Machinery Risk Assessment: The Iterative Method the Regulation Requires, Step by Step with ISO 12100

Its result is recorded under Annex IV, point (b).

Regulation (EU) 2023/1230 applies from 20 January 2027. Until 19 January 2027 the same duty sits in Annex I, general principle 1 of Directive 2006/42/EC, applied through national law; the EU Machinery Regulation keeps the five steps and widens what the assessment must cover.

The sections below cover the definitions, the duty holder, the five steps, the iteration, risk reduction, the 2027 additions, partly completed machinery, the record and the method standard. The table gives eight core rules with their legal basis.

What Is a Machinery Risk Assessment?

Annex III, Part B, point 1 of Regulation (EU) 2023/1230 requires the manufacturer of machinery or a related product to ensure that a risk assessment is carried out in order to determine the essential health and safety requirements which apply to it.

The Regulation (EU) 2023/1230 text on EUR-Lex then requires the product to be designed and constructed "to eliminate hazards or, if that is not possible, to minimise all relevant risks, taking into account the results of the risk assessment".

Under Part B, point 2, a requirement applies only where the corresponding hazard exists under conditions foreseen by the manufacturer or in foreseeable abnormal situations; sections 1.1.2, 1.7.3 and 1.7.4 apply in all cases.

Under Part B, point 4, chapter 1 applies to every product and chapters 2 to 6 according to the result, which selects the essential health and safety requirements of Annex III in play.

Hazard, Risk and the Other Annex III Definitions

Annex III, Part A of Regulation (EU) 2023/1230 defines the nine terms the risk assessment works with, starting with "hazard", "a potential source of injury or damage to health".

Under Directive 2006/42/EC these definitions sat in Annex I, section 1.1.1, which in the Regulation is headed "Applicability" and applies the requirements to partly completed machinery insofar as relevant. The table quotes all nine definitions in the order of Part A.

All nine definitions sit in Annex III, Part A; other terms: Machinery Regulation definitions.

Who Must Carry Out the Risk Assessment

The duty rests on the manufacturer: Annex III, Part B, point 1 of the Regulation names only "the manufacturer of machinery or a related product", while Annex I, general principle 1 of Directive 2006/42/EC named the "manufacturer of machinery or his authorised representative".

The Commission's guide to Directive 2006/42/EC, Edition 2.3, states that the risk assessment may be carried out by the manufacturer, the authorised representative or another person acting on their behalf, and that the manufacturer remains responsible.

Under Article 12(1), second subparagraph, of Regulation (EU) 2023/1230, drawing up the Annex IV technical documentation is not part of an authorised representative's mandate. The wider duties are set out under manufacturer obligations under the Machinery Regulation.

The Five Steps of Annex III, Part B, Point 1

Annex III, Part B, point 1 of Regulation (EU) 2023/1230 sets five steps, (a) to (e): determine the limits of the machinery, identify the hazards, estimate the risks, evaluate the risks and eliminate the hazards or reduce the risks.

Directive 2006/42/EC listed the same five steps as five indents of Annex I, general principle 1; the Regulation letters them and refers to "the machinery or related product". The table quotes each step and names the section that explains it.

Step (a): Determine the Limits of the Machinery

Step (a) determines the limits of the machinery or related product, "which include the intended use and any reasonably foreseeable misuse thereof". Intended use follows the information in the instructions for use, and reasonably foreseeable misuse is a use not intended in those instructions "but which may result from readily predictable human behaviour".

The German statutory accident insurance publication DGUV Information 209-092 (English edition 2025.06) treats the defeating of safeguards, where guards impede operation, as a foreseeable misuse that the manufacturer should have considered at design. For self-evolving products, the assessment also takes in hazards from the intended evolution of their behaviour.

Steps (b) and (c): Identify Hazards and Estimate Risks

Step (b) identifies "the hazards that may be generated by the machinery or related product and the associated hazardous situations", and step (c) estimates each risk "taking into account the severity of the possible injury or damage to health and the probability of its occurrence".

Annex III, Part A defines risk as "a combination of the probability and the degree of an injury or damage to health that can arise in a hazardous situation", so every estimate combines the two factors that step (c) names.

Step (c) sets no scale, matrix or scoring method; the record under Annex IV, point (b) must demonstrate the procedure carried out.

Step (d): Evaluate Whether Risk Reduction Is Required

Step (d) evaluates the risks "with a view to determining whether risk reduction is required, in accordance with the objective of this Regulation".

The benchmark is the requirements themselves: Part B, point 3 of Annex III makes them mandatory, and where the state of the art does not allow their objectives to be met, the product must be designed and constructed to approach those objectives as far as possible.

Directive 2006/42/EC used the same wording with "the objective of this Directive" as the reference.

Step (e): Eliminate Hazards or Reduce Risks

Step (e) eliminates the hazards or reduces the associated risks "by application of protective measures, in the order of priority established in section 1.1.2(b)".

Every measure chosen in step (e) changes the machine, so it goes back through steps (b) to (d): the measure is checked for adequacy and for any new hazard it creates. This return loop makes the process iterative.

Why the Process Is Iterative

The machinery risk assessment is iterative because every protective measure chosen in step (e) is evaluated again for its adequacy and for any new hazard it creates, and the loop runs in parallel with the design.

Annex III, Part B, point 1 of Regulation (EU) 2023/1230 describes an iterative process of risk assessment and risk reduction, as Annex I, general principle 1 of Directive 2006/42/EC did.

The Commission's Guide to application of the Machinery Directive 2006/42/EC, Edition 2.3 (April 2024), explains the loop in these terms and places the risk assessment in parallel with the design process.

Edition 2.3 is the Commission's current guidance on the Directive. For Regulation (EU) 2023/1230, only a temporary and partial guide, version 1.00, exists as of 12 November 2026, so the explanation of the loop comes from the Guide to Application of the Machinery Directive.

The Three-Step Method of Risk Reduction

Annex III, section 1.1.2(b) of Regulation (EU) 2023/1230 fixes the order of risk reduction: first eliminate or minimise risks by inherently safe design and construction, then take the necessary protective measures against risks that cannot be eliminated, and only then inform users of the residual risks.

The order is a hierarchy, not a menu. Protective measures apply only to risks that design cannot eliminate, and information applies only to the risks that remain after both. The table maps each step of section 1.1.2(b) to the manufacturer's action and to the place in the technical documentation where it is recorded.

Residual Risks and the Information for Use

Residual risks are the risks that remain after design and protective measures, and section 1.1.2(b) requires the manufacturer to inform users of them, to indicate whether particular training is required and to specify any need for personal protective equipment.

Section 1.7.2 of Annex III, "Warning of residual risks", requires warnings where risks remain, and the record under Annex IV, Part A, point (b)(ii) indicates residual risks "when appropriate".

Sections 1.7.3 on marking and 1.7.4 on instructions apply to every product whatever the result (Part B, point 2). Their content, language and format rules are set out under machinery instructions.

What the Regulation Adds from 20 January 2027

From 20 January 2027, the risk assessment of machinery placed on the market follows Annex III, Part B of Regulation (EU) 2023/1230, which keeps the five steps of Directive 2006/42/EC and adds two scopes: hazards from the intended evolution of self-evolving behaviour and risks from interactions between machines in an assembly.

The design sentence also changes: the Directive 2006/42/EC text on EUR-Lex said only "designed and constructed taking into account the results of the risk assessment".

Directive 2006/42/EC applies through national law until 19 January 2027 and is repealed from the application date (Article 51(2)). Products placed on the market under it before that date may continue to be made available (Article 52(1)); there is no parallel period. The table compares the two texts row by row.

Every other change is listed under Machinery Regulation vs Machinery Directive.

Self-Evolving Behaviour and Varying Levels of Autonomy

Annex III, Part B, point 1 requires the risk assessment to include hazards "foreseeable at the time of placing the machinery or related product on the market as an intended evolution of its fully or partially self-evolving behaviour or logic".

The sentence covers the whole lifecycle of products "designed to operate with varying levels of autonomy". Recital 32 of Regulation (EU) 2023/1230 adds that the manufacturer should address foreseen software updates and the intended evolution of the product's behaviour.

AI systems acting as safety components are also high-risk under Regulation (EU) 2024/1689. The product rules for learning and autonomous machines are covered under machinery with self-evolving behaviour.

Interactions Between Machines Functioning as an Integral Whole

The risk assessment of Regulation (EU) 2023/1230 includes risks resulting from interactions between machines arranged and controlled to function as an integral whole under Article 3, point (1)(d). Recital 33 extends the attention to interactions between components, including partly completed machinery, and within assemblies.

The Commission's guide to Directive 2006/42/EC already treated a functional link that makes a risk assessment of the whole necessary as one of three cumulative criteria of an assembly, next to a common function and a common control system. The Regulation writes that scope into the legal text.

Risk Assessment of Partly Completed Machinery

Annex III, Part B, point 5 of Regulation (EU) 2023/1230 states that "these general principles shall apply to the risk assessment carried out by the manufacturer of partly completed machinery", so the module supplier runs the same five steps for the requirements it covers.

Article 8 requires partly completed machinery to meet the relevant requirements, and section 1.1.1 applies them insofar as relevant. Directive 2006/42/EC had no such general principle, but its Annex VII, Part B already required "the risk assessment documentation showing the procedure followed", so point 5 is a new explicit provision, not a new duty.

The result goes into Annex IV, Part B, point (b): the requirements that apply and the protective measures implemented, with residual risks where appropriate. The integrator then assesses the complete machine, including the interactions of the incorporated partly completed machinery (recital 33).

Documenting the Risk Assessment (Annex IV, Point (b))

Annex IV, Part A, point (b) of Regulation (EU) 2023/1230 requires documentation on the risk assessment demonstrating the procedure carried out, including a list of the applicable essential health and safety requirements and a description of the protective measures implemented to meet each of them, with residual risks when appropriate.

Annex IV, Part A has 15 points, (a) to (o), and Part B for partly completed machinery 13 points, (a) to (m), each with its own point (b). Directive 2006/42/EC asked for the same record in Annex VII, Part A, point 1(a), fourth indent; the Regulation ties the protective measures to each applicable requirement.

The record is drawn up before placing on the market or putting into service, together with the Article 25 procedure (Article 10(2)), and kept for at least 10 years after placing on the market or putting into service (Article 10(3)); for partly completed machinery, after placing on the market (Article 11(3)).

The other points of the machinery technical file are set out under machinery technical file.

Templates, Checklists and Software for the Record

Whatever template, spreadsheet or software produces it, the record must show the procedure carried out and contain the two items of Annex IV, point (b): the list of applicable requirements and the protective measures for each.

The Commission's guide to Directive 2006/42/EC says that this information can be drawn up as a checklist of the applicable requirements and the protective measures. ISO/TR 14121-2 gives practical guidance on conducting a risk assessment in accordance with ISO 12100, with methods and tools for each step and examples of risk reduction measures.

The Method Standard Behind the Five Steps

EN ISO 12100:2010, "Safety of machinery - General principles for design - Risk assessment and risk reduction", is the type-A standard that describes the method behind the five steps.

ISO describes its scope as terminology, principles and a methodology for safety in design, covering risk assessment, risk reduction, documentation and verification, and as the basis for type-B and type-C standards.

As of 12 November 2026, EN ISO 12100:2010 is the only type-A standard in the Directive list, Implementing Decision (EU) 2023/1586, since Implementing Decision (EU) 2024/1329, and the list notes that applying A-type standards alone "does not give a full presumption of conformity". Editions and revision are covered under EN ISO 12100.

As of 12 November 2026, no harmonised standard is cited in the Official Journal under Regulation (EU) 2023/1230. The Directive list, Implementing Decision (EU) 2023/1586, was last amended by Implementing Decision (EU) 2026/2015 of 4 September 2026, which also repeals it with effect from 20 January 2027.

How to Carry Out a Machinery Risk Assessment in Compliance

Carrying out a machinery risk assessment under Regulation (EU) 2023/1230 takes six steps, from deciding who does the work to feeding the result into the conformity assessment. The six steps are listed below.

1. Decide who does the work, in-house or machinery safety consultants; responsibility stays with the manufacturer.
2. Determine the limits, including misuse, self-evolving behaviour and assembly interactions.
3. Identify hazards and estimate each risk by severity and probability.
4. Evaluate and reduce in the section 1.1.2(b) order, repeating for every new measure.
5. Record requirements, measures and residual risks under Annex IV, point (b).
6. Use the record in conformity assessment under the Machinery Regulation, keep it at least 10 years and check the route with the machinery conformity route finder.

Where the Risk Assessment Leads Next

Three provisions of Regulation (EU) 2023/1230 refer back to the risk assessment, so its results carry into control systems and autonomous travel, and its methods appear among the criteria for Annex I, Part A. The three provisions and one tool are listed below.

• Annex III, section 1.2.1(d): safety function limits are set in the risk assessment (safety and reliability of control systems).
• Required performance level per safety function (required performance level finder).
• Section 3.3.3: protection "as the risk assessment requires" (autonomous mobile machinery).
• Article 6(7)(d): uncertainty in existing risk assessment methods as a condition for Part A (high-risk machinery in Annex I).

Machinery Risk Assessment Questions

Four questions recur about the machinery risk assessment: workplace duties, C-type standards, environmental risks and modified machines.

Is the manufacturer's risk assessment the same as a workplace risk assessment?

No: the Annex III, Part B, point 1 assessment is a design duty of the manufacturer, while the Commission's guide to Directive 2006/42/EC states that national rules implementing Directive 2009/104/EC always apply to the use of machinery at work. The employer's side is covered under Work Equipment Directive 2009/104/EC.

Does applying a C-type standard replace the risk assessment?

No: the Commission's guide to Directive 2006/42/EC says applying harmonised C-type standards does not entirely dispense the manufacturer from the risk assessment. Hazards the standard does not cover need a full risk assessment, and a choice between alternative solutions needs a specific risk assessment.

Do environmental risks belong in the risk assessment?

Only for machinery applying plant protection products: Annex III, Part B, point 4 of Regulation (EU) 2023/1230 limits the environmental requirements to section 2.4 products. Their risk assessment covers unintended exposure of the environment, and leakage must be prevented at all times.

Does a modified machine need a new risk assessment?

Yes, when the modification is substantial: whoever makes a substantial modification within the meaning of Article 3(16) becomes the manufacturer under Article 18 of Regulation (EU) 2023/1230 and takes on the Article 10 obligations, including the risk assessment. Within an assembly, the duties attach to the affected machine "as demonstrated in the risk assessment" (substantial modification of machinery).