Substantial Modification under Machinery Regulation 2023/1230

What is a substantial modification under Regulation (EU) 2023/1230?

Machines change after delivery. Customers add stations, raise speeds or install new software, and integrators carry out retrofits. At some point the question arises: is this still the original machine, or a new product with a new manufacturer?

The Machinery Directive, Directive 2006/42/EC, did not define this. Regulation (EU) 2023/1230, which applies from 20 January 2027, gives a definition in Article 3, point 16. A substantial modification is:

"a modification of machinery or a related product, by physical or digital means after that machinery or related product has been placed on the market or put into service, which is not foreseen or planned by the manufacturer, and which affects the safety of that machinery or related product, by creating a new hazard, or by increasing an existing risk, which requires: (a) the addition of guards or protective devices to that machinery or related product the processing of which necessitates the modification of the existing safety control system; or (b) the adoption of additional protective measures to ensure the stability or mechanical strength of that machinery or related product".

Two details are easy to miss. "Digital means" are expressly included, so a software change can qualify. Partly completed machinery is not mentioned in the definition. Recital 26 adds that repair and maintenance operations which do not affect compliance with the essential health and safety requirements are not substantial modifications.

For an overview of what else changes in 2027, see our guides Machinery Regulation 2023/1230: key changes and Machinery Directive vs Machinery Regulation.

Article 18: who becomes the manufacturer?

Article 18 sets the consequence. A natural or legal person that carries out a substantial modification is considered to be a manufacturer for the purposes of the Regulation. That person takes on the manufacturer's obligations in Article 10.

The second paragraph of Article 18 is specific. The person must ensure and declare, on its sole responsibility, that the machinery or related product concerned conforms to the applicable requirements. The person must also apply the relevant conformity assessment procedure in Article 25(2), (3) or (4).

Three further points come from the text:

• Scope of the obligations. The obligations apply to the modified machinery or related product. If the modification affects the safety of only one machine in an assembly of machinery, the obligations apply to that affected machine, as demonstrated in the risk assessment. Recital 26 says the modifier should not have to repeat tests or produce new documentation for machines in the assembly that the change does not affect.
• Non-professional users. A non-professional user who substantially modifies their own machinery for their own use is not considered a manufacturer (Article 18, third paragraph). This exception does not cover companies.
• Importers and distributors. They have their own rule in Article 17. They are considered manufacturers if they modify a product already on the market in a way that compliance with the applicable requirements might be affected. That wording is broader than the definition in Article 3(16).

Note that the Regulation does not limit the obligations to the modified parts alone. The unit of assessment is the machine, or the affected machine within an assembly. Where a change is not substantial, the employer still has duties under national rules on the use of work equipment, based on Directive 2009/104/EC.

A practical decision test: is my change a substantial modification?

The definition contains four criteria. All four must be met. A simple way to screen a change is to answer these questions in order and record the answers.

1. Timing. Is the change made after the machine was placed on the market or put into service? Changes made before that are part of the design.
2. Foresight. Was the change not foreseen or planned by the original manufacturer? Recital 32 asks manufacturers to address foreseen future software updates in their risk assessment. If the manufacturer planned, assessed and described an update path, installing that update as described is in most cases not a substantial modification.
3. Effect on safety. Does the change create a new hazard or increase an existing risk? A higher conveyor speed can increase a drawing-in risk. A heavier gripper can create a new crushing hazard. A new paint colour does not affect safety.
4. Protective measures needed. Does the new hazard or higher risk require (a) guards or protective devices whose processing needs a change to the existing safety control system, or (b) additional measures for stability or mechanical strength?

The fourth criterion is the narrowest. If a simple fixed guard solves the problem without any change to the safety control system, the definition is in most cases not met. Borderline cases under letter (a) are still open to interpretation. The Commission guide to the application of the Regulation is in draft as of October 2026, with publication expected in the fourth quarter of 2026. It is expected to give examples, and it will not be legally binding.

Cost is not a criterion, and neither is who does the work. A change by the customer's own maintenance team, by an external integrator or by the original manufacturer's service department is screened in the same way.

Examples to assess: retrofits, software updates and cybersecurity

The cases below are not automatic outcomes. Each one needs the four-question test and a documented risk assessment.

Retrofit of a safety function

A company replaces a relay safety circuit with a safety PLC, adds a robot station, or changes the light curtain muting so that pallets pass more quickly. The work order says "maintenance". If the change was not foreseen by the manufacturer, creates a new hazard or raises a risk, and needs new protective devices processed by a modified safety control system, it is a substantial modification. Whoever did the work is then the manufacturer of that machine.

Software update that changes behaviour

An update that changes a safe speed, a stopping sequence or a muting logic is a digital modification. Whether it is substantial depends mainly on criteria 2 and 4: was the update foreseen by the manufacturer, and does it require new or changed protective measures in the safety control system? An update outside the manufacturer's planned path deserves a careful look.

Untested software or firmware changes

A firmware update is pushed to the safety PLC of several machines remotely, nobody runs regression tests of the safety functions, and nobody records the new version. This is first a quality and compliance gap. Annex III, section 1.2.1, point (f) asks for a tracing log of safety software versions uploaded after placing on the market, kept for five years after the upload. Section 1.1.9 asks the machine to identify its safety-related software. If such an update changes safety in a way the manufacturer did not foresee, it may also be a substantial modification.

Remote access and cybersecurity

Section 1.1.9 of Annex III requires protection against corruption. The machine must collect evidence of legitimate or illegitimate interventions in its software or configuration. These records help an owner see what was changed, by whom and when. A configuration change made through a remote connection is assessed like any other digital change. If an intervention, authorised or not, has changed a safety function or its settings, check the consequences for safety with the same four questions.

What the modifier must do: risk assessment, documentation, CE marking

When the four criteria are met, the person who made the modification follows the same route as a manufacturer under Articles 10, 18 and 25. In practice:

• Risk assessment of the modified machine, or of the affected machine in an assembly, covering the new hazards and the interactions with the existing parts.
• Technical documentation under Annex IV, including design and test evidence for the changed safety functions. Our guide to the technical file explains how to organise it.
• Conformity assessment under Article 25(2), (3) or (4). If the machine falls in Annex I, Part A, a notified body is always involved. For Part B, internal production control (module A) is possible only if harmonised standards or common specifications covering all relevant requirements are fully applied.
• EU declaration of conformity. Annex V, Part A, point 1 expressly provides for a declaration that identifies a "substantially modified machinery or related product".
• CE marking and updated instructions for use, with the modifier's name and contact details.

Recital 26 states that the new conformity assessment is carried out before the modified product is placed on the market or put into service again.

Checklist for planned changes to machinery

• Record the date the machine was first placed on the market or put into service.
• Check the original risk assessment and instructions for foreseen updates and modifications.
• Describe the change: physical, digital or both.
• List new hazards and risks that increase, using EN ISO 12100 as the method.
• Decide whether the required measures change the safety control system, or need stability or strength measures.
• Record the decision and the reasons, and keep it with the machine file.
• If substantial: plan the risk assessment, technical file, conformity assessment, declaration and CE marking before restarting the machine.
• If not substantial: still verify the safety functions, record software versions and check employer duties under Directive 2009/104/EC.

Our Machinery Regulation course works through the four criteria with exercises, and CE Marking Fundamentals covers the full CE route for non-EU manufacturers. VeridEx provides training only. For a specific case, check the official text and the Commission guide once published.

Key points

• Article 3(16) defines substantial modification with four criteria, and all four must be met.
• Physical and digital changes are both covered, so software updates can qualify.
• Under Article 18, the person who carries out a substantial modification becomes the manufacturer with the obligations of Article 10.
• In an assembly of machinery, the obligations apply to the affected machine, as shown in the risk assessment.
• Manufacturers can reduce uncertainty by describing foreseen software updates in their risk assessment.