What changes with the new Machinery Regulation, before committing resources

The context

The new Machinery Regulation (EU Reg. 2023/1230, applicable from 2027) brings cybersecurity requirements into machinery CE marking for the first time — and those requirements overlap with the Cyber Resilience Act and the IEC 62443 standard. For a manufacturer of automation cells for sheet-metal processing, that means three regulations bearing on the same product, with overlapping perimeters. Committing resources to a compliance project before understanding the real exposure is the fastest way to spend them badly.

The approach

I ran a targeted pre-analysis: how CRA and IEC 62443 apply to the company’s products under the new Machinery Regulation, where the requirements coincide and where they need to be treated separately, which points will become binding and on what timeline. The goal wasn’t to produce documentation, but to give management the elements to decide if, when and how broadly to launch the actual project.

The outcome

The company now has a clear picture of its exposure and the possible path forward, and is internally evaluating launching the full project. That’s the value of a pre-analysis done well: the decision to invest is made on solid ground, not on the alarm of the moment.