What section 1.1.9 requires
- Connected devices: connecting another device, directly or through a remote device that communicates with the machinery, must not lead to a hazardous situation.
- Hardware: a hardware component transmitting signal or data relevant for connection or access to software that is critical for compliance must be adequately protected against accidental or intentional corruption. The machine must collect evidence of a legitimate or illegitimate intervention in that component.
- Software and data: software and data critical for compliance with the essential health and safety requirements must be identified as such and adequately protected against accidental or intentional corruption.
- Identification: the machine must identify the software installed on it that is necessary to operate safely, and be able to provide that information at all times in an easily accessible form.
- Evidence: the machine must collect evidence of a legitimate or illegitimate intervention in, or modification of, that software or its configuration.
Link to cybersecurity certification
The Regulation states that machinery certified, or with a statement of conformity, under a cybersecurity certification scheme adopted under Regulation (EU) 2019/881 (references published in the Official Journal) is presumed to conform with sections 1.1.9 and 1.2.1 of Annex III, insofar as the certificate covers those requirements. Regulation (EU) 2024/2847 (Cyber Resilience Act) recital 53 adds that complying with its essential cybersecurity requirements could facilitate compliance with 1.1.9 and 1.2.1; the manufacturer has to demonstrate that.
Checklist before 20 January 2027
- List every software item and data set your safety functions rely on, and mark them as safety-critical.
- Record how each is protected against accidental and intentional corruption.
- Check what happens on connection of a laptop, fieldbus device or remote service: can it create a hazard?
- Decide how the machine shows the installed safety software versions on demand.
- Decide how interventions in hardware and software or configuration are logged.
- Put the evidence in the technical documentation.
General information, not legal advice or certification. Source: Regulation (EU) 2023/1230, Annex III 1.1.9, and Regulation (EU) 2024/2847 recital 53, on EUR-Lex.
44-point gap checklist
£9
Excel, each row cites its Article or Annex. See which files you must update.
Related: technical file · conformity assessment · digital instructions · UK builders. We sell to businesses only; see Terms.