When a software update makes you a new manufacturer — and when it doesn't.

Article 18 of Regulation (EU) 2023/1230 is headed "Other cases in which obligations of manufacturers apply", which understates it. A person who carries out a substantial modification "shall be considered to be a manufacturer for the purposes of this Regulation", and takes on the manufacturer obligations in Article 10. The Regulation applies from 20 January 2027. Nothing in Article 18 restricts the modification to a mechanical one.

Whether a software release crosses that line turns on three things. The instrument settles two plainly. The third it leaves open, and I went into the text to find where.

Software is expressly inside the definition. Article 3(16) defines a substantial modification as one made "by physical or digital means" after the product is placed on the market or put into service. The Regulation's definition of a safety component reaches "a physical or digital component, including software" intended to fulfil a safety function. I read the definition looking for a carve-out for code and there is none.

What follows is not one obligation but five, each with its own provision. The second paragraph of Article 18 sends the modifier back through the conformity assessment procedure, and with it come a fresh risk assessment under Annex III Part B, General principles, point 1(a) to (e), new technical documentation, a new EU declaration of conformity, and a new CE marking on the modified machine. I traced each to its own provision rather than bundling them.

The heaviest route is reserved for a narrow class. Annex I Part A item five covers "safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions", and item six covers machinery with such embedded systems not placed independently on the market, in respect only of those systems. Part A triggers Article 25(2): module B followed by module C, module H, or module G, all through a notified body, with no self-assessment route. Recital 55 draws the boundary tightly: those provisions "should not apply to software incapable of learning or evolving, and programmed only to execute certain automated functions".

Whether a machine-learning model update is a substantial modification is not settled by the instrument. Article 3(16) admits digital modification, then gates it on two mechanical outcomes: guards or protective devices whose processing necessitates modifying the existing safety control system, or additional measures for stability or mechanical strength. A model change that alters behaviour without requiring either is arguably outside the definition. Recital 26 offers a wider test, treating a modification as substantial "when new significant protective measures are required", and excluding repair and maintenance that do not affect compliance. A recital is not an operative provision, and the same applies to Recital 42, where the familiar "should be considered to be the manufacturer" phrasing sits.

I checked the operative articles, the recitals and the Blue Guide. I found no CJEU case law on the point, and no machinery-specific Commission guidance that resolves it. The Blue Guide is guidance and says so — "only the text of the Union harmonisation act itself has legal force". Its test is also broader than Article 3(16), treating a product as new where "its original performance, purpose or type is modified, without this being foreseen in the initial risk assessment". This is unmeasured rather than absent: the obligation exists, and its trigger is undefined at the edge.

A foreseen update is not a substantial modification at all. Article 3(16) requires the change to be "not foreseen or planned by the manufacturer". Annex III Part B, General principles, point 1 requires the original risk assessment to cover hazards foreseeable at placing on the market as an "intended evolution of its fully or partially self-evolving behaviour or logic". An update inside the envelope that assessment described does not restart conformity assessment. Article 10(4) treats series production changes as a separate continuing duty.

That concession is the larger half. Most releases to most machines will make nobody a manufacturer, because most machines are not in Annex I Part A and most updates are planned. If Commission guidance or a national decision resolves the edge case and I have missed it, that changes the answer. Until then the defensible claim is this narrow: for machinery in Annex I Part A items five and six, an unforeseen model change that creates a new hazard requiring new protective measures will make the person who made it a manufacturer under Article 18.