ConformTest · Machinery insights
A machinery cybersecurity checklist should connect digital access to possible physical harm. Review who can reach the controls, what they can change, how safety functions remain effective and what evidence demonstrates protection. Start during design: access architecture, software support and safe update arrangements are much harder to correct once a machine is installed and production depends on it.
Legislation and standards checked:
A maintenance connection may look harmless until it changes how a machine stops. For manufacturers and integrators, the useful starting point is a safety scenario, followed by a design decision and a repeatable verification check.
Where Do the Requirements Come From?
Annex III, 1.1.9 addresses corruption affecting safety: protect relevant connection hardware, software and data, identify installed safety software and collect evidence of relevant interventions. A service connection must not create a hazardous situation.
Annex III, 1.2.1 addresses reliable, safe control behaviour, including resistance appropriate to the risks from foreseeable malicious interference. For example, a corrupted operating command must not compromise a protective stop. [1]
| Market | Position for machinery supply |
|---|---|
| European Union | Directive 2006/42/EC applies until 19 January 2027. Regulation (EU) 2023/1230 applies principally from 20 January 2027. UK exporters must meet the applicable EU requirements. [1] |
| Great Britain | The Supply of Machinery (Safety) Regulations 2008 remain the domestic framework, with UKCA and recognised CE routes. From 20 January 2027, SI 2026/867 updates recognition to the EU Regulation, subject to its conditions; it does not directly apply EU law in GB. [2, 3] |
| Northern Ireland | EU machinery rules apply under the Windsor Framework, moving to the Regulation on 20 January 2027. SI 2026/867 provides enforcement arrangements. CE applies; CE + UKNI is required where a UK notified body carries out the required third-party assessment. [3, 4] |
For the GB recognition route, check the amended regulation 12A conditions, including conformity assessment, English documentation and instructions, declarations and marking. [3]
Machinery Cybersecurity Checklist: 11 Areas to Review
Include the programmable logic controller (PLC), human–machine interface (HMI), drives and maintenance tools. Review offline equipment too: removable media and local service ports can reach safety-relevant settings.
Legal duty: meet applicable safety requirements. Risk-based measures: choose justified controls, such as restricted access or authenticated updates. Good practice: organise evidence and assign owners. These examples are not a universal mandatory technology list.
| Check area | Questions to ask | Example evidence |
|---|---|---|
| 1. Interfaces and access points | Can a contractor reach the palletiser through an unused Ethernet socket, USB port, service connector or wireless gateway? | An annotated connection inventory recording purpose, access owner and disabled interfaces. |
| 2. Protection of safety functions | Could a network command defeat emergency stopping, a gate interlock, a speed limit or safe torque off (STO)? | A safety-function map and controlled tests showing that unauthorised commands cannot override the protective response. |
| 3. Access control | Can a shift operator load engineering settings? Are default passwords removed and cabinet keys controlled? | Role-permission tests, commissioning records and a physical-access register. |
| 4. Remote access and maintenance | Can a service session start a conveyor while someone is clearing a blockage? Who authorises and terminates access? | A session approval procedure, timeout checks and validation of local operating-mode restrictions. |
| 5. Software integrity and updates | How does a dosing machine reject an altered update, and what happens if installation loses power? | Package-authenticity checks, an approved update procedure and interrupted-update recovery tests under safe conditions. |
| 6. Safety parameters and configuration | Can a recipe import overwrite a safe-speed limit on a winding machine? | Protected parameter baselines, rejected-change test results and authorised change records. |
| 7. Intervention records and traceability | Can you reconstruct a safety-software upload and relevant intervention after replacing a controller? | Version identifiers, dated intervention records and a tested logging and retention design. |
| 8. Wireless controls | Could a neighbouring handset command the lifting table, or could lost communication leave movement enabled? | Pairing checks, unauthorised-command rejection tests and measured communication-loss behaviour. |
| 9. Third-party components | Which gateway or software dependency is unsupported, and could a supplier vulnerability affect a safety function? | Component versions, support commitments, vulnerability reviews and a software bill of materials (SBOM), where appropriate. |
| 10. Response to detected corruption | If a configuration check fails, can an axis stop without dropping its suspended load? | A defined safe-response sequence and controlled fault tests covering braking, load retention and restart. |
| 11. Instructions for the user | Does the installer know who controls accounts, approves updates and revalidates safety after maintenance? | Machine-specific commissioning instructions, access rules, update responsibilities and recovery guidance. |
What does the five-year provision actually cover?
Annex III 1.2.1(f) requires a tracing log for intervention-related data and safety-software versions uploaded after placing on the market or putting into service, enabled for five years after the upload. Its exclusive purpose is demonstrating Annex III conformity following a competent national authority’s reasoned request. It is not a blanket five-year rule for every machinery or IT event log. [1]
- 01Digital accessService laptop connection
- 02Possible interferenceUnauthorised speed-setting change
- 03Safety consequenceHazardous movement during setup
- 04Protective measureRestricted, validated configuration changes
- 05Verification evidenceRejected-change test and approved baseline
Illustrative engineering example; the appropriate measure depends on the risk assessment.
Which Standards Can Help?
| Document | Practical purpose | Important limitation |
|---|---|---|
| ISO/TR 22100-4:2018 [7] | Guidance linking machinery risk assessment with information-security concerns. | A technical report, not a certification specification. |
| IEC TS 63074:2023 [8] | Technical specification on cybersecurity aspects affecting safety-related control systems. | Does not cover every cybersecurity issue or replace functional-safety assessment. |
| IEC 62443-3-2 and 3-3 [9] | System security risk assessment, zones and conduits; system security requirements. | Select requirements for the actual architecture and risks. |
| IEC 62443-4-1 and 4-2 [9] | Secure product development processes; component security requirements. | A component or development-process claim does not establish whole-machine compliance. |
| EN ISO 12100; EN ISO 13849-1; EN IEC 62061 [10] | Risk reduction and the design, integration and validation of safety-related controls. | Functional-safety evidence alone does not demonstrate resistance to malicious interference. |
| FprEN 50742:2026 [11] | Draft machinery protection-against-corruption framework, following prEN 50742. | DKE lists the September 2026 text as a current final draft, not a published final EN. |
A draft, a published standard and an Official Journal citation are different milestones. Publication alone gives no presumption of conformity. Check the exact edition, legislation, covered requirements and restrictions. The Commission’s checked page states that the first Regulation-specific list is being prepared; Directive citations do not automatically transfer. [12]
What Should Be Included in the Technical File?
Build an evidence trail that another engineer can follow. Use a shared reference number to connect each identified hazard to its protective measure, verification result and released configuration.
- Describe the system: architecture, interfaces, operating modes and supplier components.
- Explain the risk: affected safety functions, foreseeable interference and consequences.
- Justify protection: selected measures, assumptions and responsibilities.
- Demonstrate performance: test conditions, acceptance criteria, results and unresolved actions.
- Control the baseline: software versions, parameter sets, interventions and update history.
- Support safe use: commissioning, maintenance, recovery and user instructions.
For example, link a rejected configuration-change test to both the corruption-protection requirement and the affected safety function. Where the CRA also applies, reuse relevant architecture and component records through a requirements matrix, while checking each law’s separate obligations. An SBOM helps identify dependencies; it is not, by itself, proof of machinery safety.
This structure supports the technical documentation required by Annex IV. Keep the broader technical-file retention duty separate from the specific tracing-log provision. [1]
Common Mistakes
- “It has no internet connection.” A technician’s USB stick can still introduce an unsafe change.
- “The customer has a firewall.” Document installation assumptions and the machine’s own protective measures.
- One shared engineering account. You cannot reliably attribute changes or withdraw one person’s access.
- Unprotected safety parameters. Routine production settings should not expose safety limits.
- Unrecorded software changes. A passed test is weak evidence if the released version is unknown.
How ConformTest Can Support Your Machinery Assessment
ConformTest supports machinery compliance assessment, risk assessment and technical documentation review. We can help connect the machine’s intended use, relevant safety requirements and available evidence, then identify gaps within an agreed scope.
Our CE marking support also addresses the conformity route and documentation. Any specialist cybersecurity testing or statutory third-party assessment requires a separately defined scope and confirmed provider.
Discuss Your Machinery Compliance RequirementsFrequently Asked Questions
Does this apply to machines without internet access?
Relevant safety risks can arise through USB, removable storage, local programming ports or wireless controls. Assess actual access paths and their consequences.
Is IEC 62443 certification compulsory?
There is no blanket requirement in the Machinery Regulation for every machine to hold IEC 62443 certification. Select appropriate evidence and the applicable conformity assessment route.
Can a UK manufacturer use this checklist for EU exports?
Yes. Apply EU requirements for the placing-on-market or first-use date, alongside any other applicable product legislation.
Does completing the checklist establish conformity?
No. It identifies review areas. The manufacturer must resolve findings, verify measures and complete the applicable assessment, documentation and declaration requirements.
Official Sources
Legislation and standards status checked: 21 October 2026. Catalogue descriptions establish document scope and status; they do not replace the complete standards.
- Regulation (EU) 2023/1230, Annex III 1.1.9 and 1.2.1(f), Annex IV, Articles 51–54; European Commission machinery guidance.
- Supply of Machinery (Safety) Regulations 2008; UK Government product-marking guidance.
- SI 2026/867, regulation 1, Part 2 and Part 3.
- UK Government machinery legislation response, Great Britain and Windsor Framework context.
- Regulation (EU) 2024/2847, Articles 2, 14, 69 and 71.
- European Commission CRA overview; manufacturer reporting obligations.
- ISO/TR 22100-4:2018, ISO catalogue.
- IEC TS 63074:2023, IEC catalogue.
- IEC catalogue: 62443-3-2:2020, 62443-3-3:2013, 62443-4-1:2018, 62443-4-2:2019.
- BSI catalogue: EN ISO 12100:2010, EN ISO 13849-1:2023, EN IEC 62061:2021+A2:2026.
- DKE: FprEN 50742:2026-09, final-draft status.
- European Commission machinery harmonised-standards page, Official Journal references and Regulation transition.
Images are AI-generated illustrative scenes, not photographs of ConformTest personnel or facilities.