FireSight OT · EU Machinery Regulation
Connected machines must not open a way in
From 20 January 2027, machinery placed on the EU market must meet the new Machinery Regulation (EU) 2023/1230. For the first time, its essential requirements cover protection against corruption, including through connected and remote devices. For machine builders who offer remote support, how that access works is now part of the machine's safety case.
Annex III
The requirements that touch remote access
Connections mustn't create hazards
The machine must be designed so that connecting another device to it, "via any feature of the connected device itself or via any remote device that communicates with the machinery", does not lead to a hazardous situation.
Evidence of interventions
The machine must collect evidence of a legitimate or illegitimate intervention in the hardware relevant for connection or access to safety-critical software, and in its software or configuration.
Malicious attempts
Control systems must withstand intended and unintended external influences, "including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation".
A tracing log
The tracing log of data generated in relation to an intervention, and of safety software versions uploaded after the machine is placed on the market, must be kept for five years.
Quoted and summarised from Annex III, sections 1.1.9 and 1.2.1, of Regulation (EU) 2023/1230. The regulation applies from 20 January 2027.
How FireSight OT helps
A remote-access path you can describe in your risk assessment
The Cloud Connector is the one way in to the machine network. It's designed so that the way in is narrow, deliberate and recorded.
- Nothing listens from outside. The Cloud Connector only dials out to the Hub; there's no inbound port on the machine or the plant network.
- Only the machines that are granted, and a site-side allowlist on the device that caps what the Hub may ever reach. The Hub can't widen it.
- Every connection is a person. No shared accounts. Vendors use two-factor sign-in, with working hours and an end date.
- Evidence of every intervention through it: who opened which machine, when and for how long, and every remote command, in the Hub's audit log.
- Mutual TLS with a certificate per device, and signed software updates the device checks before installing.
- Remote changes to the device's own network are off unless someone on site allows them, and roll back if the Hub is lost.
Also coming
The Cyber Resilience Act
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity rules for products with digital elements, which can include connected machines and their components.
- Since 11 September 2026: manufacturers must report actively exploited vulnerabilities and severe incidents.
- From 11 December 2027: the full requirements apply, including secure design, vulnerability handling and security updates.
- A remote-access path that's outbound only, per person and audited is far easier to describe and defend than a shared VPN account or a remote-desktop tool left running.
Being straight about it
What stays with the machine
Conformity with the Machinery Regulation is the machine builder's, assessed for the whole machine. FireSight OT secures and records the remote-access path; it doesn't make a machine conform on its own.
The machine still has to protect its own safety-related software and data, identify the safety software installed on it, and keep its own tracing log of interventions and software versions. FireSight OT's audit log records access through the Cloud Connector, which is useful evidence alongside it, not a replacement.
This page is general information, not legal advice. See also FireSight OT and NIS2, and our partner programme for machine builders.
Building machines for the EU market?
Talk to us about fitting a Cloud Connector, with its own device license, in every machine you ship.
