EU Machinery Regulation Cybersecurity: The EU Just Gave Machinery Manufacturers More Direction

13 Nov 2026

New Guidance on “Protection Against Corruption” Gives Manufacturers a Clearer Picture of how Cybersecurity, Machinery Safety, and Risk Assessment Come Together Under Regulation (EU) 2023/1230

Protection against corruption is one of the biggest changes manufacturers need to address as they prepare for the EU Machinery Regulation.

Annex III, Section 1.1.9 of Regulation (EU) 2023/1230 introduces requirements to protect safety-related hardware, software, and data against accidental or intentional corruption. Section 1.2.1 adds requirements for control systems to withstand external influences, including reasonably foreseeable malicious attempts that could lead to a hazardous situation. These are machinery safety requirements, but they bring cybersecurity directly into the machinery compliance process.

Until now, one of the challenges has been determining what some of these requirements mean in practice. On November 10, the European Commission published endorsed partial guidance covering Annex III, Sections 1.1.9, 1.2.1(a) and 1.2.1(f), specifically addressing protection against corruption. See Further Reading below for a link to the document.

The guidance doesn't turn cybersecurity into a simple checklist. What it does is give manufacturers more direction on where cybersecurity becomes a machinery safety issue and how it should be approached.

Start with the Safety of the Machine

The first distinction is important. The Machinery Regulation isn't trying to turn every machine manufacturer into an IT cybersecurity company.

For Annex III, the focus is on situations where accidental or intentional corruption can affect machinery safety. In practice, manufacturers should start with the machine's risk assessment and the measures being relied upon to reduce risk. Then consider whether corruption of hardware, software, signals, data, or configuration could cause one of those measures to fail or behave differently than intended.

Consider a machine using a programmable safety controller to monitor an interlocked guard. The question isn't simply whether someone could access the controller. The machinery safety question is whether accidental or intentional changes to the controller, its safety parameters, or the signals it receives could defeat the protective function.

A cyber weakness becomes a Machinery Regulation issue when this corruption can undermine something the manufacturer relies upon to keep the machine safe.

A Connection Is more than an Internet Connection

When people hear machinery cybersecurity, the first thought is often an ethernet connection, cloud service, or remote-access connection. The new guidance that was published takes a broader approach.

Manufacturers need to consider physical and logical connections, whether wired or wireless, temporary or permanent, direct or indirect. Depending on the machine, this could include engineering workstations, removable devices, programming interfaces, service connections, and communication between components.

This means the assessment shouldn't stop with the question, “Is this machine connected to the internet?”

Instead, identify the paths that could provide access to safety-related hardware, software, signals, data, or configurations and then determine whether corruption through one of those paths could lead to a hazardous situation.

Connect Security to the Machinery Risk Assessment

Once those connections and dependencies are understood, manufacturers need to consider what could happen if they are corrupted. This is where the machinery risk assessment and security risk assessment need to come together:

• The machinery risk assessment identifies hazards and the measures used to reduce risk.
• The security assessment considers whether accidental corruption or a reasonably foreseeable malicious attempt could undermine those measures.

For example, a remote service connection may allow an engineer to change drive parameters. If those parameters influence a safety-related speed limit, the connection now has a potential machinery safety consequence.

Think about the Machine as it Is Delivered

The guidance also addresses the condition of machinery when it is supplied.

A machine may need remote access for commissioning, diagnostics or service. That doesn't necessarily mean the access should be active when the machine is delivered. The guidance gives remote access being deactivated by default as one example of supplying machinery in a secure state.

For manufacturers, this brings the discussion into machine configuration and instructions. Which interfaces are active when the machine is shipped? How are they enabled? Who should be able to enable them? What information does the user need to operate them securely?

Cybersecurity isn't just a feature to be added to the control system; the design, default configuration, commissioning process, and instructions can all form part of the solution.

The Machine Doesn't Always Have to Keep Running

Another useful clarification concerns what happens if corruption occurs. The Machinery Regulation is concerned with preventing hazardous situations. That doesn't necessarily mean maintaining normal operation after corruption.

Depending on the machinery and its risk assessment, moving to a safe state, such as stopping the machine, may be an appropriate response. This should be familiar thinking for machinery engineers. We already consider what happens when a component fails, communication is lost or a safety-related control function can no longer perform as intended. Cybersecurity introduces another potential cause that needs to be considered.

The engineering question remains the same: what must the machine do to remain safe when something it relies upon can no longer be trusted?

Don't Forget the Evidence

Protection against corruption also has a lifecycle and documentation side.

The Machinery Regulation includes requirements relating to safety-related software and the tracing of interventions. Annex III, Section 1.2.1(f) includes a five-year availability requirement associated with traces of interventions and versions of safety software uploaded after the machinery has been placed on the market or put into service.

Think about the machine three or four years after installation. A controller may have been replaced, firmware updated or safety parameters changed during service. If someone needs to establish which safety software was installed after an intervention, can the manufacturer's systems answer that question?

This makes software identification, configuration control, and intervention records part of the conformity process.

What Should Manufacturers Do Now?

The new guidance provides more direction, but manufacturers still need to apply it to their own machinery and control architecture. A practical review can start with five steps:

1. Identify the functions and measures relied upon to keep the machine safe.
2. Identify the hardware, software, data, and configurations those measures depend upon.
3. Map the connections and interfaces that can influence them.
4. Consider accidental corruption and reasonably foreseeable malicious attempts that could affect safety.
5. Define the necessary protection, safe response, and compliance evidence.

These aren't five new requirements created by the guidance, they are a practical way to organize engineering work around the requirements already contained in Annex III.

Regulation (EU) 2023/1230 applies from 20 January 2027. Manufacturers need to be moving beyond simply identifying protection against corruption as a new requirement. The next step is understanding where corruption could affect their specific machinery and addressing those risks while the design, control architecture, and documentation can still be changed.

Start with the safety functions, follow the paths that can influence them, and build protection against corruption into the machine rather than adding cybersecurity at the end.

Further Reading

• Cybersecurity Under the Machinery Regulation and Cyber Resilience Act: Intertek's existing webinar covers protection against corruption, prEN 50742 and the relationship between the Machinery Regulation and the Cyber Resilience Act.

• European Commission | Endorsed Partial Guide to the Application of the Machinery Regulation: Read the guidance on Annex III, Sections 1.1.9 and 1.2.1(a) and (f), covering protection against corruption and the safety and reliability of control systems. The Commission notification identifies this as the endorsed partial guide for these provisions.