Is a software update a substantial modification under the Machinery Regulation?
As a rule no: software updates foreseen by the manufacturer are in principle not a substantial modification. Machinery Regulation (EU) 2023/1230 defines the term in law for the first time in Art. 3(16) and expressly includes digital modifications, so safety-related interventions in the software by third parties may well trigger a substantial modification.
What has changed with the Machinery Regulation?
Under Machinery Directive 2006/42/EC, substantial modification was not a term of the directive text. Interpretation relied on the German Federal Ministry of Labour's paper, which had mainly mechanical and functional changes in view.
Machinery Regulation (EU) 2023/1230 defines the term in law for the first time in Art. 3(16) and expressly includes digital modifications. It is thereby clear that a machine can be substantially modified through a change to its software alone.
This is not a tightening for its own sake: in modern installations the safety function lies mostly in the control system. A change to parameters of the safety PLC can weigh more heavily in safety terms than a mechanical conversion.
When is an update uncritical?
- The update comes from the manufacturer and was foreseen as part of intended operation.
- The manufacturer's risk assessment covers the update because it was already taken into account at the design stage.
- It concerns exclusively non-safety-related functions: visualisation, reporting, connection to higher-level systems.
- Safety functions, their parameters and the performance level achieved remain unchanged.
- No new hazards arise and no existing risk increases.
When can a software intervention be a substantial modification?
- A third party or the operating company changes parameters of the safety control system, such as run-down times, muting conditions or zone logic.
- A safety function is added, removed or changed in its effect.
- The software extends the intended use, for example new operating modes or higher speeds.
- A retrofit replaces the control system with a new one having its own safety logic.
- Self-learning functions change the behaviour of the machine beyond what the manufacturer assessed.
How do I assess a specific update?
What applies to self-learning safety functions?
Machinery and safety components with fully or partly self-evolving behaviour based on machine learning are listed in Annex I Part A of the Machinery Regulation. For them, involving a notified body is mandatory; internal production control is ruled out.
This does not affect every piece of software with adaptive elements. What matters is whether the safety-related behaviour evolves by itself, that is whether it reacts differently after being placed on the market than it did at the time of conformity assessment.
If you use learning methods, draw a clean line in the documentation between which functions are safety-related and which are not. That distinction determines the conformity assessment procedure to be applied.
What does the Machinery Regulation additionally require on cybersecurity?
Annex III number 1.1.9 makes protection against corruption an essential safety requirement. Safety-related software and data have to be protected against unintentional or intentional corruption.
In practice this means: evidence that only authorised software reaches the control system, logging of changes to safety-related parameters, and a defined process for installing updates.
The update process itself thereby becomes part of conformity, not just the individual update.
Sources and standards
- Machinery Regulation (EU) 2023/1230, Art. 3(16): definition of substantial modification
- Machinery Regulation (EU) 2023/1230, Annex I Part A, self-evolving behaviour
- Machinery Regulation (EU) 2023/1230, Annex III No. 1.1.9: protection against corruption
- German Federal Ministry of Labour interpretation paper on substantial modification of machinery
- EN ISO 13849-1: safety-related parts of control systems
Editions of standards and their harmonised status change continuously. Check standard numbers and editions against the current list in the Official Journal of the EU before applying them. This article is a technical classification and does not replace legal advice.
Frequently asked questions
Do I have to affix new CE marking after every update?
No. Only if the update amounts to a substantial modification does a new machine come into being with a full conformity assessment. Updates foreseen by the manufacturer are usually not that.
Who is responsible if the operating company installs an update itself?
If the operating company carries out a safety-related intervention amounting to a substantial modification, it becomes the manufacturer of the modified machine, with all duties for risk assessment, documentation and declaration of conformity.
Does this already apply before 20 January 2027?
The legal definition in Art. 3(16) applies from 20 January 2027. Until then Machinery Directive 2006/42/EC applies with the previous interpretation practice. For machinery placed on the market after the deadline you should already base your work on the Machinery Regulation definition.
Do I have to document updates even when they are uncritical?
Yes, that is strongly recommended. Without a record of which software version was on the machine and when, it cannot be demonstrated later that no substantial modification took place. Annex III 1.1.9 requires controlled handling of safety-related software in any case.
Has been guiding CE projects in machinery, plant and special purpose engineering for years. That work led to Kaidoc.app, a software for standards-based CE documentation. Through Knutec.de the same work is available as a personal service.
Write me a few lines about your project. You get a first assessment back, free of charge and without obligation.
This article was produced with AI assistance and reviewed for technical accuracy before publication. Editorial responsibility within the meaning of Art. 50(4) of the AI Act (EU) 2024/1689 lies with Heinrich Knutas.
No credit card required. A complete project to try out.