The Machinery Regulation arrives in 2027: what *logging, corruption and learning* mean for machine makers

What changes on 20 January 2027

The EU Machinery Regulation (EU) 2023/1230 replaces the Machinery Directive from 20 January 2027 ^[1]. If you make machines, related products or safety components, three things stand out: safety-relevant software changes must be logged and traceable for five years, the machine must be protected against corruption, and machines with self-learning behaviour get extra attention.

Think of it like this: if a car's braking software gets an update, you should be able to show which version was running when something goes wrong, and that nobody has quietly rewritten the log since. That is the logging duty in plain language.

Logging safety-relevant software changes

The regulation asks manufacturers to keep a record of software changes that could affect safety, and to make that record traceable for five years ^[1]. It doesn't say exactly how to protect the log, just that it must exist and be traceable.

That matters when an accident happens and someone asks which software version was running at the time. A log the manufacturer keeps is easier to challenge than one sealed at the moment it was written. The regulation sets the duty; proving the log hasn't been touched is a separate question.

Protection against corruption

The machine must be protected against corruption ^[1]. In practice, that means the software controlling safety functions should resist tampering, whether it comes from outside or from someone with legitimate access.

Again, the regulation says what must be achieved, not how. Access controls, monitoring and checksums are part of it. A sealed fingerprint of each release and each deployment event goes further, because a change shows up even when it is made by someone with administrator rights.

Machines that learn

Machines with self-learning behaviour face additional requirements ^[1]. The regulation doesn't define self-learning in detail, but the intent is clear: when a machine's behaviour changes on its own, its safety functions must stay reliable.

For anyone building machines with AI, this raises the evidence question: can you show what the machine learned, when a behaviour changed, and which version of the model was running at the time? The logging duty covers software updates; whether it covers model updates as well will depend on how notified bodies and national authorities interpret the text.

Who it applies to

The regulation applies to machines placed on the market from 20 January 2027 onwards ^[1]. Machines already on the market under the directive stay under the directive. If you are a manufacturer, you have until early 2027 to decide how to meet the logging and corruption duties, and to work out what counts as safety-relevant in your products.

What this means for you

Here are four questions to ask before the date:

1. Which software changes in our machines affect safety, and how do we record them?
2. Can we show which software version was running on a given machine on a given day, five years from now?
3. How do we protect the machine, and its logs, against corruption?
4. If the machine learns, how do we document what it has learned and when?

The regulation sets the bar. Meeting it is partly about access controls and secure design, and partly about keeping records you can later show to a notified body, a customer or a court.

How a digital witness fits

Here, the thing to seal is each release of safety-relevant software: the build fingerprint, the release notes and the test results. When a machine is deployed or updated in the field, seal a deployment record with the machine's serial number, the software version and the date.

Sealing takes a fingerprint of the record, not the record itself, so the data never leaves your systems. The fingerprint goes to WitniumChain, which returns a witness ID. If the deployment log is questioned three years later, anyone you share it with can check that it is exactly what was recorded on the day. Your system calls the REST API, the SDK or the MCP server as part of the build and deployment pipeline. The first 2,000 witnesses a month are free, and the documentation walks you through it.

What the witness shows is that a release record and its deployment log existed at that time, unchanged since. What it doesn't show is that the version was free of defects, or that the machine was safe. It gives you your own checkable record when someone asks which version was running.

How it would work

1. At release: your build system calculates a fingerprint of the build artefact, release notes and test report, sends it to WitniumChain and stores the witness ID with the release.
2. At deployment: when the software is loaded onto a machine, your deployment tool seals a record with the serial number, software version, date and witness ID of the release.
3. At inspection: an auditor, a notified body or a customer can check the release and deployment records by recalculating the fingerprints and comparing them with the sealed ones.

What to watch

The regulation comes into force on 20 January 2027 ^[1]. Before then, decide which software changes you will log, how you will protect the logs and the machine against corruption, and how you will document self-learning behaviour if your machines have it. Notified bodies will want to see those answers as part of conformity assessment.

If your machines use AI for safety functions, watch the AI Act as well: high-risk AI under Annex I applies from 2 August 2028, and logging duties in Article 12 may overlap with the machinery rules.