Regulation (EU) 2023/1230 replaces Directive 2006/42/EC on 20 January 2027. On the same date the Commission's list of harmonised standards for machinery, Implementing Decision (EU) 2023/1586, is repealed. At the start of November 2026 no implementing decision listing standards under the new Regulation had been published, so a machine builder preparing a technical file for a 2027 launch has no cited-standard route to work from at the moment.
The timing comes from two acts read together. Implementing Decision (EU) 2026/2015, adopted on 4 September 2026 and published in the Official Journal on 7 September, added 64 references to the existing list and corrected two crane standards. Its second article repeals the whole of Decision (EU) 2023/1586 with effect from 20 January 2027. The standards package for the outgoing Directive was completed and given an end date in the same document.
The Commission has said that a new implementing decision under Regulation (EU) 2023/1230 is being prepared and is expected to carry over most of the standards now cited. No publication date had been announced when this page was last checked. Machinery placed on the EU market before 20 January 2027 can still be made available under the Directive; units placed on the market from that date fall under the Regulation whether or not standards have been cited for them.
The September 2026 standards decision
Implementing Decision (EU) 2026/2015 is a routine standards update in form. Its scope is worth reading closely.
| Element | Detail |
|---|---|
| Adopted | 4 September 2026 |
| Published in the Official Journal | 7 September 2026 |
| Effect | In force from 7 September 2026 |
| Adds | 64 references to the harmonised standards list under Directive 2006/42/EC |
| Corrects | Two crane standards already in the list |
| Repeals | Implementing Decision (EU) 2023/1586, with effect from 20 January 2027 |
Several of the additions concern machine control directly: EN ISO 10218-1:2025 and EN ISO 10218-2:2025 for industrial robots, EN 1175:2025 for the electrical and electronic requirements of industrial trucks, EN ISO 13855:2024 for the positioning of safeguards, EN ISO 14119:2025 for interlocking devices associated with guards, and the amendment EN IEC 62061:2021/A1:2024 for the functional safety of safety-related control systems. These citations work under the Directive until 19 January 2027. Nothing in the decision carries them into the Regulation.
Why the gap matters for conformity files
Presumption of conformity depends on publication rather than on the content of a standard. A standard gives that presumption only while its reference is cited in the Official Journal under the legal act that applies to the product, and only for the requirements the standard covers.
From 20 January 2027 the applicable act is the Regulation. A citation made under the Directive stops producing the presumption on that date, even where the technical text of the standard has not changed. If no list has been published under the Regulation by then, the manufacturer has to demonstrate conformity by assessing the essential health and safety requirements directly and documenting the reasoning, the risk assessment and the verification. Direct assessment has always been permitted, since harmonised standards were never mandatory. Doing it now means the file has to carry the engineering evidence itself, in a form a market surveillance authority can follow.
The deadline itself does not move. Regulation (EU) 2023/1230 applies from 20 January 2027, and the absence of a cited standards list neither postpones that date nor suspends the obligations. A declaration of conformity drawn up against Directive 2006/42/EC and its cited standards describes a framework that ends on 19 January 2027. A continuing programme is exposed at the first shipment after that date, even where the model itself has not changed.
What the Regulation asks of control systems
The electronics requirements sit in Annex III. Two clauses matter most for an industrial control board.
Section 1.1.9: protection against corruption
Hardware that is critical for compliance with the safety requirements has to be protected against accidental or intentional corruption, and the machinery has to collect evidence of a legitimate or illegitimate intervention in that hardware. The same applies to safety-critical software and data, which must be identified as such. The machinery also has to be able to identify the software installed on it that is necessary for safe operation and make that information available at all times in an easily accessible form.
Section 1.2.1: safety and reliability of control systems
| Point | What it requires |
|---|---|
| 1.2.1(a) | Control systems withstand the intended operating stresses and intended or unintended external influences, including reasonably foreseeable malicious attempts by third parties to create a hazardous situation. |
| 1.2.1(b)-(c) | Hardware faults and control-logic errors do not lead to hazardous situations. |
| 1.2.1(d) | Safety functions cannot be changed beyond the limits defined in the manufacturer's risk assessment, including changes generated during a learning phase. |
| 1.2.1(e) | Reasonably foreseeable human error during operation does not lead to hazardous situations. |
| 1.2.1(f) | The tracing log of intervention data and of the versions of safety software uploaded after the machinery is placed on the market is enabled for five years after each upload, used only to demonstrate conformity following a reasoned request from a competent national authority. |
| 1.2.1(g) | Recording of data on the safety-related decision-making process is enabled, and that data is retained for one year after collection. |
For machinery with fully or partially self-evolving behaviour, the same section adds that the machine must not act beyond its defined task and movement space and must remain correctable at all times. Safety components with self-evolving behaviour that use machine learning appear in Annex I, Part A, so the conformity route for those requires a notified body rather than internal production control alone.
For an assembly supplier the practical reading is narrow: the machine has to know which software it is running, notice when that software or its configuration changes, resist interference, and keep a record that can be produced later.
Where the assembled board sits in that evidence chain
The Regulation addresses machinery and related products. A PCBA supplier in Shenzhen does not hold the CE obligation for a European machine builder's product and cannot sign the declaration of conformity.
The records behind that declaration are partly manufacturing records. A safety function runs through a sensor, a control board, a drive stage and the software that coordinates them. When a machine builder has to show that a safety function was not altered after the unit was placed on the market, part of the answer comes from the board: which revision was fitted, which components were used, whether an approved substitution changed anything relevant, and what the test record showed at build time. The machine builder carries the obligation; the assembly supplier holds part of the evidence for it.
The records worth agreeing in advance
- Board and BOM revision: an identifier that appears in the documentation and on the unit, so a service engineer can confirm what is installed.
- Unit-level traceability: a serial or batch identifier that resolves to component lots and date codes.
- Substitution records: which alternatives were approved, by whom and when, and confirmation that no unapproved part was fitted.
- Process records: the inspection and test steps applied to the build, including where SPI, AOI, X-ray, ICT or functional test were used.
- Change notification: a route for telling the customer about a change before it is introduced rather than after shipment.
- Retention: an agreed period and a way to retrieve the records for a named serial number.
These are ordinary manufacturing records, and most assemblers already produce them. What is new is that a market surveillance authority may ask the machine builder for them under Annex III, which means they have to be retrievable for a named machine and not only as an audit sample from a production lot.
What to ask a control-board supplier before 20 January 2027
1. How is the board revision marked, and where does it appear in the documentation?
Ask to see the identifier on the silkscreen, on the assembly drawing and on the shipping documentation, and check that the three agree. A revision that exists only in a spreadsheet cannot be confirmed on a machine in the field.
2. Can you trace a serial number to the components that were fitted?
Ask whether traceability stops at the batch or reaches the individual unit, and which components are covered. For a safety-relevant board, unit-level traceability is usually the point worth discussing.
3. What is your approval process for a component substitution?
Who approves, what is recorded, and whether the customer sees the change before production or after. The answer decides whether the machine builder can show that the safety function was unaffected.
4. Which test records are retained, and in what form?
Whether results are stored per unit or per batch, whether test limits are documented, and whether the record can be exported in a form the quality team can file.
5. How do you handle a change after the first production run?
A new component, a new panel supplier or a process adjustment can each require re-verification. Ask what triggers a first-article inspection and who makes that decision.
6. Can you hold the records for the period we need?
The five-year tracing requirement in Annex III applies to the machinery, not to the board supplier, but the board records have to exist for that long. Fix the retention period in the supply agreement rather than relying on a default.
What Kilandu can and cannot support
Kilandu assembles control boards for industrial, medical, automotive and energy-storage products at its plant in Bao'an, Shenzhen. Our part of this regulation is documentation and change control around the assembly, not the conformity assessment of the machine.
Within the assembly scope we can support:
- Component sourcing and incoming verification, with substitutions handled through an approval route agreed with the customer.
- SMT and through-hole assembly, with in-process SPI and AOI and X-ray inspection where the product requires it.
- Electrical testing, including ICT and functional test against an agreed test plan.
- Revision marking, serialisation and batch records, where these are specified at quotation or engineering review.
- Retention and retrieval of production, inspection and test records for the period agreed in the quality documents.
Outside that scope:
- We do not write PLC programs, safety software or machine firmware, and we do not assess safety functions against EN ISO 13849 or EN IEC 62061.
- We do not issue CE declarations of conformity, act as a notified body, or take over the machine builder's risk assessment.
- Our published certificates (ISO 9001, IATF 16949, ISO 13485, ISO 14001 and UL) cover management systems and, where applicable, component recognition. They are not evidence of conformity for a finished machine.
The Regulation places responsibility on the economic operator that puts the machinery on the market. A supplier that implies it can carry part of that responsibility creates a gap the customer finds later, usually during an audit.
What to do before January 2027
Just under twelve weeks remain before the Regulation applies. Three items are worth closing out in that time.
- Map safety functions to boards. Identify which assemblies carry safety-relevant functions and record the revision of each. The rest of the work depends on this list.
- Fix the evidence set. Agree with the supplier which records are produced per unit and which per batch, and how long each is kept. Write it into the quality agreement.
- Record the standards position. In the technical file, state which standards are applied and on what basis, and where direct assessment of an essential health and safety requirement is used instead of a cited standard. If a new list appears before 20 January 2027, update the file rather than rebuild it.
Nothing in the transition requires a different board. The exposure is in the file. A technical file that still cites a repealed list is the kind of finding that turns up during a surveillance audit, months after the shipment left.
Frequently asked questions
Does Regulation (EU) 2023/1230 apply to a PCBA manufacturer in China?
Not directly, if the company only supplies boards to a machine builder. The obligations fall on the economic operator that places the machinery on the EU market. The supplier's role is to provide the manufacturing and component records the machine builder needs, as agreed in the supply documents.
Is the harmonised standards list for the new Regulation published yet?
At the start of November 2026, no implementing decision listing harmonised standards under Regulation (EU) 2023/1230 had been published. The Commission has stated that a new decision is being prepared and is expected to include the vast majority of standards currently cited under the Directive. Check the Official Journal before finalising a conformity file.
Can we keep citing EN ISO 13849-1 or EN IEC 62061 after January 2027?
The editions cited under Directive 2006/42/EC do not automatically confer a presumption of conformity under the Regulation. If a standard is cited under the Regulation, it can be used for the requirements it covers. If it is not cited, conformity has to be demonstrated by other means with the technical reasoning documented.
Does a control board need its own CE marking?
A board supplied as a component is not itself a CE-marked product under the Machinery Regulation; the CE marking and the declaration of conformity belong to the machinery. Other legislation may apply to the finished product, and the board's design still affects whether the finished product can meet those requirements.
Is the Cyber Resilience Act relevant to the same boards?
It can be. Connected machinery may fall under both the Machinery Regulation and Regulation (EU) 2024/2847. The Machinery Regulation asks whether a cyber event can compromise safety; the Cyber Resilience Act addresses the security of products with digital elements. They are separate assessments and one does not substitute for the other.
What should we request with each shipment?
At minimum the board revision, the serial or batch identifier, the component traceability record for the agreed components, the approved-substitution record where a change occurred, and the inspection and test results for that build. Write the exact list into the quality agreement rather than requesting it case by case.
Sources
- Regulation (EU) 2023/1230 of the European Parliament and of the Council on machinery.
https://eur-lex.europa.eu/eli/reg/2023/1230/oj - European Commission, Machinery (Regulation (EU) 2023/1230, application from 20 January 2027).
https://single-market-economy.ec.europa.eu/sectors/mechanical-engineering/machinery_en - Commission Implementing Decision (EU) 2026/2015 of 4 September 2026 on harmonised standards for machinery.
https://data.europa.eu/eli/dec_impl/2026/2015/oj - Commission Implementing Decision (EU) 2023/1586 on harmonised standards for machinery (repealed with effect from 20 January 2027).
https://eur-lex.europa.eu/eli/dec_impl/2023/1586/oj - Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act).
https://eur-lex.europa.eu/eli/reg/2024/2847/oj
Standards position checked against the Official Journal on 2 November 2026. This page covers the assembly-supplier side of the requirement and is not legal advice.
Related resources
-
Welcome customers to visit our branch companies for factory inspection and guidance
-
ExpeElectronica2024 in Munich, Germany
-
Connecting Infinite Possibilities | Bao'an District New Union 'Ignite Learning' Class (including our Shenzhen Jintianlei Innovation Technology Co., Ltd.) visited Biz Link to discuss new
-
PCBA industry global prospects
-
Welcome French customer PACE to visit our factory for audit