The Machinery Regulation logs safety changes for five years from January 2027

A new rulebook for machines

From 20 January 2027, a new regulation replaces the old Machinery Directive for everything sold or put into service from that date. The Machinery Regulation (EU) 2023/1230 doesn't touch machinery already on the market under the directive, but for anything new the rules have changed ^[1].

One of the clearest changes is about software. When software determines how a machine behaves in a way that affects safety, the manufacturer has to keep a log of changes, protect that log against tampering and be able to trace it back for five years.

Think of it like a service book for a car. Nobody looks at it when things are running smoothly, but if there's a fault or an accident the question is often what was done, when and by whom. The regulation wants that same paper trail for safety software in machinery, and it wants the trail kept in a way that holds up.

What counts as safety-relevant

The regulation doesn't define every detail of what safety-relevant means, but the principle is straightforward: if a change to the software can affect how safely the machine operates, it counts. That includes updates, patches and modifications.

For self-learning machinery, the rules go further. A self-learning machine is one that changes its behaviour on the basis of data or experience. If that learning can affect safety, the manufacturer has to monitor the machine after it's deployed, check that it stays within its intended limits and have a way to intervene if it doesn't ^[1].

The five-year log

The regulation asks for a log that can be traced for five years after the machine was placed on the market. The log covers safety-relevant software changes: what was changed, when and, where it matters, why.

The regulation also says the machine must be protected against corruption ^[1]. That means more than just keeping the log somewhere. Someone has to be able to check, years later, that the log hasn't been rewritten after the fact.

That's harder than it sounds. The people who keep the log are often the same people who could edit it. Access controls and monitoring help, but they don't answer the question a court, an inspector or an insurer is likely to ask: how do you know nobody with the right access changed it anyway?

What this means for you

If you make or sell machinery, and the software in it affects safety, here are three questions to ask now:

• Do you have a way to log safety-relevant software changes automatically, so nothing gets missed?
• Can you show, five years from now, that the log is exactly what was written at the time?
• If the machine learns, do you have monitoring in place to check it stays safe, and a plan for what to do if it doesn't?

The regulation applies from 20 January 2027, so there's time to get this right. The part about corruption protection is easy to skip over when reading the rules, but it's the part that will matter in a dispute.

Sealing the log

This is where a digital witness fits. The thing to seal is the log record each time a safety-relevant change is made: what was changed, the version number, the date and who approved it. Sealing takes a fingerprint of the record, not the record itself, so the log never leaves your systems.

If the log is questioned three years later, anyone you share it with can check that it matches the fingerprint sealed at the time. If someone has changed even one character, the check will fail.

A digital witness doesn't show that the change was safe, or that the log is complete. It shows that the log you're presenting is the one written on the day, unchanged since it was sealed.

You seal each change as it's logged, through WitniumChain's REST API, SDK or MCP server. The content stays with you. The first 2,000 witnesses a month are free. Read the documentation to see how it works.

How it would work

1. Each time a safety-relevant software change is logged, your system sends a fingerprint to WitniumChain and gets a witness ID back.
2. The log and the witness ID are stored together in your records.
3. When the log is checked, the fingerprint is recalculated and compared with the sealed one.

What to watch

The Machinery Regulation applies from 20 January 2027, to machinery placed on the market or put into service from that date. Machinery already on the market under the old directive isn't affected ^[1].

For self-learning machinery, keep an eye on how notified bodies interpret the monitoring and intervention duties. The regulation sets the principle, but the detail will come from how it's applied in practice.

If you work with machinery that uses AI in a way that affects safety, this regulation is one to read alongside the AI Act. The overlap is real, and the logging duties complement each other.