The Machinery Regulation is coming: who carries the liability when machines change?

From directive to regulation

The Machinery Regulation (EU) 2023/1230 ^[1] replaces the Machinery Directive from 20 January 2027. It applies to machines placed on the market after that date, not to machines already out there under the old rules ^[2].

The shift matters. A directive tells member states what to achieve and lets them choose how. A regulation applies directly. One text, across the EU, with fewer gaps for national interpretation.

The new regulation adds requirements that weren't there before. Two stand out: logging safety-relevant software changes, and liability when machines are modified.

Software is part of the machine

Under the old directive, software was often treated as something separate, almost invisible. The new regulation is blunt: software counts. If it affects safety, it's part of the machine, and the manufacturer has to think about it from the start ^[1].

That means:

• Safety-relevant software changes must be logged and kept traceable for five years.
• The machine must be protected against software corruption.
• Self-learning machinery, which can change its behaviour through use, has extra obligations.

Think of it like the service book for a car. You know what was done, when and by whom. The regulation wants the same for machines: a trail you can follow if something goes wrong.

Who becomes the manufacturer?

Here's where it gets interesting. Say you buy a machine and modify it. Not just a new paint job, but something substantial: a new control system, an upgraded arm, a different safety sensor. Under the regulation, you might become the manufacturer for the modified parts, or even for the whole machine ^[3].

The test is whether the modification is substantial enough to affect compliance with the essential health and safety requirements. If it is, you're on the hook for CE marking, documentation and liability.

It's the same principle as if you rebuild an old tractor and fit it with a modern engine and brakes: at some point it stops being the original maker's tractor and becomes yours, at least in the eyes of the law.

The logging requirement

Article 10 and Annex III say that safety-relevant software changes must be logged in a way that makes them traceable ^[1]. The log must be kept for five years from when the machine is placed on the market, or longer if national law says so.

What counts as safety-relevant? Anything that could affect whether the machine meets the essential requirements: emergency stops, guards, speed limits, sensors. A cosmetic tweak to a display probably doesn't count. A firmware update that changes how the emergency stop works definitely does.

The regulation doesn't say how to protect the log, just that it must be traceable. Traceable means you can show what changed, when and in what version. A log that someone with access can quietly edit is traceable in the narrow sense, but harder to rely on if there's a dispute.

Self-learning machinery

Self-learning systems, where the machine changes its behaviour through use, get their own section in Annex III ^[1]. The manufacturer must:

• identify risks that can arise from the learning process,
• put in measures to keep risks acceptable, and
• make sure any learning stays within the intended limits.

Say a sorting robot learns to speed up by skipping a safety check. That's the kind of drift the regulation wants manufacturers to think about and prevent. The log becomes doubly important, because it's your record of what the machine learned and when.

What this means for you

If you make, import, modify or integrate machines:

• Check whether your software changes are safety-relevant. If they are, you need a logging system that keeps a trail for five years.
• Decide now how you'll protect those logs. The regulation asks for traceability, and a log that holds up under scrutiny is easier to defend than one kept in a file anyone with admin rights can rewrite.
• Think about modifications. If you substantially change a machine, you might become the manufacturer, with all the obligations that entails. Document what you changed, why and when.
• For self-learning systems, map the risks from learning behaviour and decide how you'll keep it within safe bounds.
• If you buy machines from outside the EU, remember that as an importer you're treated as the manufacturer for compliance purposes.

The five-year clock starts when the machine is placed on the market. That's a long time to keep a log trustworthy.

Sealing the change log

This is where a digital witness fits. The thing to seal is each software change record as it's written to the log: the version number, what changed, when and who approved it.

Sealing takes a fingerprint of the record, not the record itself, so the log stays in your system. When the five years are up, or when a notified body or an inspector asks to see the trail, anyone you share it with can check that the record is still the one written on the day of the change. Change a single character and the fingerprint won't match.

It doesn't show that the change was safe, or that the machine still meets the requirements. It shows that the log hasn't been quietly rewritten, even by someone with the keys to the system. For a manufacturer facing a dispute, that's the difference between a log people can question and one they can check.

You can seal change records through WitniumChain's REST API, SDK or MCP server, as part of your release or deployment pipeline. The content never leaves your systems. Read the docs to see how it works.

How it would work

1. Your change management system writes a record to the log: version, changes, approver and timestamp.
2. The system sends a fingerprint of that record to WitniumChain and gets a witness ID back.
3. When an inspector or a customer asks for the trail, you hand over the log and the witness IDs. They calculate the fingerprints and check them against the sealed ones.

What to watch

• 20 January 2027: the Machinery Regulation starts to apply to machines placed on the market.
• National market surveillance: each member state will enforce the regulation through its market surveillance authority. Penalties will be set nationally.
• Notified body guidance: as notified bodies start certifying machines under the new regulation, expect clearer guidance on what counts as a substantial modification and how detailed the logging must be.
• Product liability: the new Product Liability Directive, which treats software as a product from 9 December 2026, runs in parallel. A machine with software is a product under both rules.

The Machinery Regulation closes a gap that was visible for years: software matters, changes matter, and someone has to keep the record. From January 2027, that someone is named, and the trail has to last.