Machinery Regulation
Cybersecurity becomes a requirement for machinery
The Machinery Regulation replaces the Machinery Directive from 20 January 2027. For the first time, cybersecurity is an essential health and safety requirement. The requirements apply to machine builders.
The regulation
Two cybersecurity requirements
The Machinery Regulation is Regulation (EU) 2023/1230. Two requirements in Annex III concern cybersecurity.
1.1.9 Protection against corruption
Connecting another device or using remote access must not lead to a hazardous situation. Software and data that are critical for safety must be protected against changes, whether accidental or intentional.
1.2.1 Safety and reliability of control systems
The control system must withstand intentional attempts to create hazardous situations.
The requirements apply to machinery placed on the market from 20 January 2027.
Dates
Check the status before you plan
Industry associations have asked the EU to postpone the two requirements to 11 December 2027. That is when the Cyber Resilience Act also applies in full. As of October 2026 we had seen no decision to postpone them. So plan for 20 January 2027.
A standard, EN 50742, is being developed to support the requirements. Check whether it has been published and cited by the EU. Only then does it give a presumption of conformity.
The review
What XoT helps with
The table shows what the machine builder needs and what XoT does. Rows where XoT helps are highlighted in green.
| Need | What XoT does | XoT |
|---|---|---|
| Only authorised people and devices reach the control system | A Lock in front of the machine. Access per person, device and time. | Yes |
| Remote service without opening the machine to the network | Outbound-only connections via the XoT-Bridge. No inbound ports. | Yes |
| Evidence of who connected and when | The XMS logs every connection and every policy change. Browser sessions are recorded. | Yes |
| Protection of the control system's own logic and firmware | XoT protects the path to the control system, not the program in it. | No |
| Logging of changes inside the control system | That happens in the control system. | No |
| The machine builder's risk assessment | The machine builder does that. | No |
Whether XoT is sufficient for your risk assessment is your decision as the machine builder.
Together with the CRA
The Machinery Regulation and the Cyber Resilience Act
A machine with a network connection is often covered by both regulations. The Machinery Regulation is about keeping people safe. The Cyber Resilience Act is about the product's cybersecurity over its whole life.
Work for the CRA can support the Machinery Regulation requirements. But you need to show the link in the technical documentation. Each regulation has its own conformity assessment.
Common questions
Does the Machinery Regulation apply to XoT?
No. XoT is not machinery. Machine builders who integrate XoT can download a product description for their technical file.
Does the machine meet the requirements if we use XoT?
Not through XoT alone. XoT helps with access, remote service and logs. You assess the machine as a whole as the machine builder.
Do the requirements apply to machines already delivered?
They apply to machinery placed on the market from 20 January 2027. A machine that is substantially modified can count as a new machine. Check what applies to your machine.
Can we fit XoT to machines already at customer sites?
Yes. The Lock is installed in front of the machine, and the machine does not need to change. Check whether the addition counts as a substantial modification.
This is our reading of the regulation, not legal advice.
Do you build machines?
We are happy to describe how XoT can be part of your machine and your technical documentation.