New machinery regulation requires stricter cybersecurity standards

The new MVO is intended to take account of the increased risks in the areas of digitalization, cyber security and artificial intelligence (AI). (Image source: AdobeStock / Attasit)

As digitalization progresses, machines and devices are integrating more and more software components. The EU has addressed this in its new Machinery Regulation (MDR), which will replace the previous Machinery Directive after a transitional period. This regulation requires adaptations from dealers, manufacturers and operators, with TÜV SÜD providing crucial tips for implementation.

A key component of the change is the replacement of printed operating instructions with a QR code that takes users to a digital version. A printed version only needs to be provided by the manufacturer if specifically requested by the customer. However, Regulation 2023/1230 (MVO) stipulates that paper instructions are still required for machines used by non-professionals.

New addressees

The latest Machinery Ordinance (MVO) responds to the increasing risks posed by digitalization, cybersecurity and artificial intelligence (AI). It aims to better secure machines against misuse and fraud, challenges that are closely linked to the digital transformation. This regulation was created to provide a robust response to these risks and ensure comprehensive protection.

The scope of the MDR is broad and covers a wide range of equipment - from machinery such as agitators, pumps and compressors to distillation, filtration and separation equipment. The regulations also extend to pedelecs that are used in-house and to lifting equipment. Even electrically adjustable desks fall under the provisions of the new MVO.

The new MVO came into force in July 2023 and will replace the previous Machinery Directive 2006/42/EC (Machinery Directive) from January 20, 2027. (Image source: AdobeStock / Attasit)

An important innovation concerns the responsibility for implementing the Machinery Ordinance: The addressees in the regulation are manufacturers, dealers, importers and authorized representatives of the machinery. If operators make “substantial modifications” to the machinery, they are also legally regarded as manufacturers. A “substantial modification” can even be a change to the software. Anyone who makes changes to a purchased machine at the factory must therefore comply with the MVO.

Platform for external attacks is growing

The new Machinery Ordinance (MVO), which came into force in July 2023 and replaces the former Machinery Directive 2006/42/EC, will only be fully effective after a transitional period of 42 months, i.e. from January 20, 2027. TÜV SÜD nevertheless advises preparing for the upcoming changes now in order to prevent safety and liability risks in the event of damage.

With the advent of digitalization, the new MVO considers machines together with their sensors and associated software as a single unit. In recent years, many plants, especially in the chemical and process industries and in mechanical engineering, have been equipped with networked sensors and additional software, which increases the attack surface for cyber attacks. The MVO now takes these technological developments into account at a regulatory level.

The requirements for cyber security, including control systems and the artificial intelligence used, are increasing. The focus is also on autonomous machines, remote-controlled devices and collaborative robots, known as cobots. According to the MVO, all machines must be designed to prevent both intentional and unintentional manipulation, including that which could be carried out via remote access. These specific requirements are set out in Annex III Part B of the Machinery Ordinance, among others.

However, there is a simplification with regard to cybersecurity: Here, the requirements of the GDPR are deemed to have been met if a certification or declaration of conformity in accordance with the European Cybersecurity Act 2019/881 on cybersecurity already exists. In this case, it is assumed that the requirements of the MDR are also met, as defined in sections 1.1.9 and 1.2.1 of the MDR.

Highest safety standards, stricter rules

The MVO intensifies the safety requirements for a specific category of machinery listed in Annex I Part B and divided into six risk categories. Machinery in these categories, which are classified due to their increased risk potential, are subject to a stricter conformity assessment, which cannot be carried out internally but must be carried out by a notified body. The aim is to guarantee compliance with the highest safety standards.

These categories include systems that use artificial intelligence and machine learning for safety functions and can develop independently. Machines in which such systems are integrated must also be assessed by a notified body. Other examples of machines that require an external conformity assessment are removable drive shafts with their protective devices, vehicle maintenance lifts and fastening and assembly devices equipped with magazines for screws or nails.

TÜV SÜD experts recommend regularly checking the annex to the Machinery Directive, as the list of machines that require an assessment by a notified body is constantly being updated. Although the MDR has many similarities with the previous Machinery Directive, the new regulations on cybersecurity and the use of AI in particular bring significant changes.

It is therefore advisable for company decision-makers to prepare for the changes at an early stage. A reassessment of existing machines is often necessary, whether due to changes in software or the addition of machine learning systems. If you act proactively, you can minimize safety and liability risks in the event of damage.