Machinery Regulation
EU Machinery Regulation 2027: which part of the technical file is a data question
Regulation (EU) 2023/1230 applies to every machine placed on the market from January 2027 onwards. It prescribes no software. A project folder with a content list meets the form, and for many machine builders that is the right answer. This page says which four duties are data duties, where a folder breaks anyway, and which part of it Ref carries today.
The situation
Four new duties, and all four are about data
Against the old Machinery Directive 2006/42/EC, four points are genuinely new. The source code of safety-related software belongs in the file and has to be produced on the reasoned request of a national authority. For sensor-fed, remotely driven or autonomous machinery, the data used and the development, testing and validation processes belong in it too, where safety-related operations are controlled by sensor data. Digital instructions for use and digital declarations of conformity have to stay reachable online for the expected lifetime and at least ten years. And handing the file over has itself become a duty: on reasoned request, everything in paper or digital form, in a language the authority understands.
One tightening is easy to miss. A software update can amount to a substantial modification. Whoever performs it becomes the manufacturer in law, with a new risk assessment, a new file and a new ten years.
The honest answer
A folder meets the form
The Regulation prescribes no form, no file format and no system. Article 10(10) asks for the documentation in paper or digital form, and that is the whole requirement. A folder on the file server with a spreadsheet as its index is permitted. A paper binder is permitted. Anyone telling you otherwise is selling fear.
If your evidence consists of drawings, a standards tree and a risk assessment, CE software is built for exactly that and costs a fraction of a data platform. Then it is the right way, and we say so in the first conversation.
Where it breaks
Ten years outlast the people
The retention period runs per machine from delivery. At five machines a year, five years in, 25 periods are open at once. The folder can hold that. Finding things again is the work, after a staff change, a server move and two format changes.
A substantial modification also needs the state as delivered, because the delta risk assessment refers back to the original file. An overwritten document no longer knows that state. And an assessor walks a chain, from the hazard through the requirement and the protective measure to the evidence and the residual risk. A folder structure does not hold that chain; the connections sit in the designer's head.
Where the data came from
The point at which a folder stops carrying
Annex IV Part A point (n) is the sentence that lands on robotics and automation. It reaches sensor-fed, remotely driven or autonomous machinery, and there only where safety-related operations are controlled by sensor data. Where that holds, the characteristics, capabilities and limitations of the system have to be described where appropriate, together with the data and the development, testing and validation processes used. Those are datasets, runs and model states.
A file server manages those worst of all, and classic PLM was built for parts lists and CAD. In Ref a result stays connected to the run that produced it, and the run to the dataset and the model state it used. That comes out of the work itself and is no documentation task. The traceability page shows what the chain looks like in daily use.
In Ref
Which part Ref carries
Every file, model, run and result exists as a version, and versions are never overwritten. Who submitted what and when is written by the server and cannot be edited afterwards. Requirements come in as ReqIF and go out as ReqIF. Bought-in components sit in the product's dependency record together with their declarations. Suppliers get their own login, limited to what you give them. Agents work under the same rules as people, and their work is marked as machine-authored.
Boundaries
What others do better
Ref does not do the risk assessment itself: no standards tree, no checklist against Annex III. The traceability log inside the machine, the control system's account of its own safety software and the protection against corruption under Annex III sections 1.1.9 and 1.2.1 are control technology in your product rather than data management at our end. Keeping the instructions for use online for ten years per serial number is not part of it either; separate suppliers exist for that. The scope page says this at more length.
Who it is for
When a data platform pays for itself here
The Regulation on its own does not carry the price of a data platform. If your file consists of drawings, a standards tree and a risk assessment, take CE software and be done sooner. If your evidence consists of simulations, test series and datasets, if sensor-fed or learning functions are involved, and if you carry several variants, the folder breaks at point (n). That is where our work starts.
Questions
What people ask first
Does the Regulation prescribe a system?
No. Article 10(10) asks for paper or digital form, in a language that is easily understood. Form, format and tool are free.
Is there a transition period?
No. What counts is the date of placing on the market, rather than the date design started. Machines placed on the market before it keep their status; Article 52 covers this.
Which harmonised standards apply?
Under Article 20 the presumption of conformity attaches to standards whose references are published in the Official Journal. Which ones that is on your date is a question for your CE coordinator. This page is no legal advice.
Does the history survive ten years?
Versions are never deleted during the contract, and reading back a state from years ago is the normal case. The retention duty stays yours.
Does Ref replace our CE software?
No. We expect it to keep running alongside, and we build no standards tree of our own.
What applies to AI-based safety components?
For safety components with fully or partly self-evolving behaviour through machine learning, Article 25(2) rules out self-certification; a notified body has to assess them. Data management changes nothing about that. It makes the documentation that body asks for presentable.
Where does the data sit?
In the Azure region of your choice inside the EU. Running on your own premises is possible as a project.
Related pages
If your evidence consists of runs and datasets, a pilot with one real project shows in four weeks how far this carries, and it costs nothing. Tell us about your project.