Cybersecurity is becoming an integral part of machinery safety. The forthcoming EN 50742 standard gives concrete form to the new requirements in the Machinery Regulation and affects how manufacturers need to approach risk assessment, safety functions, and documentation. Here are five things worth starting now.
In our previous blog post, we described prEN 50742 and how cybersecurity is becoming part of machinery safety. Standardization work has continued since then.
As of September 2026, the document has advanced to FprEN 50742:2026, a final draft European Standard. On 11 September, the final vote was recorded as having been initiated. It is not yet a published EN standard.
Publication has been planned for November 2026, subject to a positive final outcome. This makes the issue particularly timely ahead of the Machinery Regulation (EU) 2023/1230 becoming applicable on 20 January 2027.
What does this mean in practice? Here are five areas we think machinery manufacturers should start examining now.
1. Start with the machine’s existing risk assessment
EN 50742 does not mean that the conventional risk assessment disappears and is replaced by a separate IT risk analysis. On the contrary, the starting point remains the machine and its safety.
The central question is: Could manipulation of hardware, software, data, or an interface affect the machine’s safety and lead to a hazardous situation?
This differs from conventional IT security. The focus is not on all of an organization’s cyber risks, but on manipulation of hardware, interfaces, software, or data that could affect machinery safety.
Start with the existing risk assessment, therefore, and identify which protective measures and safety functions could be affected by manipulation.
2. Identify the machine’s interfaces and connections
Modern machines rarely operate entirely on their own. Ethernet, Wi-Fi, USB, remote servicing, higher-level control systems, and programming or service interfaces are examples of connections that may need to be assessed.
Annex III, section 1.1.9 of the Machinery Regulation explicitly addresses protection against interference via connected devices, including remotely connected devices, where such interference could lead to a hazardous situation. FprEN 50742 was developed to address this requirement, among others.
Not every connection presents a high risk, but each needs to be identified and assessed.
3. Ask not only “what could go wrong?” but also “what could be affected?”
Conventional machinery safety considers, among other things, what happens if a component fails or a safety function malfunctions.
EN 50742 adds another dimension: What happens if someone, intentionally or unintentionally, changes information, software, parameters, or communications on which safety depends?
If safety depends on parameters in the control system, for example, verifying that the safety function works may not always be enough. The manufacturer also needs to assess whether functions or data could be affected through the machine’s connections in a way that creates a hazardous situation.
The connection between digital interference and physical machinery safety is the central concern.
4. Make cybersecurity traceable in the CE conformity process
As more aspects need to be considered, documentation becomes even more important. It should be possible to trace the relationship between, for example: Risk → protective measure → safety-critical function → potential interference → measure → verification.
This is where NodeCE is particularly relevant. When risk assessments, requirements, safety functions, and verification are managed within the same structure, it becomes easier to show the relationship between a risk, potential digital interference, the selected measure, and its verification. That traceability is becoming increasingly important in the CE conformity process.
5. Do not wait until 20 January 2027
The Machinery Regulation (EU) 2023/1230 will become applicable on 20 January 2027 and introduces explicit requirements relating to protection against manipulation and the safety of control systems.
Machines and production lines designed during autumn 2026 may be placed on the market after the new Regulation becomes applicable.
Our recommendation is therefore simple: Start identifying safety-critical digital interfaces and functions during the design phase. It is much easier to build in appropriate protection from the outset than to try to add it to a finished design at the end of the CE marking process.
From conventional machinery safety to Security for Safety
EN 50742 does not mean that machinery manufacturers must become experts in general IT security, but the boundary between machinery safety and cybersecurity is changing.
If software, data, or communications can affect a function that matters to the machine’s safety, that potential interference must also be considered as part of the safety work. This is the essence of what is often called Security for Safety.
For many machinery manufacturers, this means developing the CE process they already use. That is precisely what NodeCE is designed to support.
NodeCE brings together risk assessment, requirements, safety functions, verification, and CE documentation in a coherent workflow. As EN 50742 and the Machinery Regulation increase the need for structure and traceability, these relationships become central. Instead of relying on separate documents and spreadsheets, teams can follow the work from an identified risk and requirement through to the selected measure and its verification. This makes NodeCE a natural tool for putting the new requirements into practice in CE conformity work.
Is your CE process ready for 2027?
Book a NodeCE demo and we will show you how risk assessment, safety-critical functions, requirements, and verification can be managed in a coherent CE process ahead of 2027.