Machinery Regulation guide
Risk assessment for machinery: the obligation, the process and what the Machinery Regulation newly requires
No CE marking without a risk assessment: the process according to ISO 12100 — and the new Machinery Regulation requirements from cybersecurity to AI.
Risk assessment: who needs it and why it comes first
The risk assessment is the foundation of all machinery compliance: before placing on the market, the manufacturer must systematically identify the hazards presented by its machinery, estimate the risks and reduce them sufficiently through design, protective measures and user information. Without a documented risk assessment there is no legally sound EU declaration of conformity — and therefore no CE marking.
The obligation applies to anyone who counts as a manufacturer — including a company that builds machinery for its own use, and one that substantially modifies existing machinery. And it deliberately stands at the start of the project: design decisions, warnings and the residual-risk chapters of the operating instructions are all derived from the risk assessment — anyone who "documents it retrospectively" at the end inverts the logic and produces paperwork instead of safety.
The risk assessment process according to DIN EN ISO 12100
The established roadmap is DIN EN ISO 12100. It describes the risk assessment as an iterative process:
- Determine the limits of the machinery: limits of use including reasonably foreseeable misuse, spatial and temporal limits (lifetime, maintenance intervals).
- Identify hazards — systematically across all life phases: transport, assembly, commissioning, operation, setting, maintenance, fault clearance, dismantling.
- Estimate the risks: severity of harm and probability of occurrence for each hazard.
- Evaluate the risks: has the risk been adequately reduced — or is further action required?
- Risk reduction in three steps: (1) inherently safe design, (2) technical protective measures, (3) user information — in exactly that order of priority. A warning does not replace a feasible design solution.
- Iterate until all risks are adequately reduced; remaining residual risks belong in the operating instructions.
Risk assessment under the Machinery Regulation: new topics, same logic — and the documentation question
The EU Machinery Regulation 2023/1230 retains the basic logic but widens the scope: where relevant to the machinery, from 20 January 2027 cybersecurity risks (protection of safety functions against manipulation) and the behaviour of self-learning systems must also feed into the risk assessment. Anyone incorporating networked controls or AI functions should add these chapters to their assessment templates now.
For documentation, the rule is: the risk assessment forms part of the technical documentation and must be retained for 10 years from the placing on the market — deliverable to the market surveillance authorities, but not owed to the customer. In practice, filing it in the digital machine file with access protection has proven itself: operating instructions publicly available via the QR code, risk assessment and design documents in the protected area. That way, the state of the documentation at the time of delivery remains demonstrable even years later.
FAQ
Frequently asked questions
Who must prepare the risk assessment?
The manufacturer — or whoever legally becomes the manufacturer: this includes companies that build machinery for their own use or substantially modify existing machinery. Delegation to external service providers is possible; the responsibility remains with the manufacturer.
Which standard governs the risk assessment?
The standard is DIN EN ISO 12100 ("Safety of machinery — Risk assessment and risk reduction"). It describes the iterative process from determining the limits of the machinery through to three-step risk reduction.
Must the risk assessment be handed over to the customer?
No. It is part of the technical documentation of the manufacturer and only needs to be presented to the market surveillance authorities upon reasoned request. The customer receives the operating instructions and the declaration of conformity — the residual risks from the assessment appear there as warnings.
Keep reading
More chapters of this guide
Machinery Regulation: Deadlines and Transition until 20 January 2027
A hard cut-off date instead of a transition period: from 20 January 2027, every placing on the market is governed exclusively by the Machinery Regulation.
Digital Operating Instructions under the Machinery Regulation: What Is Permitted
Paper is no longer mandatory: Article 10(7) permits digital operating instructions — subject to four conditions.
Technical Documentation under the Machinery Regulation: Scope, Retention, Access
From risk assessment to declaration of conformity: what must remain deliverable for 10 years — and what may stay protected.
QR Code on the Machine: How It Satisfies the Machinery Regulation
The Machinery Regulation does not prescribe a QR code — but it does require a permanent digital access route. The code is the de facto standard.
What Is an EU Declaration of Conformity? Mandatory Contents and Transition to the Machinery Regulation
The legally binding document behind the CE marking: what belongs in it — and what changes on 20 January 2027.
Next step