1. The regulation - what changes in 2027

Two regulations introduce, for the first time, cybersecurity requirements into the world of industrial machinery:

• Machinery Regulation (EU) 2023/1230 - applies from 20 January 2027. It sets essential cybersecurity requirements for machinery, notably Annex III §1.1.9 ("Protection against corruption") and §1.2.1 ("Safety and reliability of control systems").
• Cyber Resilience Act (EU) 2024/2847 - applies from 11 December 2027 (with vulnerability-reporting duties starting 11 September 2026). It covers "products with digital elements", including connected robots.

Both are about making machines resilient to reasonably foreseeable misuse and tampering - not about demanding perfection.

2. Is buying a refurbished robot still compliant?

In most cases, yes - and no new obligations arise. Here is why:

• Legacy status is preserved. Products lawfully placed on the EU market before the application dates keep their status (Machinery Reg. art. 52(1); CRA art. 69(2)). The CRA only re-engages if the product undergoes a substantial modification after that date.
• Repair and refurbishment are not a substantial modification, as long as the intended use and risk level do not change (CRA recital 42).
• The original CE marking stays valid. Original certificates and conformity remain valid (Machinery Reg. art. 52(1)-(2)).

3. When obligations do arise

There are three situations buyers should know about, because they change who is responsible:

Importing from outside the EU

A robot imported from a third country is treated as placed on the market - i.e. as new (Machinery Reg. recital 10). The importer becomes responsible for current conformity; a non-EU "CE" plate is not equivalent to a valid EU CE marking.

Substantial modification

A change not foreseen or planned by the manufacturer that affects safety or compliance (Machinery Reg. art. 3(16); CRA art. 2(30)) makes whoever performs it the "manufacturer", with all related duties (Machinery Reg. art. 18; CRA art. 22). Adding axes within the manufacturer's standard is a foreseen change - not substantial - so the CE stays valid.

Building an assembly

Combining a robot and a welder to work "as an integral whole" creates an assembly of machinery - a new machine with its own intended use (Machinery Reg. art. 3(1)(a) and (d)). Whoever builds the working assembly becomes its manufacturer: new risk assessment, new CE for the assembly, technical file and declaration of conformity (Annex III 1.2.4.4: the emergency stop must halt both robot and welder). Following each maker's integration rules is necessary but not sufficient - the hazards of the combination (arc, fumes, moving torch) are not covered by the original CE markings.

4. Cybersecurity of older-generation robots - how we protect them

Older robots do not verify the authenticity of the instructions they receive: they execute whatever arrives on the expected interface. The law does not demand invulnerability - it requires proportionate protection against "reasonably foreseeable malicious attempts" (Annex III 1.2.1) and evidence of intervention (1.1.9).

Our approach is defence in depth - trust is built around the robot: physical security, network segmentation, disabled USB/ports, whitelist gateway, role-based accounts and passwords, logging, software integrity, plausibility limits.

Where a higher level is justified by the risk assessment, the recommended solution is an encrypted, safety-rated bridge PLC inside a closed and sealed cabinet. It authenticates and encrypts on the outward side (TLS / IEC 62443) and implements certified safety functions (SIL/PL per IEC 61508 / 62061 / ISO 13849), while the cleartext run to the robot stays short and physically protected. Conditions: the bridge is the only access path, encryption is genuinely configured, safety is independent from the gateway part, logging is in place, and everything is documented in the technical file. Residual risk - physical access to the cabinet - is mitigated by seals, open-detection and independent safety, and recorded in the risk assessment.

5. Our approach to compliance

Measures that cost almost nothing - disabled USB, role-based passwords, network segmentation - we apply as standard. Costlier measures are calibrated to the real risk of your site, because it is the risk assessment that defines what is "reasonably foreseeable".

Every unit we refurbish keeps its original conformity documentation. Where we provide a standard base configuration, it can be assessed once and reused across identical units (internal production control, art. 25). For the base "robot + controller" unit (e.g. KRC4), where the cyber requirements mostly live, a single standard configuration is reusable across all units with that controller.

A single certification does not cover every final application: each different cell or assembly needs its own conformity - or we can supply the base unit as partly completed machinery with a declaration of incorporation and assembly instructions (art. 22), leaving the final CE to the integrator.

6. Frequently asked questions