What five weeks of counting found

Regulation (EU) 2023/1230 will apply from 20 January 2027. Counted from 8 October 2026, that is 104 days. What is measured about that interval is the calendar and the register. Almost nothing else is.

Five weeks of counting produced four absences in the public record and one missing definition. Each is worth stating with the date it was read.

The deadline is the only quantity here that nobody had to choose to publish. It is a cut-off with no transition period, and Directive 2006/42/EC is repealed with effect from the same date by Article 51(2). Nothing sits between the two instruments. On 17 February 2026, seven trade associations — CECE, CECIMO, CEMA, EGMF, EUnited, FEM and ATVEA — stated jointly that machinery is the only industry excluded from the Omnibus IV transition period.

The official interpretation is due at roughly the moment of the requirement it interprets. The Commission's application guide for the Regulation is expected in the fourth quarter of 2026, and the last comparable guide arrived roughly five months after the Directive it explained. Member states need only notify their penalty rules by 20 October 2026, three months before application. The technical guidance sits in the same position: EN ISO 10218-1:2025 and EN ISO 10218-2:2025 were cited in the Official Journal on 7 September 2026 in support of Directive 2006/42/EC. The decision that cited them is repealed on 20 January 2027, and nothing has yet been cited under the Regulation.

Thirty-nine notified bodies held a current notification under the Regulation on 13 September 2026, against one hundred and forty-four under the Directive it replaces. Both come from the Commission's register, read that day, and both are counts, not standing facts. Of the thirty-nine, three are notified for safety components whose behaviour is fully or partly self-evolving through machine learning, and two for machinery with embedded self-evolving machine-learning safety systems. Those are the counts for the whole Union. The first notified body under the Regulation was notified on 8 September 2024, roughly twenty-eight months before the Regulation applies, and a market cannot be assessed faster than its assessors were appointed.

Nobody has published a figure for how ready the industry is, and nobody publishes how long getting ready takes. I went looking for a readiness number across trade associations, notified bodies, the large consultancies and the Commission's impact assessment. There is none, for a sector the Commission itself describes as 98% small and medium enterprises. I ran a second sweep across seven certification bodies for a published duration benchmark for SIL 2 or SIL 3 assessment. Not one of the seven publishes one.

That absence is easy to misread as an accusation. I am not saying the industry is unprepared. I am saying nobody has measured it. The nearest thing to a measurement is the industry's own signature: in January 2026, CECE, CECIMO, EGMF, FEM and others asked the Commission in writing to postpone the Regulation's cybersecurity provisions.

"Safe-by-design" is not a defined term in any instrument that would give it meaning. It is absent from IEC 61508, ISO 13849 and Regulation (EU) 2023/1230, and the nearest formal concept is ISO 12100's inherently safe design methodology. Four questions make it testable: a named SIL or PL target, a documented redundancy architecture, a re-certification route for software updates, and fallback behaviour demonstrated under sensor failure. The third binds hardest, because from 20 January 2027 the manufacturer will retain lifecycle obligations for software modifications that affect safety functions. For machinery in Annex I Part A items five and six, whose safety functions use self-evolving machine learning, an unforeseen change creating a new hazard that requires new protective measures will make whoever made it a manufacturer under Article 18, and the instrument does not settle whether a model update on its own qualifies.

Retraining does not close a failure mode either. After Waymo vehicles were observed passing stopped school buses, Waymo ran live training sessions with real buses and shipped software updates. Five further violations followed in November 2025, and a recall covering 3,067 vehicles followed in December 2025.

The strongest argument against all of this is that an absence in the record is not an absence in the world. A manufacturer may have measured its own readiness and kept the figure. A certification body may hold duration data it does not publish. The assessor count is still moving: twenty-three of the thirty-nine were notified since 1 January 2026 and ten since 1 July 2026, by the register's last-approval-date field on 13 September 2026.

If a readiness survey or a published duration benchmark exists and I have missed it, that closes two of the five, and I would want to see it. Until then the position is narrow. With 104 days left, the deadline is measured to the day and almost nothing behind it is measured at all. If nobody has measured it, measure it. That is the work that follows.