19 July 2023
Entry into force
Regulation (EU) 2023/1230 entered into force and replaces Directive 2006/42/EC. Its rules for notified bodies started to apply earlier than the rest.
Templates and guides for the cybersecurity requirements of the EU Machinery Regulation
Editable Word and Excel templates, practical guides and a completed example for a connected field sprayer. Use them to record applicability, add malicious attempts to your risk assessment, specify protection against corruption and write the cybersecurity part of the technical file.
The kit organises the work. Your team implements and verifies the protection measures.
See the kit
Free 4-page overview
- Each template ends with a table of the provisions of Regulation (EU) 2023/1230 it helps you document.
- Checked against Regulation (EU) 2023/1230, its corrigendum and the status of the harmonised standards on 3 November 2026.
- Written by a product cybersecurity architect who has worked on risk assessment, supplier requirements, secure update and PKI design, and evidence for regulatory approval.
The date is fixed. The standards are still coming.
The Regulation has been in force since 2023 and applies from January 2027. The duties then run for as long as your machines are on the market and in use.
- 20 January 2027
Application
Machinery and related products placed on the EU market must meet Annex III, including protection against corruption (1.1.9) and the safety and reliability of control systems (1.2.1), and must carry the CE marking under the Regulation (Art. 54, as corrected in OJ L 169 of 4 July 2023).
- From placing on the marketOngoing
For the life of the machine
Keep the technical documentation and the EU declaration of conformity for at least 10 years (Art. 10(3)). Keep the tracing log of interventions and of safety software versions for five years after each upload (Annex III, 1.2.1(f)). Check every change that could be a substantial modification (Art. 3(16), Art. 18).
What you get
- 14 editable templates (11 Word, each with a PDF preview, and 3 Excel), each ending with a table of the Machinery Regulation provisions it helps you document
- 14 guides that explain what each template is for, which provision asks for it and who fills it in
- A worked example for a fictional connected field sprayer, with 25 completed files
- A mapping workbook between the Machinery Regulation and the Cyber Resilience Act, for machines that fall under both
- Free updates until at least 31 December 2027
Inside the kit
Follow one hazard through the documents.
The Brannvik worked example connects the applicability record, the risk assessment and the evidence matrix. See how the entries relate before you start your own.
How the documents connect
- Hazard
R-01
Boom unfolds near a person.
- Measure
M-01
The controller filters commands by interface.
- Test
T-01
No output is activated from the gateway link.
- Evidence
O-11
The obligation for 1.2.1(a) is evidenced.
ApplicabilityMR-01
Start with the machine.
The applicability record describes the sprayer and its interfaces, and shows why a tractor implement stays in scope as interchangeable equipment.
EX_MR-01_Applicability_Record_Brannvik_M24 · section 1
Excerpts from the fictional Brannvik SprayLine M24 worked example included in the kit. Product files are in English. Select an image to enlarge it.
Your files stay on your systems
The kit is a set of Word, Excel and PDF files that you fill in on your own systems. No cloud deployment is required, and the kit does not require you to upload design or test data to us.
No upload to us
There is no account to create. Design data, interface details, test results and signing-key procedures stay on the systems you choose.
No cloud deployment required
Nothing to install, host or connect to your network. The files open in Microsoft Office or LibreOffice.
Keep editable copies on your own systems
The technical documentation and the EU declaration of conformity must be kept for at least 10 years after the machinery is placed on the market (Art. 10(3)). Your completed files can stay in your own document control for that time.
Pay once
One price per licence. No subscription and no fees per machine or per user. Free updates until at least 31 December 2027.
What the kit does not do: it does not test your machine, scan your code or replace your functional safety work. Keep the tools and analyses you already use for that; the kit shows which cybersecurity evidence the Machinery Regulation expects from them.
When you buy or request the free overview, Polar, our Merchant of Record, processes your order details. See Privacy.
From applicability to the technical file
- 1Applicability and inventory
- 2Risk assessment with malicious attempts
- 3Interfaces and protection measures
- 4Evidence of interventions
- 5Software identification and updates
- 6Verification and evidence
- 7Technical file and instructions for use
- 8Suppliers, changes and the CRA
See a completed set of example documents
All 14 templates are filled in for the Brannvik SprayLine M24, a fictional tractor-mounted field sprayer with an ISOBUS connection, an LTE telematics gateway and a Bluetooth app: applicability record, risk assessment with threat scenarios, interface analysis, protection and evidence specifications, update procedure, verification plan, evidence matrix, technical file, supplier requirements, instructions for use, substantial modification assessment and the mapping to the CRA. Start with the free 4-page overview.
Applicability: interchangeable equipment, in scope, no notified body, CRA applies too
Interface analysis: which command each interface may give
Protection specification: testable requirements, each traced to a measure and a test
Get the free 4-page overview
The 25 filled example files come with the full kit.
Brannvik Agri Systems AB and the Brannvik SprayLine M24 are fictional.
Written by a practitioner
Özer Koray Akdemir is a product cybersecurity architect. He built a product cybersecurity function for connected products while the regulation that required it was still new. The work covered threat analysis and risk assessment, cybersecurity requirements for suppliers, the architecture for signed over-the-air updates and their keys, and the evidence for the approval audit. Before that he worked for many years on embedded systems, cryptographic systems and secure communications. The kit turns that experience into documents your team can complete.
About the author →Two ways to start
Worked example
For teams that want to see finished documents before they start. Begin with the free 4-page overview.
See the worked example →Machinery Regulation Cybersecurity Kit
For manufacturers preparing connected machinery for 20 January 2027. All 14 modules, the guides and the worked example.
See the kit →