Machinery Regulation and Cyber Resilience Act for UV systems and UV measurement technology

On 20 January 2027, Regulation (EU) 2023/1230 replaces Machinery Directive 2006/42/EC. It brings one requirement the old directive did not have: protection of safety-related hardware, software and data against corruption. For UV systems this has a particular twist that the general literature does not yet address. The safety-related quantity here is not a door switch but a physical measurand – irradiance in W/m² and the dose derived from it in J/m².

This article classifies both regulations for irradiation systems, UV sensors and UV meters. It is written for design engineers and those responsible for CE marking who place systems on the market, and for quality assurance and laboratory management who validate dose and process.

There are two regulations with three deadlines, and the first one is already behind the planning of many manufacturers.

The Machinery Regulation has no transitional or sell-off period. What counts is the moment of placing on the market, not the start of design work. A system designed in 2025 and first made available in February 2027 is measured against the new regulation.

The two regulations pursue different objectives. The Machinery Regulation protects people from physical harm; there, cybersecurity is a means to an end. The Cyber Resilience Act protects the digital elements themselves, regardless of whether an attack would have physical consequences. This yields the distinction that matters most in practice: the Machinery Regulation covers only safety-related functions, the Cyber Resilience Act all digital elements of a product.

Annex III No. 1.1.9 of Regulation (EU) 2023/1230 is headed „Protection against corruption“. In substance, the provision requires five things:

• Safety-related hardware, software and data must be protected against unintentional and intentional corruption.
• The software installed for safe operation must remain identifiable.
• Interventions in safety-related software or its configuration must be traceable; corresponding evidence must be collected and secured.
• Connection to another device, or communication with it, must not give rise to a hazardous situation.
• In addition, No. 1.2.1 requires control systems to withstand reasonably foreseeable malicious attempts at access by third parties.

The word „unintentional“ is often overlooked. What is covered is not only an attack from outside but any falsification: a faulty update, an electromagnetically corrupted setpoint transmission, a bit error in parameter memory. Anyone who reads the clause purely as a cybersecurity requirement misses half of the obligation – and also misses the fact that some of the necessary measures are likely to exist already from the EMC and reliability assessment and merely need to be assigned.

The yardstick is not completeness but proportionality against reasonably foreseeable events. A laboratory irradiation chamber in the closed network of a research institute calls for a different effort than a system connected to a plant network.

This question has to be settled before all others, because it decides whether 20 January 2027 is a deadline for a given device in the first place. The regulation's definition of machinery requires a drive system and at least one moving part – both together, not one of the two.

If your system has a drive system and at least one moving part, it is to be assessed as machinery under Regulation (EU) 2023/1230; otherwise the rules for electrical equipment apply, in particular the Low Voltage Directive 2014/35/EU and the EMC Directive 2014/30/EU.

The BSM-03 curing chamber from Opsytec Dr. Gröbel GmbH has a pneumatic shutter operating at 4 to 6 bar and a movable sample carrier with a load capacity of 20 kg. A drive system and a moving part are therefore present; the chamber is treated as machinery, and its EU declaration of conformity cites the Machinery Directive. From 20 January 2027, Regulation (EU) 2023/1230 takes its place. In the BSL-02, operating personnel are fully protected from UV radiation inside the completely enclosed and monitored irradiation chamber.

The control units of the UV LED range, by contrast, are placed on the market under the Low Voltage Directive 2014/35/EU and the EMC Directive 2014/30/EU. They are neither machinery nor safety components.

Measurement technology provides the counter-example. The SR900 spectroradiometer is expressly built as an array spectrometer with no moving parts. It is therefore not machinery – and a meter that performs no safety function in your system is not a safety component within the meaning of this regulation either.

Protection lies in the interlock, not in the legal interpretation.

This is where UV technology differs. In general machine safety the safety-related quantity is a state – door open or closed, drive free or locked. In a UV system it is a measured value. And the same measured value can take on three different roles.

Protection of persons. Irradiance determines whether the exposure limit values of Directive 2006/25/EC are complied with. For the risk assessment, however, what matters is not the exceedance itself but the severity of the acute effect.

The two acute effects of incoherent UV radiation are well described. UV conjunctivitis – also known as photokeratitis or arc eye – becomes noticeable, according to the German Technical Rules on Artificial Optical Radiation (TROS IOS), only five to ten hours after exposure and has subsided after one to three days. It is expressly regarded as reversible because new epithelial cells are continuously formed in the cornea and conjunctiva. UV erythema appears two to eight hours after the individual threshold dose is exceeded and fades after three to four days.

The TROS IOS itself distinguishes these acute, reversible effects from the long-term, irreversible and carcinogenic effects of UV radiation. The risk graph of EN ISO 13849-1 assesses the severity of a single event – and for that event severity S1 applies, a slight and normally reversible injury. With S1, the required performance level remains at PL c at most, even with frequent exposure and poor avoidability.

This does not release anyone from the exposure limit values. Repeated erythema increases the long-term risk, and DNA damage occurs even below the visible reddening threshold. That is precisely why the limit values of Directive 2006/25/EC and the duties under the German OStrV continue to apply alongside the machinery assessment.

In any case, the weak flank of the assessment is not severity but avoidability. The latency of several hours means that a person being exposed does not notice it at the moment of exposure. Parameter P therefore has to be rated unfavourably. And precisely from this follows the correct measure: not a monitoring function but inherently safe design – the enclosed chamber, the first step of EN ISO 12100. Where the radiation does not leave the housing, no exposure arises that a dose monitor would have to catch.

In a completely enclosed irradiation chamber, dose measurement is therefore not a safety function but a process quantity. Protection lies in the housing and in the interlock, supplemented by marking and instruction in accordance with DIN EN 12198-1.

Where no exposure can arise, the dose has nothing to monitor.

Hygiene safety. In disinfection, the dose does not protect the operator but third parties. An underestimated dose leads to ineffective treatment without anything being noticeable at the system. If the irradiation dose is a protective quantity for third parties in your application, the integrity of the measuring chain is part of your safety assessment and not merely a question of quality.

Process quality. In curing, artificial ageing or photostability testing, the dose is a quality parameter. Corruption leads to scrap or an invalid test result, not to personal injury. Annex III No. 1.1.9 does not apply here – but the Cyber Resilience Act does, as soon as digital elements are involved.

The assignment therefore depends on the application, not on the device. If a component performs a safety function in your system, its parameters belong to the safety-related data under Annex III No. 1.1.9; if it processes process quantities only, it does not. This distinction has to be made, justified and documented in the risk assessment – it does not follow from the data sheet.

One borderline case deserves attention. The RM-32 display unit has switching outputs. If you integrate a switching output into a safety function, the switching threshold that has been set becomes safety-related data. If the output only signals process limits, the same setting remains a quality parameter. Opsytec Dr. Gröbel supplies the traceably calibrated measuring channel; assessing the wiring remains with the manufacturer of the machine.

A switching output becomes safety-related only through the way it is wired.

An example makes the division of responsibility tangible. In the BSM-03 curing chamber, an active guard locking device performs the protective function; it is a safety component. The control voltage for the lamp ballast and for the shutter is enabled through it. The concept is supplemented by warning instructions and end-position monitoring of the shutter. The residual risk of brief exposure is an acute irritation of the eye.

The consequence for Annex III No. 1.1.9 is significant: protection arises upstream of the control system, not within it. Anyone who alters the dose control cannot bypass the guard locking – without enabled control voltage, neither the ballast nor the shutter operates. The safety-related attack surface of the software therefore stays small.

This is not an incidental observation but the core of the demonstration. Annex III No. 1.1.9 requires protection of safety-related software and data. Where the protective function is implemented in hardware and placed upstream of the control system, the set of safety-related software shrinks – and precisely this line of reasoning belongs in the technical documentation, supported by circuit documents and a description of the guard locking device.

A guard lock that removes the voltage cannot be reprogrammed.

The draft standard on protection against corruption works with examples from general mechanical engineering. For a UV measuring chain the scenarios look different. The following table is intended as an entry point into your own threat analysis, not as a final list.

The last two rows are the most frequent cases in practice – and neither of them is an attack. That is exactly why Annex III No. 1.1.9 expressly covers unintentional corruption as well.

A standard of its own is currently being developed for protection against corruption. DIN EN 50742 „Safety of machinery – Protection against corruption“ exists as draft 2026-03 and is being prepared in CENELEC Technical Committee 44X. The draft describes a three-stage procedure: identification of the critical assets, threat analysis, determination of the required level of protection. As levels of protection it defines the stages SRSL0 to SRSL3, where SRSL0 describes the completely isolated network. Two equivalent routes are open for the threat analysis: an analysis specific to the machine manufacturer, or use of the processes from the IEC 62443 series of standards.

If you operate a measuring system in a completely isolated plant network, this corresponds to protection level SRSL0 of that draft. No presumption of conformity arises from it as long as the draft is not listed in the Official Journal of the European Union.

The same holds more broadly: to date, no harmonised standard has been listed in the Official Journal for Regulation (EU) 2023/1230. The demonstration therefore has to be made, for the time being, through your own description of the solution in the technical documentation. Applicable standards may and should be drawn on as the state of the art, but they do not carry the burden of proof.

The network architecture decides the protection level, not the individual device.

Both regulations require evidence. For a UV system, the evidence to be provided is metrological in nature: the question is whether the displayed value corresponds to the actual value.

Opsytec Dr. Gröbel GmbH operates two laboratories accredited in accordance with DIN EN ISO/IEC 17025:2018-03: the calibration laboratory K-20284-01-00 and the testing laboratory PL-20284-01-00. Calibration covers 200 to 1000 nm and 0.2 µW/cm² to over 10 W/cm², with a measurement uncertainty of ≥ 2.8 %. The testing laboratory also assesses in accordance with ASTM G138-12, CIE 250:2022 and the photobiological classification under IEC 62471-6:2022.

A traceable calibration provides the metrological basis for such evidence. It is not, however, a statement about the conformity of a product with the Machinery Regulation: accreditation concerns the calibration and testing service, not the product.

Traceability does not replace a declaration of conformity – it makes one demonstrable.

Protection against corruption is only one part of the risk assessment. For the radiation itself, the familiar rules continue to apply: DIN EN 12198-1:2008-11 for assessing and reducing risks from radiation emitted by machinery, with radiation categories 0, 1 and 2; DIN EN 62471:2009-03 for the photobiological classification of the source into risk groups; and the German Ordinance on the Protection of Employees against Hazards from Artificial Optical Radiation (OStrV) for the duties of the operator.

From 20 January 2027, DIN EN 12198-1 will be applied within the risk assessment under Regulation (EU) 2023/1230 rather than under the Machinery Directive. The assessment methodology itself does not change.

You will find details on the course and healing of the acute effects under UV erythema in the workplace. A complete overview of the applicable rules, with categories and assessment distances, is available under Guidelines, norms and standards in UV.

The Cyber Resilience Act does not attach to the definition of machinery but to the data connection. If a direct or indirect data connection to a device or network is intended for a product, it is a product with digital elements under Regulation (EU) 2024/2847. Measurement technology is therefore covered, even though it is not machinery.

Spectroradiometers, dosimeters and hand-held meters have neither a drive system nor a moving part. But because the data connection to the evaluation PC is intended, the Cyber Resilience Act applies nonetheless. What does not move is not machinery – it is covered all the same.

With sensors, the connection decides. UV probes, inline sensors and PLC sensors output irradiance as an analogue signal of 0 to 10 V or 4 to 20 mA; if a sensor is connected purely by analogue means, it has to be examined case by case whether a data connection within the meaning of the regulation exists at all. The PLC.D, by contrast, offers RS-485, RS-232 and USB and is therefore indisputably a product with digital elements. The PLC.net transmits readings via Ethernet, Modbus TCP and CSV export and is powered by Power over Ethernet Type 1. Operating instructions and data sheet specify use in a closed plant network; the device works with a fixed IP address.

Only the protocol turns a measuring signal into a digital element.

Two design characteristics have a direct bearing on Annex III No. 1.1.9 and on Annex I of the Cyber Resilience Act. Changes require a physical key press at the device, and this applies to firmware updates as well – an update cannot be installed remotely. The product portfolio of Opsytec Dr. Gröbel GmbH moreover contains no radio interfaces and no remote maintenance; the Radio Equipment Directive 2014/53/EU and the EN 18031 series are therefore not applicable to these devices.

Opsytec Dr. Gröbel GmbH has set up a process for reports under Article 14 of the Cyber Resilience Act. Reports of vulnerabilities are accepted via the contact details given in the imprint.

Anyone who has to stand at the device does not change it from the network.

The same applies on the control side. The LedControl Touch offers RS485 and USB, optionally a LAN web interface, Modbus RTU and ASCII, and straightforward firmware upgrades. Parameterisation is password-protected and divided into the separate roles of administrator and operator. Access control and the provision of security updates are among the essential requirements in Annex I of Regulation (EU) 2024/2847.

For safety-related shutdown there is a clear division of labour, and it is the point at which most data sheets become vague. The interlock input of the LedControl is galvanically isolated; the control unit and the LED modules work with a safety extra-low voltage of 24 V DC and can be switched off completely in the event of a fault. The performance level, however, is achieved not by the control unit but by the circuit: two-channel guard door monitoring with monitored external contactors is, according to the manufacturer, suitable up to Category 4 and PL e in accordance with EN ISO 13849-1 and SIL 3 in accordance with EN 62061, provided that short circuits in the control of the actuator and in the sensor circuit can be excluded. The characteristic values belong to the external safety components; the calculation of the safety function is specific to the installation.

For a completely enclosed chamber with severity S1, a low performance level is generally sufficient. Where an operator classifies higher, the connection example covers the range up to Category 4 and PL e.

The performance level is achieved by the circuit, not by the control unit.

Replacing mercury vapour lamps with UV LED modules changes the spectrum, the irradiance distribution and often the control system as well. If such a conversion constitutes a substantial modification, it triggers a new conformity assessment – and whoever carries it out becomes the manufacturer of the modified machine, even if they had previously only operated it.

What matters for the assessment is whether the conversion creates a new hazard or increases an existing risk. When the spectral range changes, both are possible in principle: the photobiological classification of the source under DIN EN 62471:2009-03 may change, and a dose monitor calibrated for the old spectrum will read incorrectly after the conversion.

If your system is placed on the market for the first time after 20 January 2027, Regulation (EU) 2023/1230 governs, even if design work began earlier. The same applies to a system that has to be treated as new machinery in law because of a conversion carried out after that date.

Does a UV irradiation system fall under Machinery Regulation (EU) 2023/1230?

Only if it has a drive system and at least one moving part, such as a shutter, a turntable or a movable sample carrier. A chamber without moving parts is electrical equipment and is subject to the Low Voltage and EMC Directives.

What exactly does Annex III No. 1.1.9 „Protection against corruption“ require?

Safety-related hardware, software and data must be protected against unintentional and intentional falsification. The installed software must remain identifiable, interventions must be traceable, and connection to another device must not give rise to a hazardous situation.

When is UV dose monitoring a safety function?

Not in a completely enclosed chamber – there the housing provides protection and the dose is a process quantity. It becomes safety-related where it protects third parties, for instance in disinfection, or where a system is operated without complete enclosure.

What performance level does the interlock of a UV irradiation chamber need?

The severity of acute UV exposure is generally S1, a slight and normally reversible injury: photokeratitis heals within one to three days according to TROS IOS. In the risk graph of EN ISO 13849-1, S1 limits the required performance level to PL c at most.

Is a UV sensor a safety component within the meaning of the Machinery Regulation?

As a rule, no. It depends on its function in the system, not on the sensor type: if the sensor supplies process values only, it is not a safety component. In an enclosed chamber this is the normal case. The classification is made in the risk assessment.

Does the Cyber Resilience Act also apply to UV meters and UV sensors?

Yes, as soon as a direct or indirect data connection to a device or network is intended for the device. A radiometer with a USB port is therefore covered, even though it is not machinery. With purely analogue connection, the classification has to be examined case by case.

Do I need two CE markings if the Machinery Regulation and the CRA both apply?

No, there remains one CE marking. It may only be affixed if both regulations are satisfied, and both have to be named in the EU declaration of conformity. The conformity assessment is carried out separately for each regulation.

Does converting a UV system to UV LED become a substantial modification?

It may. What matters is whether a new hazard arises or an existing risk increases. When the spectral range changes, the photobiological classification may change, and the dose monitoring has to be recalibrated.

Which documents should I request when buying a UV system from 2027?

An EU declaration of conformity naming the applicable legal acts, operating instructions with details of emission and assessment distance, evidence of traceability for the dose monitoring, and information on access protection, software version and update path.

The statements on the course and healing of the acute UV effects are based on the German Technical Rules on Artificial Optical Radiation (TROS IOS, General Part) issued by the Federal Institute for Occupational Safety and Health, on the information published by the Federal Office for Radiation Protection on acute damage to eyes and skin, and on Annex 3 of the Technical Rules of the German Social Accident Insurance Institution for the Building Trade, which justifies the reversibility of photokeratitis by the continuous regeneration of epithelium in the cornea and conjunctiva.

The classification of severity and the assignment of the required performance level follow the risk graph of EN ISO 13849-1. The protection levels SRSL0 to SRSL3 come from draft standard DIN EN 50742:2026-03, which is not listed in the Official Journal of the European Union and therefore does not give rise to a presumption of conformity.

Spectrally resolving and broadband instruments are available for assessing irradiance and dose. The SR900 spectroradiometer records the spectral distribution and works without moving parts. The RMD Pro operates several sensors simultaneously and stores measurement series for evaluation. For permanent monitoring in the process, the UV sensors with analogue, serial or Ethernet connection are suitable, and for dose control inside the chamber the UV-MAT.

Traceability is provided by the calibration laboratory of Opsytec Dr. Gröbel GmbH. Please contact us for a classification of your system.