EU Machinery Regulation 2027: what changes for humanoid robots and robot dogs

Regulation (EU) 2023/1230 replaces the Machinery Directive and applies from 20 January 2027. Humanoid robots and robot dogs placed on the EU market from that date must meet updated safety requirements on machine learning in safety functions, tampering and cyber attacks, logging of software changes, and autonomous behaviour around people. Organisers will mostly notice the change through suppliers' paperwork.

The regulation in brief

The Regulation of 14 June 2023 on machinery repeals Directive 2006/42/EC, which has applied since 29 December 2009. The new regulation applies from 20 January 2027. As a regulation, it applies directly and identically in every Member State.

The provisions on notified bodies (independent certification organisations), Articles 26 to 42, have applied since 20 January 2024, so that these bodies could prepare in advance.

The regulation does not mention humanoids by name. It applies to machinery and related products in general. A walking robot with motors, moving limbs and a control system will generally fall within it, unless more specific EU legislation covers the same risks.

Self-evolving behaviour: a new high-risk category

The most discussed change concerns artificial intelligence. Annex I of the regulation lists categories of machinery that need stricter checks. Part A now includes two new entries:

• safety components with fully or partially self-evolving behaviour that use machine learning to ensure safety functions;
• machinery with embedded systems of that kind which were not placed on the market separately, in respect of those systems only.

The recitals explain the reasoning. Such systems were included because of their data dependency, opacity, autonomy and connectivity. The recitals also set a boundary. Ordinary software that cannot learn or evolve, and that only runs programmed automated functions, is not covered by these entries.

For Part A categories, Article 25(2) removes the option of self-assessment by the manufacturer. A notified body must be involved, through one of three routes:

1. EU type-examination followed by conformity to type based on internal production control;
2. full quality assurance;
3. unit verification.

Whether a particular humanoid falls into these entries depends on whether a machine-learning system ensures a safety function, such as detecting people or limiting force. A learned dance routine with no safety role is a different matter. Manufacturers make that judgement in their risk assessment, and borderline cases are likely to be debated until guidance matures.

Designing for autonomy and learning

Even where no notified body is required, Annex III sets essential health and safety requirements that apply to every machine. Several were rewritten with autonomous and learning machines in mind.

• Lifecycle risk assessment. Manufacturers must consider hazards that may arise as the machine's self-evolving behaviour or logic develops over its lifetime, as far as those hazards are foreseeable when the product is placed on the market.
• Bounded behaviour. Control systems of machines with self-evolving behaviour must not cause actions beyond the defined task and movement space. It must always be possible to correct the machine to keep it safe.
• No unsafe learning. Changes to settings or rules made by the machine or by operators, including during a learning phase, must be prevented where they could lead to hazardous situations.
• Communicating with people. Under the ergonomics section, autonomous machines must, where relevant, respond appropriately to people (through words, gestures, facial expressions or body movement). They must also communicate their planned actions, meaning what they will do and why, in a way operators can understand.
• Sharing space. The requirements on moving parts now address both physical contact and the psychological stress that interaction with a machine can cause. This applies to people sharing a space with a machine as well as to direct interaction.

These are design obligations on the manufacturer. They do not certify that a robot is safe in a crowd. For how this plays out at a venue, see our guide to safety at public events with robots.

Cybersecurity becomes a safety requirement

The Machinery Directive had little to say about hacking. The new regulation treats corruption of software and data as a safety hazard.

Section 1.1.9 of Annex III, on protection against corruption, requires that connecting another device, including a remote device, must not create a hazardous situation. Software and data that are critical for safety must be identified and protected against accidental or intentional corruption. The machine must show which safety-relevant software is installed. It must also collect evidence of legitimate or illegitimate interventions in that software or its configuration.

Section 1.2.1 adds that control systems must withstand reasonably foreseeable malicious attempts by third parties that could lead to a hazardous situation. It also introduces two logging duties:

• a tracing log of interventions and of safety software versions uploaded after the machine was placed on the market, kept for five years;
• for machines with self-evolving behaviour, records of the safety-related decision-making of software-based safety systems, kept for one year.

In both cases, the data is to be used only to show conformity in response to a reasoned request from a national authority. For wireless control, a lost or faulty connection must not lead to a hazardous situation. Article 20(9) adds that a certificate under an EU cybersecurity certification scheme can provide a presumption of conformity with these two sections, to the extent it covers them.

These rules matter for robots updated over the air or controlled by tablet or radio. Data-protection duties are separate and covered in our guide to cameras, microphones and visitor privacy.

Autonomous mobile machinery and the supervisor

Chapter 3 of Annex III covers machinery that presents risks because of its mobility. It now defines autonomous mobile machinery. It also introduces a supervisor: a person responsible for supervising such a machine, with a supervisory function that allows remote, non-permanent oversight.

Where relevant, the supervisory function must let that person receive information and alerts. It may only allow limited orders, such as stopping, restarting or moving the machine to a safe position. If the function is not active, the machine must not operate. Autonomous mobile machines must also either work inside an enclosed zone with guards or protective devices, or carry devices that detect people, animals and obstacles nearby, or both where the risk assessment requires it.

How far these provisions fit a walking humanoid, as opposed to an autonomous cart or mower, is not settled in the text itself. Manufacturers' risk assessments and future standards will shape the answer. The distinction between remote control and autonomy is explained in our guide to teleoperated or autonomous robots.

Paperwork, updates and modifications

Several practical changes affect anyone handling a robot after it leaves the factory.

• Digital instructions. Article 10(7) allows instructions in digital form. They must be downloadable, printable and online for the product's expected lifetime and at least ten years. Buyers can ask for a free paper copy at the time of purchase.
• Source code on request. Technical documentation must be kept for ten years. Where relevant, source code or programming logic must be made available to authorities on reasoned request.
• Substantial modification. Under Article 18, anyone who modifies a machine, physically or digitally, in a way the manufacturer did not foresee may become the manufacturer of that machine, if the change creates a new hazard or increases an existing risk and requires extra protective measures. This covers changes such as new safety-relevant software, added payloads or structural changes. Purely cosmetic branding is unlikely to qualify, but the test is about safety impact, not intent.
• Trade fairs. Article 4(2) allows a machine that does not yet comply to be displayed at trade fairs, exhibitions and demonstrations, provided a visible sign says so. Adequate measures must protect people during demonstrations.

Standards are still catching up

The regulation sets objectives. Detailed technical solutions come from harmonised standards, which give a presumption of conformity once their references are published in the Official Journal. If standards are missing, the Commission may adopt common specifications instead. In Europe, machinery safety standards are developed by committees such as CEN/TC 114 (Safety of machinery), as CEN-CENELEC's mechanical and machines sector page describes. Until standards for machine learning and humanoid-specific hazards mature, manufacturers will rely more on their own risk assessments and on notified bodies.

The Machinery Regulation also interacts with the EU AI Act, which treats certain AI safety components of machinery as high-risk. That timeline is explained in our article on AI Act deadlines for robots.

This article is general information, not legal advice. Specific obligations depend on the product and the role of each company in the supply chain.

What this means for event organisers

• Ask for the declaration. For robots placed on the EU market from 20 January 2027, ask the supplier for the EU declaration of conformity and whether it cites Regulation (EU) 2023/1230. Note whether a notified body was involved.
• Ask about updates and modifications. Ask who installs software updates, whether a change log is kept, and whether the supplier has altered the robot since purchase. Add these questions to your brief to robot suppliers.
• Check the operating mode. Clarify whether the robot runs autonomously, under supervision or by remote control at your event, and who can stop it.
• Watch for non-compliance signs at shows. A robot displayed under the trade-fair exemption must carry a visible notice. Demonstrations still need protective measures.
• Keep insurance aligned. Regulatory status can affect cover, so review it alongside our guide to insurance and liability for robot hire.

Frequently asked questions

When does the EU Machinery Regulation 2023/1230 start to apply?

The regulation applies from 20 January 2027, when it replaces Directive 2006/42/EC. Some provisions started earlier: the rules on notified bodies, the independent organisations that certify higher-risk machinery, have applied since 20 January 2024. This gave those bodies time to be designated and prepare before manufacturers need their assessments. Products placed on the market in conformity with the old directive before 20 January 2027 may continue to be made available.

Does every AI-powered humanoid robot need third-party certification?

Not automatically. Annex I Part A requires a notified body only for safety components, or embedded systems, with fully or partially self-evolving behaviour using machine learning that ensure safety functions. A robot whose learned behaviour has no safety role, such as a choreographed routine, may still follow the standard procedure. The manufacturer's risk assessment determines which category applies, and borderline cases may be debated.

What cybersecurity duties does the Machinery Regulation introduce?

Annex III requires that connections to other or remote devices must not create hazards. Safety-critical software and data must be protected against accidental or intentional corruption, and the machine must record interventions in its software. Control systems must withstand reasonably foreseeable malicious attempts. A tracing log of safety software updates must be kept for five years after each upload.

Can a robot that does not yet comply be shown at a trade fair?

Yes, under Article 4(2) Member States may not prevent a non-compliant product from being displayed at trade fairs, exhibitions and demonstrations. A visible sign must clearly state that it does not comply and will not be made available until it does. Adequate measures must also be taken to protect people during demonstrations, so safety planning still applies.

How this article was made: written by the humanoid4rent editorial team with AI assistance; every factual statement was checked against the sources listed below on 2026-10-31. Spotted an error? Write to info@humanoid4rent.com.