenance activities

Network protection

Protect communication paths and machine boundaries. Examples include: • Defined machine trust boundaries • Network segmentation • Industrial firewalls • Secure routers • Controlled remote access

Product security functions

Utilise built-in product capabilities wherever applicable. Examples include: • Authentication • Authorisation • Event history • Program protection • Communication integrity mechanisms • Safety diagnostics

Monitoring and traceability

Maintain visibility and accountability throughout the lifecycle. Examples include: • Event logging • Audit records • Configuration history • Evidence of interventions

Machinery Regulation and CRA

Many customers are preparing for both: EU Machinery Regulation and Cyber Resilience Act (CRA)

Although the objectives are different, the practical implementation often follows similar engineering principles. Both benefit from:

• Risk-based decision making
• Defense-in-Depth concepts
• Network segmentation
• User and access management
• Logging and traceability
• Secure change management
• Lifecycle thinking
• Security-by-design principles

This means many customers can establish one overarching cybersecurity strategy that contributes both to Machinery Regulation objectives and CRA objectives.

Machinery Regulation	Cyber Resilience Act
Machine safety	Product cybersecurity
Prevention of hazardous situations	Vulnerability management
Protection against corruption affecting safety functions	Security updates
	Secure product lifecycle

Building confidence beyond 2027

The Machinery Regulation introduces new requirements. But it also creates an opportunity.

An opportunity to build machines that are:

Safer
Better documented
More transparent
More resilient against manipulation
Better prepared for future requirements

Whether your machine operates as a standalone solution or as part of a connected production environment, the objective remains the same:

Protect the machine. Protect people. Maintain productivity.

Start with the risk assessment

No two machines are identical.

A standalone machine inside a protected environment will have different requirements than a machine connected to factory networks, remote maintenance systems or cloud services.
For this reason, the machine risk assessment remains the starting point of every Machinery Regulation project.

The risk assessment helps determine:

• Which hazards exist
• Which safety functions are affected
• How connected the machine is
• Which protection measures may be appropriate
• Which documentation is required

The Machinery Regulation compliance flow begins with understanding the scope of the machine and performing the risk assessment before selecting technical measures and preparing documentation.

FAQ section

Does the Machinery Regulation apply to my machine?

This depends on the machine type, intended use, product scope and date of placement on the market. If you are unsure, Mitsubishi Electric can help you understand the scope and relevant product information.

Can Mitsubishi Electric perform the risk assessment for my machine?

The machine risk assessment remains the responsibility of the machine manufacturer because it requires detailed knowledge of the complete machine, its intended use and its operating environment.
Mitsubishi Electric can support discussions regarding automation products, safety technologies, system architectures and cybersecurity considerations.

Where additional expertise is required, we can also help customers identify suitable partners and specialized service providers experienced in machine risk assessments, machinery compliance and industrial cybersecurity projects.

Is IEC 62443 mandatory under the Machinery Regulation?

Not generally.

The Machinery Regulation defines safety objectives and required outcomes. IEC 62443 provides an established industrial cybersecurity framework that can help machine builders implement structured cybersecurity concepts and support their overall protection strategy.

Do I always need a firewall or security router?

Not necessarily.

The required protection measures depend on your machine architecture, connectivity and risk assessment.
For some applications, physical protection and controlled access may provide sufficient protection. For others, additional measures such as segmentation, industrial firewalls or secure remote-access solutions may be appropriate.

Can I prepare for the Machinery Regulation and CRA at the same time?

In many cases, yes.

Although the regulations focus on different objectives, many practical cybersecurity measures contribute to both. A common cybersecurity strategy can often reduce complexity and minimize future engineering effort.

Planning Machinery for 2027 and beyond?

Every machine is different. The level of connectivity, the safety functions, the operating environment and the cybersecurity exposure all influence the final solution.

If you are currently evaluating:

• Machinery Regulation requirements
• Functional Safety concepts
• Industrial Cybersecurity measures
• Product selection
• System architecture
• Future machine platforms

we encourage you to discuss your project with Mitsubishi Electric at an early stage.

Together we can help identify suitable technologies, architectures and protection concepts for your specific application.

Contact us

Contactez-nous
- Technical Support
- Contactez-nous
Newsletter
Service
- Support
- Shop
Téléchargements