EU machinery and cybersecurity rules: considerations for Tianjin robotics companies
2026-10-23 · Machine translation; headline edited
GLOBAL COMPLIANCE · ROBOTICS
New EU regulations on robotics are set to take effect soon.
What should Tianjin-based companies consider when expanding overseas?
Machine Safety × Cybersecurity × HANNOVER MESSE
As the global robotics industry accelerates its shift toward intelligence and digitalization, the European market is placing increasingly stringent demands on the safety, reliability, and cybersecurity of robotic products.
In 2027, two key EU regulations will enter a critical implementation phase: Machinery Regulation (EU) 2023/1230 will become fully applicable on January 20; and the main cybersecurity requirements for products under the Cyber Resilience Act (CRA) will become fully applicable on December 11. Among these, the CRA’s reporting obligations regarding vulnerabilities that have been actively exploited and serious cybersecurity incidents took effect earlier, on September 11, 2026.
What do these changes mean for Tianjin-based robotics companies expanding into the European market? If they plan to participate in the 2027 HANNOVER MESSE, must they complete all certifications in advance?
REGULATORY UPDATE / 01
Two new EU regulations: what should robotics companies pay attention to?
“Machinery Regulation”: Addressing Safety Risks Posed by Digital Technologies
On January 20, 2027, the EU Machinery Regulation (EU) 2023/1230 will fully apply, replacing the current Machinery Directive 2006/42/EC. Building on traditional machinery safety requirements, the new regulations place greater emphasis on risks that software, connectivity features, and digital technologies may pose to machinery safety.
Companies specializing in industrial robots, collaborative robots, AGVs/AMRs, and smart manufacturing equipment should assess the safety requirements of mechanical motion, safety control systems, software integrity, remote control, and networked maintenance, taking into account the actual functions of their products.
The Cyber Resilience Act: Enhanced Product Cybersecurity Management Requirements
The CRA has introduced cybersecurity requirements for products containing digital elements, covering product design, development, vulnerability management, and security updates. Companies need to distinguish between reporting obligations that are already in effect and the main product requirements that will become fully applicable at the end of 2027.
Three Important Milestones
2026.09.11 The CRA reporting obligations for vulnerabilities and serious cybersecurity incidents come into effect 2027.01.20 The EU Machinery Regulation becomes fully applicable 2027.12.11 The CRA’s core product cybersecurity requirements become fully applicable
For vulnerabilities that have been actively exploited and for severe cybersecurity incidents that meet the reporting criteria, manufacturers are required to fulfill their reporting obligations as stipulated, including an initial alert within 24 hours, a follow-up notification within 72 hours, and the corresponding final report. Final reports for vulnerabilities that have been actively exploited are generally submitted within 14 days after corrective or mitigating measures become available; different deadlines apply to severe cybersecurity incidents.
HANNOVER MESSE / 02
Do I have to complete all certifications in advance to exhibit at HANNOVER MESSE 2027?
Key Takeaway | A showcase does not equate to official market launch
No. Simply participating in an exhibition does not mean that a product must have completed all EU market access procedures in advance; however, exhibits that are not compliant must meet the relevant exhibition exemption conditions.
Article 4(2) of the EU Machinery Regulation permits machinery that does not yet comply with the relevant requirements to be exhibited at trade fairs and similar events, provided that it is clearly marked as non‑compliant, that it may not be placed on the market until compliance is achieved, and that appropriate safety measures are taken during demonstrations. The CRA also has regulations pertaining to exhibition displays.
Accordingly, for robotic products intended solely for exhibition purposes and not formally made available or put into service in the EU market, companies may arrange to exhibit them in accordance with the applicable trade fair rules. Permitting display does not mean that the exhibition venue’s on-site safety management requirements can be ignored.
In particular, for dynamic exhibits such as heavy-load AGVs, industrial robotic arms, and collaborative robots, please confirm in advance with the exhibition organizer the requirements for equipment operation, isolation and protection measures, personnel safety, and technical documentation.
It should also be noted that even if no sales are made at this trade show, if the company already offers relevant products in the EU market, it must still comply with the CRA reporting obligations that may apply to existing products. Similarly, deliveries made after the show, free trials, or use of the products on the customer’s premises should each be assessed separately to determine whether they trigger market access obligations.
TIANJIN ROBOTICS / 03
Based on the characteristics of Tianjin’s robotics industry, which products should receive particular attention?
Tianjin’s robotics industry encompasses multiple segments, including robot manufacturing, core components, system integration, and application services. The degree of digitalization, operating environments, and security risks vary across different products, so compliance priorities also differ.
Heavy-duty AGVs and Mobile Robots
Focus on the risks that may arise from functions such as motion control, emergency stop, personnel protection, safety-related control systems, as well as remote diagnostics and networked maintenance.
Industrial Robots and Automation Equipment
In addition to mechanical and electrical safety, attention should also be paid to control software, system interfaces, communication functions, software updates, and the management of third-party software components.
Intelligent Inspection and Special-Purpose Robots
For products with functions such as environmental sensing, data collection, wireless communication, and remote control, risks related to identity authentication, access permissions, data communication, and system maintenance should be assessed in conjunction with their actual intended use.
Compliance assessments cannot be one-size-fits-all.
The applicable regulations, conformity assessment procedures, and technical documentation requirements vary among different robotic products; therefore, each case should be assessed individually in light of the product category, intended use, digital functions, and specific commercial arrangements.
PRACTICAL CHECKLIST / 04
From product showcasing to market delivery, prepare the following four items in advance.
01|Review of Applicable Laws and Regulations
Clarify the applicability of machinery safety, cybersecurity, and other specific EU regulations, and identify the tasks that must be completed before a product can be officially placed on the market.
02|Enhance Software Component Management
Gradually establish a software bill of materials (SBOM), inventory the operating system, control software, third-party components, and open-source software, and enhance vulnerability identification and traceability capabilities.
03|Establish a Cybersecurity Response Mechanism
Improve the processes for vulnerability discovery, risk assessment, technical remediation, and required external reporting, and clearly define internal responsibilities and response timeframes.
04|Prepare Technical Documentation and Conduct Safety Verification
In accordance with applicable requirements, refine risk assessment, test verification, software integrity protection, and technical documentation management to prepare for customer audits and subsequent market releases.
For prototype units intended solely for exhibition display, a phased approach can be adopted based on product maturity and actual market plans; it is not necessary to apply all the requirements of the full‑scale launch product directly to the demonstration phase.
GO GLOBAL / 05
Compliance capability is becoming part of international competitiveness.
From April 5 to 8, 2027, the HANNOVER MESSE industrial fair will be held in Germany. The Tianjin Robot Industry Association will continue to organize Tianjin-based robotics companies to participate in exhibitions, supporting them in showcasing their innovative achievements, connecting with overseas customers, and expanding international cooperation channels.
Hanover is not only a platform for showcasing technologies and products, but also an important window for understanding international market rules, observing industry trends, and building trust with overseas customers. Exhibiting at trade shows differs from officially entering the EU market, but companies seeking to convert exhibition opportunities into overseas orders should proactively familiarize themselves with regulatory changes and assess product compliance gaps.
The Tianjin Robot Industry Association will continue to monitor developments in EU regulations and standards related to robotics and intelligent equipment, strengthen information sharing and the alignment of professional resources in international markets, and provide support for companies seeking to expand into overseas markets.
Official EU Legal Reference
The following are official EU regulations and policy statements; readers may search for the original texts themselves:
↗EU Machinery Regulation (EU) 2023/1230
↗EU Cyber Resilience Act (EU) 2024/2847
↗CRA Vulnerability and Cybersecurity Incident Reporting Guidelines
Note: The specific compliance obligations shall be determined in accordance with the original text of EU regulations, the latest official interpretations, and the actual circumstances of the product.