Ordering a packaging line for 2027: what the Machinery Regulation changes in the purchase spec

The purchase specification for a new blister line is on its third revision. Under “Regulatory”, one line has not moved since the site’s first packaging project: CE marked in accordance with Directive 2006/42/EC. The supplier quotes fourteen months to the factory acceptance test, the site adds three for installation and qualification, and someone at the table does the arithmetic. The line will be handed over in the first months of 2027.

That line will not be placed on the market under the Directive. Regulation (EU) 2023/1230, the EU Machinery Regulation, will apply from 20 January 2027, and what decides which text governs a machine is the day it is placed on the market or put into service, not the day the order was signed. A specification written against the Directive asks for the wrong declaration and misses what a pharmaceutical buyer needs most: protection against corruption, a trace of changes to safety software, and who becomes manufacturer after a rebuild.

The handover date decides, not the order date

The Regulation was published in the Official Journal (OJ) on 29 June 2023 and entered into force on 19 July 2023. Article 54 first set its application date at 14 January 2027; a corrigendum of 4 July 2023 moved it to 20 January 2027, the day Article 51(2) repeals the Directive. As a regulation, it needs no national transposition.

Article 52 works one way only. A product placed on the market in conformity with the Directive before 20 January 2027 may still be made available afterwards. A machine placed on the market or put into service from that date must meet the Regulation, whatever its contract says.

For a packaging line, that gives three cases. Machines delivered before the date keep their Directive declarations. A line handed over after it is an assembly of machinery under Article 3(1)(d), machines “arranged and controlled so that they function as an integral whole”, and its manufacturer declares it against the Regulation. That can be the integrator or the site itself: Article 3(18)(b) makes a manufacturer of anyone who builds machinery and puts it into service for their own use.

What the Regulation adds to the Directive

Most of Annex III, the essential health and safety requirements, carries over the Directive’s Annex I. What changes concerns software, connections and what happens after delivery.

Corruption and control systems, read on a packaging line

Section 1.1.9 opens with one sentence a buyer can test: the machine shall be designed so that “the connection to it of another device, via any feature of the connected device itself or via any remote device that communicates with the machinery”, does not lead to a hazardous situation. On a packaging line the connected devices are easy to list: the builder’s remote-support router, the serialisation server that sends codes to the printer, the manufacturing execution system (MES) that downloads a recipe, the USB port on the human-machine interface (HMI), the service technician’s laptop.

The rest of 1.1.9 is about evidence. Software and data critical for safety must be identified and protected against accidental or intentional corruption; the machine must show which safety software it runs “at all times in an easily accessible form”, and collect evidence of any intervention, legitimate or not, in that software or its configuration. Section 1.2.1(f) adds a tracing log of the safety software versions uploaded after delivery, enabled for five years, for use only when a national authority asks.

On the shop floor, that means the safety program has a version and a signature the technician can display without a laptop, and changing it leaves a trace the site can read. Under good manufacturing practice (GMP), quality already asks for audit trails on product data; the Regulation asks the machine to keep a comparable record for safety.

Section 1.2.1(a) extends what control systems must withstand to “reasonably foreseeable malicious attempts from third parties leading to a hazardous situation”, “where appropriate to the circumstances and the risks”. That qualifier is the builder’s risk assessment. A buyer who never asks to see it gets whatever level the builder chose.

This now weighs on the safety architecture. Hard-wired safety relays, a separate safety controller, or a safety programmable logic controller (PLC) that also runs the machine: the choice was long argued on cost, wiring and flexibility, as a 2019 InTech feature listed below did. A relay chain has no program to corrupt. A safety program on a networked PLC has a project file, a password and a download path, each to be argued under 1.1.9 and 1.2.1(a).

Article 20(9) gives presumption of conformity with 1.1.9 and 1.2.1 to products certified under an EU cybersecurity scheme adopted under Regulation (EU) 2019/881, once its reference is in the OJ. The Cyber Resilience Act, Regulation (EU) 2024/2847, in force since 10 December 2024 and applying from 11 December 2027 for most obligations, will also reach many networked components of the line. How the line meets the plant network stays the site’s design: see zones and conduits: start from the risk, not from the switch.

Self-learning safety functions

Annex I Part A adds two categories that always need a notified body: safety components with “fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions” (point 5), and machinery with such systems embedded (point 6). Article 25(2) then allows only type-examination, full quality assurance or unit verification. Recital 55 keeps out “software incapable of learning or evolving”: a conventional safety program is not caught, however complex.

On a packaging line, the boundary runs between quality and safety. A vision system trained to reject a misprinted carton performs a quality function. A trained model that decides whether a person has entered a palletiser cell performs a safety function, and section 1.2.1 then adds three conditions: no action beyond the defined task and movement space, a record of safety-related decisions kept for one year, and the possibility to correct the machine at all times.

When the site rebuilds the line

Packaging lines are rebuilt more often than replaced. Article 3(16) defines a substantial modification as one made “by physical or digital means”, not foreseen or planned by the manufacturer, that creates a new hazard or increases a risk, and that requires either new guards or protective devices whose processing needs a change to the existing safety control system, or new measures for stability or mechanical strength.

Under Article 18, whoever carries it out becomes the manufacturer, for the whole machine or, in an assembly, only for the machinery affected, “as demonstrated in the risk assessment”. On a site rebuilding with an integrator, that person is often the site. Recital 26 keeps repair and maintenance that leave compliance untouched out of the definition.

Three cases show how the test usually runs. Change parts for a new blister format, listed by the builder in the instructions, are foreseen: no substantial modification. A drive replaced like for like is maintenance. A robot cell added at the case packer, with a laser scanner that has to be wired into the existing safety controller, ticks every box, and the modifier becomes manufacturer of the affected part of the line.

“Digital means” matters on a line where most changes are made in software. A safety program edited to allow a higher jog speed with a guard open modifies the safety control system without a screw being turned. GMP change control catches the change; it often lacks the question “does this create a new hazard or increase a risk?”, asked before the qualification plan is written. The qualification side is covered in what each qualification stage proves.

The standards that carry the proof

ISO 12100:2010 sets the method for risk assessment and risk reduction. ISO 13849-1:2023, fourth edition, April 2023, covers safety-related parts of control systems, software included; IEC 62061:2021, second edition, 22 March 2021, covers the functional safety of safety-related control systems. Under the Directive, Implementing Decision (EU) 2022/621 cited EN IEC 62061:2021, and Implementing Decision (EU) 2024/1329 added EN ISO 13849-1:2023 while keeping the 2015 edition listed until 15 May 2027.

Under the Regulation, Article 20(1) ties presumption of conformity to harmonised standards whose references are published in the OJ for it. So the builder states, standard by standard, the edition applied and the act that publishes its reference. A risk assessment citing “EN ISO 13849-1” without a year cannot be checked against the right text. For 1.1.9, builders often bring evidence from the IEC 62443 series, such as IEC 62443-4-2:2019: useful, provided the risk assessment says which hazard each measure addresses.

Lines for the purchase specification

These lines belong in the user requirement specification (URS) and the commercial terms, not in a cybersecurity annex nobody opens at the factory acceptance test (FAT). How a URS drives the qualification that follows is set out in writing a URS that actually drives the qualification.

1. Applicable act. Machine by machine, the offer states whether it will be declared under Directive 2006/42/EC or Regulation (EU) 2023/1230, given the planned delivery date.
2. Risk assessment scope. It covers every connection under 1.1.9 and the malicious attempts of 1.2.1(a), and is delivered with the documentation.
3. Safety software and its trace. The safety software with version and signature, how the machine displays it, and which log records changes to it and its configuration.
4. Remote access. How the builder connects, what can be changed remotely, and the evidence that a session cannot defeat a safety function.
5. Machine learning. A statement that no safety function relies on self-evolving behaviour, or the notified body certificate if one does.
6. Standards. Each harmonised standard with its year and the act publishing it.
7. Instructions. Digital under Article 10(7), online for at least ten years after placing on the market, and a paper copy requested at purchase, due free within one month.
8. Foreseen modifications. The formats, speeds and later additions the builder plans for, written into the instructions.

The eighth line costs nothing at order. Article 3(16) only catches modifications “not foreseen or planned by the manufacturer”: what the builder writes down at delivery is the boundary every later rebuild is judged against.

What to check at the factory acceptance test

• The draft declaration. It names the right act and the standards with their editions.
• Safety software identity. Version and signature on the HMI match the documents; record them as the change control baseline.
• A change leaves a trace. Change one safety-relevant parameter under supervision, restore it, and find the evidence where the builder said it would be.
• Remote session. Open it, check what it reaches, and cut it mid-operation: the machine stays safe.
• Safety functions under fault. Test each with the faults its validation plan names, as EN ISO 13849-2:2012 describes, not only in normal running.
• Instructions. Open the downloaded copy offline, as a technician would during a breakdown.

How deep each test should go is the subject of how deep should a qualification test go?. On the projects we see, the FAT is where these points are cheapest to settle: the builder’s engineers are in the room and the cabinet doors are open.

Five common mistakes

• Dating by the order. The purchase order date does not decide the applicable act; the placing on the market or putting into service does.
• Standards without a year. “EN ISO 13849-1” in a specification or a risk assessment leaves open which edition the calculation followed.
• Cybersecurity outside the CE file. Under the Regulation, protection against corruption is an essential health and safety requirement, assessed with the rest of the machine.
• Remote access accepted as a service. The builder’s router is a connected device under 1.1.9; ask how a session is bounded before it is installed.
• Rebuilds without the Article 18 question. A site that adds a robot cell and rewires the safety controller may have become a manufacturer without noticing.

A packaging line bought for 2027 is bought under the Regulation. The specification is the cheapest place to make the builder say so, and to write down what the line may become.

References

• Regulation (EU) 2023/1230 on machinery, Articles 3, 10, 18, 20, 25, 51, 52 and 54, Annex I, Annex III 1.1.9 and 1.2.1.
• Corrigendum to Regulation (EU) 2023/1230), OJ L 169 of 4 July 2023 (application dates).
• Directive 2006/42/EC on machinery, Annex I 1.1, 1.2.1 and 1.7.4.
• Commission Implementing Decision (EU) 2024/1329, harmonised standards for machinery, EN ISO 13849-1:2023.
• Commission Implementing Decision (EU) 2022/621, harmonised standards for machinery, EN IEC 62061:2021.
• ISO, ISO 13849-1:2023, Safety of machinery, Safety-related parts of control systems, Part 1: General principles for design.
• IEC, IEC 62061:2021, Safety of machinery, Functional safety of safety-related control systems.
• ISO, ISO 12100:2010, Safety of machinery, General principles for design, Risk assessment and risk reduction.
• AUTOMATION 2023 Volume 6, Understanding Standards-Based Safety System Design, November 2023, p. 57.
• InTech, Integrated or separate safety systems, September/October 2019, p. 20.