An AI retrofit on an existing machine: when do you become the manufacturer yourself?

What changes on 20 January 2027

Regulation (EU) 2023/1230 on machinery was published in the Official Journal on 29 June 2023 and replaces Directive 2006/42/EC. Article 54 provides that it applies from 20 January 2027; Article 51(2) repeals the Machinery Directive with effect from that same date. From then on, references to the repealed Directive are construed as references to the Regulation.

There is one detail that causes confusion, and it is worth knowing where it comes from. The original text in Official Journal L 165 gives not 20 but 14 January 2027. That date was corrected by a corrigendum in Official Journal L 169 of 4 July 2023, which corrects dates in fourteen numbered points. Mostly the difference is six days, as in point 10, which corrects the second paragraph of Article 54; in one case it is almost three years, because point 12 replaces '14 October 2023' with '20 October 2026' in point (b) of the third paragraph of Article 54. So if you come across a page that mentions 14 January 2027, you are reading a text that has not taken the corrigendum into account. The correct date is 20 January 2027.

On another point a more persistent misunderstanding circulates: that a three-year transition period applies to existing machines. No such provision exists in the Regulation. Article 52(1) is something else. It provides that Member States may not impede the making available on the market of products that were placed on the market in conformity with Directive 2006/42/EC before 20 January 2027. That is an arrangement for what is already on the market, not a reprieve for what you do after that date with machines you already have in place.

The deciding test, in full

Article 3(16) of the Regulation defines a substantial modification as 'a modification of machinery or a related product, by physical or digital means after that machinery or related product has been placed on the market or put into service, which is not foreseen or planned by the manufacturer, and which affects the safety of that machinery or related product, by creating a new hazard, or by increasing an existing risk, which requires: (a) the addition of guards or protective devices to that machinery or related product the processing of which necessitates the modification of the existing safety control system; or (b) the adoption of additional protective measures to ensure the stability or mechanical strength of that machinery or related product'.

That definition consists of four conditions, all four of which must be met, and the fourth splits into two branches:

• It is a modification by physical or digital means. Software expressly counts here; that is new compared with how the discussion was usually conducted under the Machinery Directive.
• The modification takes place after the machine has been placed on the market or put into service.
• The modification was not foreseen or planned by the manufacturer. An adjustment that the manufacturer itself included in the design and the risk assessment therefore falls outside the definition.
• The modification affects safety by creating a new hazard or increasing an existing risk, and does so in such a way that either (a) guards or protective devices are needed whose implementation requires a change to the existing safety control system, or (b) additional measures are needed for stability or mechanical strength.

Why that fourth condition matters

Almost all Dutch-language pages on this subject paraphrase the definition as 'a new hazard or an increased risk' (translated) and leave out points (a) and (b). That removes precisely the threshold the legislator built in. A retrofit that introduces a new hazard which you adequately control without adding guards that affect the safety control system, and without measures for stability or mechanical strength, does not meet the definition on the wording of Article 3(16).

That is a sober observation, not a free pass. You must be able to substantiate the conclusion that you stay below the threshold, and that substantiation is exactly the document you owe in any case.

Recital 26 of the Regulation points both ways, and you should know that before you build on the narrow reading. On the one hand, it states that repair and maintenance operations which do not affect compliance with the essential health and safety requirements should not be considered substantial modifications, and that whoever does make a substantial modification does not have to repeat the tests and documentation for parts of an assembly that the modification does not concern. On the other hand, the same recital describes the threshold as reached when new significant protective measures are required, and that is broader wording than points (a) and (b) of Article 3(16). A recital is not a binding provision, but a supervisory authority or court may use it to interpret the provision. So this, too, is still unsettled: if you build your conclusion on the narrow reading, you would do well to acknowledge that broader wording in your risk assessment rather than leave it out.

What happens if you do fall under it

Article 18 is short and its effect is far-reaching. A natural or legal person who substantially modifies a machine is considered a manufacturer for the purposes of the Regulation and is subject to the obligations of Article 10. If the modification affects the safety of only one machine within an assembly, this applies to that machine, 'as demonstrated in the risk assessment'.

Three things in that provision deserve attention. First, the risk assessment limits the scope of your manufacturer's obligations: if the modification affects the safety of only one machine within an assembly, the obligations of Article 10 extend no further than that machine, as demonstrated in the risk assessment. The same document that triggers the obligation therefore also delimits it. Article 18 says nothing about civil or criminal liability; that runs along other lines. Second, the exception for non-professional users applies only to those who modify their own machine for their own use; a food producer or haulier that adapts its own line is a professional user and does not fall under it. Third, Article 18 makes no distinction between 'the integrator did it' and 'we did it ourselves'. What matters is who carries out the modification, and that is a contractual question you answer before commissioning the work rather than afterwards.

What the obligations of Article 10 involve in concrete terms is no secret, but it is work. The modified machine must be designed and constructed in accordance with the essential health and safety requirements of Annex III. You draw up the technical documentation as described in Annex IV, Part A, carry out the conformity assessment procedure of Article 25, draw up the EU declaration of conformity and affix the CE marking. You keep that documentation and the declaration at the disposal of the market surveillance authorities for at least ten years. For AI, one phrase in Article 10(3) stands out: the source code or programming logic included in the technical documentation is to be made available to the competent national authorities upon a reasoned request, insofar as it is needed to check compliance with Annex III. That is a good reason, when buying an AI component, to know what you hold and what stays with your supplier, alongside access to the machine data itself.

The question that usually decides whether you need a notified body, and the list that takes precedence

This is where the cost difference lies, and it is bigger than with most other choices in this matter. Article 25(4) provides that whoever modifies a category of machinery not listed in Annex I applies the internal production control procedure, module A in Annex VI. That is a self-declaration, without a third party. If the category is listed in Annex I, Part A, Article 25(2) prescribes one of three heavier routes: EU type-examination followed by conformity to type, full quality assurance, or unit verification. All three involve a notified body.

Between those two lies a third branch that is missing from almost every overview, even though it is the one that applies most often to manufacturing companies. If your machinery category is listed in Annex I, Part B, Article 25(3) allows you to apply module A internal production control only if the machine has been designed and constructed in accordance with the harmonised standards or common specifications specific to that category that cover all the relevant essential health and safety requirements. Those two routes are equivalent: where no harmonised standard exists, a common specification can fulfil the same function. If neither is met, or if they do not cover all the relevant requirements, a route with a notified body is mandatory: EU type-examination followed by conformity to type (modules B and C), full quality assurance (module H) or unit verification (module G). That obligation is entirely separate from the question of whether AI is involved, and therefore takes precedence over the reasoning below.

This is not a theoretical category, but note the conditions that the annex itself attaches, which almost always disappear in summaries: most entries apply only with manual loading and/or unloading. Part B includes, among others: presses, including press-brakes, for the cold working of metals, with manual loading and/or unloading, whose movable working parts may have a travel exceeding 6 mm and a speed exceeding 30 mm/s; injection or compression moulding machinery for plastics and for rubber with manual loading or unloading; circular saws for wood and for meat in the manually operated types described there; band-saws with manual loading and/or unloading for wood and for meat; hand-fed planing, tenoning and spindle moulding machinery for woodworking; portable chainsaws for woodworking; locomotives, brake-vans and hydraulic-powered roof supports for underground working; and manually loaded trucks for the collection of household refuse incorporating a compression mechanism. A band-saw in a meat processing room or a press in a metal workshop falls under Part B if loading or unloading is manual, for presses moreover only above that travel and speed, and then regardless of what you add to it. A fully automatically fed version of the same machine does not fall under those entries. This is a selection of the entries that turn up most often in food, metal and wood environments, not a reproduction of the full list: go through Annex I, Part B, word for word once for your own machinery, including the conditions attached to each entry, before you assume that module A is enough.

Back to Part A, because that is where the AI question lies. Annex I, Part A, lists six categories, and two of them concern AI. Point 5 names 'safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions'. Point 6 names machinery that has such embedded systems which have not been placed independently on the market, in respect only of those systems.

Recital 55 draws a distinction here that decides the whole question. The provisions on third-party conformity assessment of software ensuring safety functions should only apply to systems with fully or partially self-evolving behaviour using machine learning approaches. By contrast, they should not apply to software incapable of learning or evolving that is programmed only to execute certain automated functions.

From this follows a test of three conditions, all three of which must be met before you end up in Part A: the component ensures a safety function, it uses machine learning, and it keeps evolving in the field. Article 3(4) defines a safety function as a function that serves to fulfil a protective measure designed to eliminate or reduce a risk, and which, if it fails, could result in an increase of that risk. That 'could' is not a detail: the definition does not require that the risk will certainly increase on failure, only that it can. Quality control does not fall under it; protecting an operator does.

In practice this comes down to one question for your supplier: does this model keep learning after it has been deployed, or was it trained once and then frozen? For a frozen model, recital 55 points in a different direction than for a model that keeps learning from your own line data. Ask that question in writing and keep the answer, because it is the hinge on which the rest of your process turns.

One point remains unresolved here, and you should be aware of it. Article 3(3) defines a safety component as a component 'which is independently placed on the market', whereas point 6 of Annex I, Part A, exists precisely for embedded systems that have not been placed independently on the market. Recital 54 reads in that direction by stating that the third-party assessment should take place whether or not the safety component has been placed independently on the market or is part of an embedded system, and adds that machinery should not have to be re-certified solely because a system has been embedded in it whose safety component has already undergone that assessment. For the borderline case in which those definitions meet, we have found no authoritative interpretation, and we are not going to invent one here.

The obligation that bites first

Before you get to Annex I, something else stands in your way, and it is the step that is most often missing in practice. The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) writes in its work instruction 'Beoordelen van gewijzigde machines' (Assessing modified machinery) that whoever makes the modification must carry out a risk assessment of every modification, before it can be concluded whether or not the modification is substantial. That assessment must make clear which essential health and safety requirements the modification affects and which new risks it brings.

The consequence follows just as plainly. If no risk assessment can be shown after a modification, the supervisory authority cannot check whether the modified machine complies. If the person making the modification concludes that it is not substantial, they do not acquire manufacturer's obligations; if it turns out afterwards, for example during an inspection or after an incident, that this conclusion was wrong, enforcement action is taken against the person who made the modification.

In practical terms, this means that under that instruction you owe the risk assessment for every adjustment, and especially for the adjustments you think stay below the threshold. The document is, after all, the evidence that they do stay below it. If you have no assessment, you have no defence, only a gap.

In its section on verifiability, the same work instruction gives the list against which an inspector assesses a modified machine: the declaration of conformity of the modified machine, its user manual, a nameplate bearing the CE marking on the modified machine, and a technical file containing the risk assessment, an inventory of the applicable requirements and a justification of how they have been met. That list is useful as your own checklist, even though the instruction formally concerns the current regime.

What is still entirely undecided about AI retrofits

This is the honest part, and it is more important than it sounds, because a lot of certainty is being sold on this subject that rests on nothing.

• There is no European Commission interpretive guide to Regulation (EU) 2023/1230. What the Commission does publish for it is guidance with a standard template for reporting accidents under Article 6(9), and Recommendation for Use sheets for notified bodies. The well-known 'Guide to application of the Machinery Directive 2006/42/EC', edition 2.3 of April 2024, concerns the outgoing Directive, not the Regulation. A guide to the Regulation is reportedly being worked on, with attention to AI-driven safety functions among other things, but as far as we could verify the Commission has published nothing official about it: the Commission's sector page does not mention such a guide, and the register of expert groups lists no subgroups for the machinery expert group. We therefore give no start date, no number of subgroups and no publication date. The gap is real; we do not know how long it will last, and in your planning you should not count on that guide arriving in time.
• No enforcement case, court ruling or supervisory decision is known concerning an AI retrofit as a substantial modification, under either the Directive or the Regulation. Anyone who tells you that 'practice has by now shown' how this works out cannot back that up with a case.
• The Dutch work instruction still formally rests on the Warenwet (Dutch Commodities Act), the Warenwetbesluit machines (the Dutch machinery decree under that Act) and Machinery Directive 2006/42/EC. In its section on the Regulation, it quotes a definition of 'ingrijpende wijziging' (substantial modification) which, according to its own footnote, is 'a translation of the latest available English draft text' (translated). That draft definition stops at the question of whether conformity with the essential requirements may be affected, and is therefore noticeably broader than the adopted text with its points (a) and (b). The current version of the instruction dates from 19 April 2024; on its work instructions page, the Arbeidsinspectie states that the work instructions have been under revision since June 2026.
• The Commission's 2022 Blue Guide does contain a software-specific test for substantial modification, but it is a different test: it turns on the original intended functions, the type or the performance of the product, not on guards or mechanical strength. Moreover, the Blue Guide is a Commission notice, not binding law. A retrofit can meet the Blue Guide test and still fall outside Article 3(16). The two are not aligned, and nobody has reconciled them for AI retrofits.
• The claim that retraining a model on new data in itself amounts to a substantial modification appears in commercial publications but is not in the Regulation. It is a plausible idea, not a rule.
• The German paper 'Wesentliche Veränderung von Maschinen' (substantial modification of machinery) from the BMAS (German Federal Ministry of Labour and Social Affairs) exists and is mentioned by the Nederlandse Arbeidsinspectie as an interpretation used within Europe. We have not read its content and therefore attribute no test to it.

Three situations, reasoned through

The three situations below are illustrative: worked-out reasoning based on the legal text above, not client stories and not existing cases. They show what the test turns on. What the outcome is in your own case depends on your own risk assessment.

Suppose a food producer installs an AI camera on an existing packaging line. If that camera only rejects product and controls an ejector, it does not fulfil a safety function within the meaning of Article 3(4): it protects the quality of the product, not the safety of persons. Annex I, Part A, points 5 and 6 then do not come into play. But the ejector itself is a new moving working part. If it calls for a new guard whose implementation requires a change to the existing safety control system, point (a) of the fourth condition is met and you fall under Article 18. And if the same camera is also used to stop the machine to protect an operator, then it is a safety component, and the question from recital 55 decides whether you need a notified body. How to assess the quality side of such a camera is covered in our piece on reject classification on the packaging line.

Suppose a grower replaces the adjustable climate control in an existing greenhouse with a learning controller that operates vents, screens and heating. The first three conditions are then met without much discussion: it is a digital modification, made after putting into service, and not foreseen by the original manufacturer. Whether the fourth condition is met is an open question that must be answered installation by installation: does the new control regime call for guards that affect the safety control system, or for measures for stability or mechanical strength, for example because screen or vent loads go beyond the original design margins? We have not verified how vent and screen drives are classified under the Regulation, nor whether a specific climate installation falls within the scope of Article 2 as machinery. So this is expressly a matter for case-by-case assessment, and it ties in directly with what we wrote earlier about climate and energy control in the greenhouse.

Suppose a warehouse adds an AI layer over an existing AGV or order picking installation. If that layer only determines the sequence and allocation of tasks, while the existing safety scanners and bumpers remain the protective layer, untouched, the fourth condition is probably not met. If, on the other hand, the AI takes over obstacle detection or the decision on speed and distance, it plausibly comes close to being a safety component, and once again the deciding question is whether or not it keeps evolving in the field. We have not assessed any specific AGV architecture and have not read any harmonised standard; if you are considering this route, have it assessed for each installation. The broader trade-off around AI in the warehouse is covered in our piece on order picking and staff shortages.

What the omnibus package changed here

If you looked up the relationship between the Machinery Regulation and the AI Act at some point, you may have a picture that has been out of date since this summer. Regulation (EU) 2026/1744 of 8 July 2026, the omnibus package that entered into force on 27 July 2026, changes three things at once on this point.

• The Machinery Regulation moves from Section A to Section B of Annex I to the AI Act. Recital 42 of the omnibus package gives the reason: to prevent overlap, a sectoral approach is chosen for AI in machinery.
• Article 2(2) of the AI Act has been rewritten. For high-risk systems under Article 6(1) related to products covered by Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 now apply. The system therefore remains high-risk, but the substantive chapter on high-risk systems no longer applies directly to such an AI component in a machine.
• Instead, a new paragraph in Article 8 of the Machinery Regulation instructs the Commission to amend Annex III to that Regulation, by means of delegated acts, by adding health and safety requirements for AI systems that are high-risk under Article 6(1) of the AI Act. Those requirements must reflect what Chapter III, Section 2, and Articles 17, 19, 72 and 73 of the AI Act require, and the delegated acts must apply by 2 August 2028 at the latest. As of today, therefore, what exactly they will contain is not yet fixed.
• In addition, the package inserts paragraphs 1a to 1c into Article 6 of the AI Act. Paragraph 1a provides that AI systems used solely for non-safety-related aspects of user assistance, performance optimisation, service efficiency, automation or convenience, or for quality control, do not qualify as safety components; paragraph 1b sets out the counterpart to that. For the AI camera that only rejects product, that is a fresh point of reference, with one warning: that provision concerns qualification under the AI Act, not Article 3(4) of the Machinery Regulation. Read both paragraphs side by side before you build a conclusion on them.
• Finally, the dates for high-risk systems shift to 2 December 2027 for Annex III and 2 August 2028 for AI in regulated products under Annex I.

Where to start in practice

You do not need to build a case file or hire an adviser for this. First make a list of the AI additions you are considering for existing machines in the coming year, including the additions you currently still regard as software rather than as a machine modification. That distinction does not exist in the Regulation.

Document a risk assessment for each of them, and do so before you conclude whether the modification is substantial. In it, answer the fourth condition explicitly: does this modification call for guards or protective devices whose implementation requires a change to the safety control system, or for measures for stability or mechanical strength? Your answer to that question, with the reasoning attached, is the document that matters in an inspection.

In addition, put two questions to your supplier in writing. Does this component fulfil a safety function, and does the model keep learning after it has been deployed? Together, those two answers determine whether you stay in module A or need a notified body, and the difference between those two routes is the biggest cost difference in this whole matter. Before that, however, check whether your machinery category is listed in Annex I, Part B, including the condition of manual loading or unloading that usually goes with it: in that case Article 25(3) decides, not the AI question. The exception is when the added system is itself a self-learning safety component as referred to in Part A, point 6, because then the machine falls under both parts at once and the heavier route of Article 25(2) applies after all.

And record who signs. Under Article 18, the person who carries out the modification declares on their sole responsibility that the machine complies with the Regulation. At AIBA, our starting point is that the human decides and signs; here that is not a working method but the literal content of the provision, and so it is worth that person knowing what they are signing for. Our free Practice Scan helps you choose the first application and get a clear view of what you really need for it.