The EU Machinery Regulation 2023/1230: From Machine Safety to Cyber-Physical Safety
How software, connectivity, cybersecurity, AI, remote access, and digital modification are changing machinery safety
Regulation (EU) 2023/1230 does more than replace Directive 2006/42/EC with a directly applicable machinery regulation. It extends machinery safety into the digital mechanisms through which modern machines are configured, programmed, connected, updated, remotely maintained and intentionally manipulated. This article examines that transition from conventional machine safety toward cyber-physical safety, beginning with the Regulation's legal structure, Essential Health and Safety Requirements (EHSRs), conformity-assessment model and rules on digital safety components and substantial modification. It then analyses Annex III §1.1.9 on protection against corruption, §1.2.1 on safety and reliability of control systems, and §1.2.6 on communication-network failure to determine when a cybersecurity weakness becomes a machinery-safety issue. The key distinction is causal: not every vulnerability constitutes machinery non-conformity, but cybersecurity becomes part of the safety case when compromise of software, configuration, data, communications or control authority can invalidate a risk-reduction assumption and produce hazardous machine behaviour. The article therefore connects traditional functional-safety methods under ISO 13849 and IEC 62061 with adversarial threat modelling, IEC TS 63074, IEC 62443 and the emerging EN 50742 machinery-specific standard for protection against corruption. It develops an authority-centric architecture that distinguishes connectivity, observation, operation, configuration, engineering and safety authority; applies that model to remote maintenance, safety-parameter manipulation and cloud-to-control attack paths; and shows why authentication or network segmentation alone cannot preserve a safety case. The analysis also extends into procurement, FAT/SAT, commissioned software and configuration baselines, patching, firmware updates, remote service, change control and the Article 3(16) substantial-modification test. Finally, it places the Machinery Regulation alongside the Cyber Resilience Act, NIS2 and the AI Act to separate product safety, product cybersecurity, organisational cybersecurity and AI-specific obligations. The resulting engineering proposition is that modern machinery conformity increasingly depends not only on the reliability of safety functions, but also on preserving the integrity, provenance and bounded authority of the digital dependencies on which those functions rely.