For Machine Integrators: What Counts as a ‘Substantial Modification’ Under the EU Machinery Regulation

Under EU Regulation 2023/1230, a modification is ‘substantial’ when it is made by physical or digital means after the machine was placed on the market or put into service, was not foreseen or planned by the manufacturer, and affects safety by creating a new hazard or increasing an existing risk, in a way that requires either new guards or protective devices that force a change to the existing safety control system, or additional measures for stability or mechanical strength. Whoever carries it out becomes the manufacturer for that machinery (Article 18).

Why U.S. integrators need this definition

American integrators increasingly retrofit cells in their customers' European plants: adding a robot, changing a product format, swapping a safety scanner for a vision system. Under EU law the question is no longer just ‘is it safe?’ but ‘did we just become the manufacturer of this machine?’. EU-OSHA notes that, compared with the 2006 Directive, the new Regulation clarifies the notion of substantial modification. The Directive-era approach, as the European Commission summarizes it, applied the rules when existing machinery was modified ‘to such extent that it becomes de facto new machinery’.

Timing: the Regulation applies from 20 January 2027. Everything below describes that regime; it is EU law and has no effect on retrofits in U.S. plants, which are governed by OSHA rules and U.S. consensus standards.

The definition, broken down

Article 3(16) of the consolidated text (29 May 2026) contains five cumulative elements:

1. A modification by physical or digital means. Software and parameter changes count, not just hardware.
2. Made after placing on the market or putting into service. Changes during the original build are part of manufacturing.
3. Not foreseen or planned by the manufacturer. Options, formats or configurations the original manufacturer designed for are outside the definition. The Regulation's definition of ‘lifetime’ even includes ‘physical or digital modifications foreseen by the manufacturer’.
4. Affects safety by creating a new hazard or increasing an existing risk.
5. Requires either (a) adding guards or protective devices whose processing necessitates modifying the existing safety control system, or (b) adopting additional protective measures to ensure stability or mechanical strength.

What happens when you cross the line: Article 18

Article 18 states that a person who carries out a substantial modification ‘shall be considered to be a manufacturer’ and is subject to the Article 10 obligations: design to Annex III, technical documentation, conformity assessment, EU declaration of conformity and CE marking. That person must ‘ensure and declare on its sole responsibility’ that the machinery conforms and apply the relevant procedure under Article 25(2), (3) or (4).

There is an important scoping rule for multi-machine lines: if the substantial modification affects the safety of only one machine that is part of an assembly, the manufacturer obligations apply to that affected machinery, ‘as demonstrated in the risk assessment’. So a modification to one station of a robot line does not automatically make you the manufacturer of the whole line, but your risk assessment has to prove the limits.

• Non-professional users modifying their own machinery for their own use are not treated as manufacturers (Article 18, last paragraph). Industrial plants and integrators do not benefit from this.
• Importers and distributors who modify a product already on the market ‘in such a way that compliance with the applicable requirements might be affected’ also become manufacturers (Article 17), a lower threshold than Article 3(16).

Robot-cell scenarios: how the definition reads

The Regulation gives the criteria, not examples, and no official Commission guide to Regulation 2023/1230 has been published yet (the Commission's guide, edition 2.3 of April 2024, covers the old Directive). The table below applies the text's own criteria; treat it as a reading aid, not an official interpretation.

Software changes now leave a trail

Digital modifications are easier to trace under the new essential requirements (Annex III). Section 1.1.9 requires machinery to identify the software necessary for it to operate safely and to collect evidence of a legitimate or illegitimate intervention in the software or its configuration. Section 1.2.1 requires a tracing log of the versions of safety software uploaded after placing on the market, enabled for five years after each upload, available to authorities on reasoned request. And it states that the limits of safety functions are established in the manufacturer's risk assessment, with no modifications allowed to settings that could lead to hazardous situations.

For self-evolving systems, the same section requires that the control system not cause actions beyond the defined task and movement space, and that safety-related decision data be retained for one year. If your retrofit adds a machine-learning safety function, note that such functions sit in Annex I, Part A, which requires a notified-body procedure under Article 25(2).

Keep in mind who will read that documentation. Under Article 10(3), the manufacturer must keep the technical documentation available to market surveillance authorities for at least 10 years, and where relevant the source code or programming logic must be made available on a reasoned request. A retrofit file that explains why a change was or was not substantial is the first thing an authority will ask for after an incident.

A retrofit checklist for integrators

1. Get the original manufacturer's instructions and declaration: they show what was foreseen or planned.
2. Run a risk assessment of the change, including interactions with the rest of the assembly (Annex III, Part B).
3. Test each element of Article 3(16) and record the conclusion.
4. If substantial: define which machinery is affected (Article 18), then apply Article 10 to it, including the Annex IV technical file and the Article 25 procedure.
5. Update the identification plate, the instructions for use and the declaration.
6. Keep the file for at least 10 years (Article 10(3)).
7. On the employer side in the U.S., OSHA's Technical Manual similarly expects additional task-based risk assessments for new or modified tasks, and 29 CFR 1910.147 requires retraining when a change in machines presents a new hazard.

To test your own scenario against the text, ask the EU robot and cobot machinery safety base a question like ‘What exactly turns a change to an existing machine into a substantial modification?’ and read the cited article.