On 20 January 2027, the Machinery Regulation (EU) 2023/1230 replaces the previous Machinery Directive 2006/42/EC. Much remains familiar: risk assessment, essential health and safety requirements, CE marking. One change, however, directly affects machine builders and control engineers: protection against tampering and cyberattacks is now explicitly part of machine safety. Anyone placing a machine on the market must show that an intervention via the network or software cannot create a hazardous situation.

What is new?

  • Regulation instead of directive: It applies directly in all EU member states without national transposition. Different interpretations from country to country disappear.
  • Software counts: Software that performs a safety function and is supplied separately can also be a safety component.
  • Substantial modification: Anyone who modifies a machine after the fact in a way that creates new hazards is considered the manufacturer. This also applies to retrofits and software extensions.
  • Digital instructions: They are permitted. However, instructions must still be provided on paper if the customer requests it.

The two cybersecurity requirements

Cybersecurity is covered in Annex III of the regulation, in two sections:

1.1.9 Protection against corruption

  • Connecting another device, including via remote access, must not lead to a hazardous situation.
  • Hardware that carries safety-relevant signals or data must be protected against accidental and intentional corruption.
  • Software and data that are critical for the safety of the machine must be identified and protected.
  • The machine must collect evidence of legitimate and illegitimate interventions in this software and its configuration.

1.2.1 Safety and reliability of control systems

  • Control systems must also withstand malicious attempts by third parties that could lead to a hazardous situation.
  • Interventions in the control system and uploaded versions of the safety software must be logged. These records must be available for five years so that the manufacturer can demonstrate conformity at the request of the authorities.

In practice this means: access protection alone is not enough. It must also be traceable who changed what in the safety-relevant software, and when.

Cyber Resilience Act and IEC 62443

In parallel, the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is coming into force. It applies to products with digital elements, including controllers, HMIs and many networked machines. Reporting obligations for actively exploited vulnerabilities have applied since 11 September 2026, the remaining requirements apply from 11 December 2027. Among other things, the CRA requires security by design, vulnerability handling and security updates throughout the product lifecycle.

The two regulations are aligned: meeting the CRA requirements largely covers the cybersecurity requirements of the Machinery Regulation as well. The IEC 62443 series has become the established technical basis:

  • IEC 62443-3-2: risk assessment, dividing the plant into zones and conduits
  • IEC 62443-3-3: system security requirements, graded by security level
  • IEC 62443-4-1 and 4-2: secure development process and requirements for components

Harmonised standards specifically for the cybersecurity requirements of the Machinery Regulation are still being developed. Until then, IEC 62443 is the most sensible benchmark.

On the machine: TIA Portal and SINUMERIK

The good news: many of the required mechanisms are already available in current Siemens controllers. They just need to be used consistently.

  • CPU access protection: Activate the protection levels of the S7-1500 and of the SINUMERIK ONE PLC with a password so that nobody can load or change programs without authorisation.
  • User management: With central user management in TIA Portal (UMAC), people get their own accounts and roles instead of a shared password. This is the basis for traceable interventions.
  • Secure the safety program: Set the F-password and document the collective signature of the safety program. Every change is then detectable via the signature.
  • Secure communication: Use secure PG/HMI communication via TLS and switch off insecure services such as the web server or protocols that are not needed.
  • Separate networks: Connect the machine network and the company network to separate interfaces, with a firewall or security router in between. Allow remote maintenance only through a defined, logged access point.
  • Secure the operator level: In SINUMERIK Operate, configure access levels with password and key switch so that operators can only change what they need for their task.
  • Know-how protection: Apply know-how and copy protection to blocks. This protects intellectual property and prevents unnoticed changes to critical logic.

Checklist for machine builders before 2027

  1. Take stock: Which interfaces does the machine have (Ethernet, USB, remote maintenance, Wi-Fi)? Which software and parameters are safety-relevant?
  2. Extend the risk assessment: Include tampering and remote access as a source of hazards, ideally according to IEC 62443-3-2.
  3. Define a protection concept: Make access protection, user management, network separation and hardening the standard for all machine types.
  4. Set up logging: Record interventions and software versions of the safety functions and keep them for five years.
  5. Update and vulnerability process: Define how vendor security advisories are evaluated and how updates reach the customer.
  6. Update documentation: Switch technical documentation, instructions and the declaration of conformity to the new regulation.
  7. Involve suppliers: Request cybersecurity evidence from suppliers of controllers, drives and software.

Conclusion

With the new Machinery Regulation, cybersecurity changes from an optional extra to an obligation. For machine builders this does not mean reinventing everything: the tools in TIA Portal and SINUMERIK are there, and IEC 62443 provides the framework. What matters is to build the measures into the machine standard early and consistently. There is not much time left before January 2027.

Note: This article provides a technical overview and does not constitute legal advice. The authoritative source is the text of the regulation in the Official Journal of the EU.