Regulation & compliance
Machinery cybersecurity
From 20 January 2027, safety functions must be protected against accidental and intentional corruption. Cyber and functional safety now meet in the CE technical file.
Cybersecurity for machinery safety under Regulation (EU) 2023/1230 — linking IEC 62443 to ISO 13849 and IEC 62061
- Category
- Regulation & compliance
- Scope
- EU
- Edition / refs
- Annex III 1.1.9 & 1.2.1 · applies from 20 January 2027
MSA output
- Safety function ↔ zone map
- Threat-to-safety-function assessment
- Technical file evidence
- Engineer sign-off
What is Machinery cybersecurity?
Regulation (EU) 2023/1230 applies from 20 January 2027 and, for the first time in EU machinery law, makes cybersecurity a safety requirement. Annex III 1.1.9 (protection against corruption) requires that connecting another device, directly or remotely, does not lead to a hazardous situation, and that safety-critical hardware, software and data are identified and adequately protected against accidental or intentional corruption, with evidence of legitimate or illegitimate interventions collected.
Annex III 1.2.1 (safety and reliability of control systems) requires control systems to withstand reasonably foreseeable malicious attempts from third parties leading to a hazardous situation, and to keep a tracing log of interventions and safety software versions uploaded after placing on the market. It adds requirements for control systems with fully or partially self-evolving behaviour.
The Regulation sets the requirement; it does not prescribe the method. IEC 62443 is the established series for industrial automation and control system security (zones, conduits and security levels), while ISO 13849 and IEC 62061 cover functional safety. Most manufacturers have no documented method that links the two for each safety function.
In Great Britain, the Supply of Machinery (Safety) Regulations 2008 continue to apply. Manufacturers and panel builders exporting to the EU must meet Regulation (EU) 2023/1230 for machinery placed on the EU market from 20 January 2027.
Who it applies to
- OEMs placing connected or networked machinery on the EU market from 20 January 2027
- Control panel builders and system integrators supplying safety controllers, PLCs and remote access
- GB manufacturers exporting machinery or panels to the EU
- Functional safety and OT security engineers who must evidence both disciplines in one technical file
Key requirements
- 01
Safe connections (1.1.9)
Connecting another device, locally or remotely, must not lead to a hazardous situation.
- 02
Protect safety-critical software & data
Identify software and data critical to compliance and protect them against accidental or intentional corruption.
- 03
Collect evidence of interventions
Record legitimate or illegitimate interventions in critical hardware, software and configuration.
- 04
Withstand malicious attempts (1.2.1)
Control systems must withstand reasonably foreseeable malicious attempts from third parties that lead to hazards.
- 05
Log safety software versions
Enable a tracing log of interventions and safety software versions uploaded after placing on the market, kept for five years.
- 06
Self-evolving behaviour
Systems with self-evolving logic must not act beyond their defined task and movement space.
Summary for orientation only. Always refer to the current official text of Machinery cybersecurity and any applicable legislation.
MSA for Machinery cybersecurity
What MSA generates
Evidence produced from your engineering inputs, traceable end to end and exported to Word, PDF or Excel.
Safety function ↔ zone map
Each ISO 13849 / IEC 62061 safety function is linked to the IEC 62443 zones, conduits and target security levels it depends on.
Threat-to-safety-function assessment
Corruption and malicious-access threats are assessed for their effect on each safety function, with measures recorded.
Technical file evidence
The assessment exports as traceable CE technical file content against Annex III 1.1.9 and 1.2.1.
Engineer sign-off
Items route through review and sign-off by a certified safety engineer before evidence is issued.
Frequently asked questions
When do the Machinery Regulation cybersecurity requirements apply?
Regulation (EU) 2023/1230 applies from 20 January 2027. From that date machinery placed on the EU market must meet Annex III, including 1.1.9 protection against corruption and 1.2.1 safety and reliability of control systems.
What does "protection against corruption" mean?
Annex III 1.1.9 requires that connecting devices does not create hazards, that safety-critical hardware, software and data are protected against accidental or intentional corruption, and that evidence of interventions is collected.
Is IEC 62443 mandatory under the Machinery Regulation?
No. The Regulation sets essential requirements, not a method. IEC 62443 is a widely used series for industrial control system security and is a practical way to structure the assessment alongside ISO 13849 or IEC 62061.
How do IEC 62443 and ISO 13849 fit together?
ISO 13849 and IEC 62061 define how reliable a safety function must be. IEC 62443 defines how the systems it runs on are protected. Linking each safety function to its zones, conduits and security levels shows a cyber threat cannot defeat it unnoticed.
Does this apply to machinery sold in Great Britain?
GB continues to apply the Supply of Machinery (Safety) Regulations 2008. Machinery or panels exported to the EU and placed on the market from 20 January 2027 must comply with Regulation (EU) 2023/1230.
Generate Machinery cybersecurity evidence from your own data
See how MSA turns your requirements, drawings and process data into certification-ready documents — fully offline.