2023/1230 — what changes on 20 January 2027

This is the post I wish existed when I first started reading the regulation. I'll try to make it the one you reference when someone in a meeting says "the EU thing in 2027."

Four dates

June 2023 · published in the Official Journal

Regulation (EU) 2023/1230 was published in the Official Journal of the European Union. Publication is when the clock on the transition periods starts.

July 2023 · entry into force

Under the standard EU rule, the regulation entered into force on the twentieth day after publication — July 2023. Entry into force is not the same as "applies to your product." It's the point at which the legal text becomes part of EU law.

July 2024 · partial application

A set of provisions — notably those concerning the notified bodies that will perform conformity assessments — began to apply. These early-applying provisions don't yet change what manufacturers must do, but they do start building the assessment infrastructure the main application will rely on.

20 January 2027 · full application · T-0

This is the date. On 20 January 2027, the Machinery Regulation applies in full. There is no further transition period. The old Machinery Directive 2006/42/EC stops applying on the same day. It is not a gradual handover. It is a replacement.

From 20 January 2027, machinery placed on the EU market must comply with 2023/1230. Machinery already on the EU market before that date is handled under specific transitional rules, but new product placements after the date are in scope of the new regulation.

The replacement, not rollover, point

One thing worth being precise about. The Machinery Regulation is a regulation, not a directive. In EU law those are different instruments with different effects.

A directive sets objectives and each member state transposes it into national law in their own way. That's how the 2006 Machinery Directive worked. National variation was a feature of the system.

A regulation applies directly and uniformly across all 27 member states, without transposition. That's how 2023/1230 works. There is no national variation. A machine that complies in Germany complies in Portugal. A machine that doesn't comply in France doesn't comply anywhere else in the EU either.

This is a structural simplification, and it's one of the reasons the regulation is being taken more seriously by industry legal teams than the 2006 directive was at the equivalent point in its rollout.

Four structural shifts

01 · AI explicitly covered

Autonomous systems and AI-based safety functions are now explicitly in scope. Annex III (the list of machinery requiring notified-body assessment) now includes categories specifically defined around machines whose safety-relevant behaviour involves AI or self-evolving code.

This is new. The 2006 directive was written before modern machine-learning architectures were a meaningful concern for machinery manufacturers. 2023/1230 addresses the question head-on.

02 · Cybersecurity is mandatory

Manufacturers must protect safety functions against third-party attacks for the operational lifetime of the machine. Software security updates are required for ten years after the machine is placed on the market, or longer if the manufacturer commits to a longer lifecycle.

This is one of the most underappreciated parts of the regulation. It turns every Physical AI OEM into a ten-year software-maintenance business by regulatory obligation, not by business choice. The cost-of-ownership implications are significant.

03 · Directly binding

Already covered above, but worth stating as a structural point. 27 member states. Uniform text. No national transposition differences. The regulation is the regulation.

04 · Mandatory third-party certification for high-risk categories

Self-declaration of conformity is no longer sufficient for the high-risk categories of machinery listed in Annex I Part A. These machines now require notified-body assessment before placement on the EU market.

If your product is in one of those categories — and the list includes categories that a lot of Physical AI products fall under, including certain autonomous and collaborative machinery — the compliance pathway is fundamentally different from what it was under the 2006 directive.

What this means in practice

A few concrete implications.

• For manufacturers placing machinery on the EU market. The compliance work is not optional and the deadline is not moving. Notified-body capacity is finite, so starting early is a commercial advantage.
• For integrators assembling machines from components. The regulation places duties on the party who places the final machine on the market. If that's you, the compliance duty is yours even if the components came from third-party suppliers.
• For importers. Importers and authorised representatives now have explicit duties under the regulation. An importer placing non-compliant machinery on the EU market is directly liable.
• For Physical AI companies generally. If your roadmap includes the EU market, 20 January 2027 is a real deadline. If your roadmap excludes it, you're excluding the single largest regulated robotics market in the world.

The source

The authoritative text is on EUR-Lex. It is not long, it is not impenetrable, and it is readable by a technically-literate operator in an afternoon. Secondary commentary — Pilz, TÜV Rheinland, TÜV Nord — is useful for structured summaries, but the actual text is where the real constraints are.

This primer is not a substitute for reading it. It's an invitation to read it.