Europe's Machine Safety Rules Get a Cybersecurity Deadline — and Designers Are Rethinking the Basics
Published on 10/25/2026 at 05:41 | Editorial boerse-global.de
From 20 January 2027, machinery sold in the European Union will have to clear a hurdle that has nothing to do with moving parts. Regulation 2023/1230, the EU's new Machinery Regulation, explicitly requires manufacturers to assess cyber threats to programmable logic controllers, sensors and network interfaces — and to fold risks such as unauthorised access, malware and overload attacks into their safety concepts as a matter of course.
That shift lands on top of an engineering discipline that already demands rigour at every stage. Systematic risk assessment underpins both the design and the legally compliant operation of industrial plant. Under the ISO 12100:2010 framework, the process is iterative and begins with precisely defining the boundaries of the machine itself.
Designers and manufacturers must capture potential hazards across a product's entire lifecycle so that dangers to operating and maintenance staff are minimised from the outset.
A thorough risk assessment is only as strong as the paperwork behind it — and gaps in the documentation are where employers get caught out. A free toolkit gives you 41 ready-to-use templates and checklists covering fire safety, manual handling, first aid and lone working, so the evidence trail is in place before anyone asks for it. Download the free Risk Assessment Toolkit
Eight hazard types, and a formula for judging them
Identifying potential sources of danger sits at the heart of the analysis. Technical guidance distinguishes eight fundamental hazard categories, which include complex combined hazards.
To grade risk in a practical way, companies often turn to a semi-quantitative method. The risk value R is calculated as R = S Ă— F Ă— O Ă— A, where severity, frequency, probability of occurrence and possibility of avoidance each take a value from one to four. In-house policies frequently set a threshold of R less than or equal to 8 as an acceptable residual risk.
The standard prescribes a fixed hierarchy for bringing identified risks down. Inherently safe design always comes first, eliminating hazard points through engineering itself. Only where that is technically impossible do separating or non-separating protective devices come into play. Passing on usage information and warnings in the operating manual forms the final tier of risk reduction.
For machines exported into the European single market, that unbroken chain of evidence is mandatory: without a sound risk assessment covering every life phase — from installation through operation and maintenance to disposal — the technical documentation lacks the necessary legal basis.
C-norms outrank the general standards
Putting the framework into practice depends on understanding how the standards stack up. In the international and European rulebook, product-specific C-norms take precedence over the general A-level standards such as ISO 12100, and over B-group norms as well.
For safety-related control systems, ISO 13849 picks up where this process leaves off. It governs electrical, hydraulic, pneumatic and mechanical control systems and defines the required Performance Level from a to e across categories B to 4, taking into account parameters such as mean time to dangerous failure and diagnostic coverage. For more complex software-based architectures, the Safety Integrity Level classification under IEC 62061 applies instead.
A separate layer for the learning machines
As industrial connectivity deepens, hazard analysis is widening its focus onto digital risks. Safety functions built on machine learning are also moving into the spotlight.
As safety concepts take on cyber and software risks, the underlying duty to protect workers hasn't gone anywhere. A free health and safety toolkit bundles the risk assessments, checklists and toolbox talks that UK employers need to meet their legal obligations — covering COSHH, PUWER and more — and it's already used by over 37,000 UK companies. Get the free Health & Safety Toolkit
In these applications, industry experts recommend a clear architectural separation between adaptive analysis systems and a deterministic, independently verifiable safety layer — a split intended to keep mechanical and functional machine safety intact over the long term.
