New rules for machinery, products and exports
The Machinery Regulation applies from 20 January 2027, the Cyber Resilience Act's reporting duties have applied since 11 September 2026 and export control lists change regularly. COBACK reads the new publications every day and shows which of them could affect your products, plants and export markets, and why.
Topics and rules
What is changing, who in the company works with it and which legal acts are behind it.
Machinery and product safety
The Machinery Regulation replaces the Machinery Directive on 20 January 2027. It sets new requirements for safety functions with self-learning software and for protection against tampering through connected devices. Instructions may be supplied in digital form; if the buyer asks for a paper copy at the time of purchase, the manufacturer provides it free of charge. Consumer products have been covered by the General Product Safety Regulation since 13 December 2024. Design, product safety and technical documentation are affected.
Examples
- Machinery Regulation (EU) 2023/1230
- General Product Safety Regulation (EU) 2023/988
- Low Voltage Directive 2014/35/EU
- German Product Safety Act (ProdSG)
Cyber security of products and operations
Since 11 September 2026 manufacturers of products with digital elements have had to report actively exploited vulnerabilities and severe security incidents through ENISA's single reporting platform, including for products already on the market. The remaining manufacturer duties under the Cyber Resilience Act apply from 11 December 2027. For their own operations, the German NIS 2 implementation act requires medium-sized and large machinery manufacturers to register with the BSI, put risk management in place and report significant incidents. Product development, IT security and management are affected.
Examples
- Cyber Resilience Act (EU) 2024/2847
- NIS 2 Directive (EU) 2022/2555
- German NIS 2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG)
Software, AI and data in machines
Connected machines placed on the EU market from 12 September 2026 must be designed so that users can access the product data. Since an amendment of the AI Act in July 2026, the requirements for high-risk AI in machinery are to sit in the Machinery Regulation itself. The Commission adds them there by a delegated act that has to apply by 2 August 2028. Software development, service and contract drafting are affected.
Examples
- Data Act (EU) 2023/2854
- AI Act (EU) 2024/1689
- Amending Regulation (EU) 2026/1744 to the AI Act
Export control and sanctions
The EU list of dual-use items is updated regularly. The version in force since November 2025 added, among other things, equipment for metal 3D printing and for semiconductor manufacturing. On top come the Russia sanctions, the US export rules for items of US origin or with US content and, since April 2025, China's export controls on certain rare earths and the magnets made from them. Export control, sales and procurement are affected.
Examples
- Dual-Use Regulation (EU) 2021/821
- Russia sanctions Regulation (EU) No 833/2014
- German Foreign Trade and Payments Ordinance (AWV)
- Export Administration Regulations (EAR), 15 CFR parts 730 to 774
Product liability
The new Product Liability Directive has to be transposed into national law by 9 December 2026 and applies to products placed on the market after that date. It expressly covers software and updates and makes it easier for injured parties to prove a defect. In Germany a new Product Liability Act is to replace the current one. Legal, quality and software development are affected.
Examples
- Product Liability Directive (EU) 2024/2853
- German Product Liability Act (ProdHaftG)
Ecodesign and carbon border adjustment
The Ecodesign for Sustainable Products Regulation sets requirements for individual product groups through delegated acts, for example on durability, reparability and a digital product passport. The definitive phase of the carbon border adjustment mechanism has run since 1 January 2026: anyone importing more than 50 tonnes a year of CBAM goods such as steel or aluminium needs authorised CBAM declarant status. Product management, procurement and customs are affected.
Examples
- Ecodesign for Sustainable Products Regulation (EU) 2024/1781
- CBAM Regulation (EU) 2023/956
- CBAM simplification Regulation (EU) 2025/2083
The path of a change
Example: a new entry in the dual-use list
01Law database
An update of Annex I to the Dual-Use Regulation appears in the Official Journal of the EU, with a new entry for certain metal 3D printers. COBACK reads it together with the day's other publications.
02Relevance
The check against the digital twin gives a relevance score of 82. The reasoning names your range of laser melting systems, your sales company in India and the passage of the regulation it relies on.
03Open questions
What is open is whether the systems reach the technical values of the new entry. COBACK asks that question and engineering confirms it. The export control officer then marks the change as relevant.
04Task
This creates tasks with steps, owners and deadlines: export control reclassifies the range in the ERP system by 16 October 2026 and applies to BAFA for the licences needed, and sales reviews open orders for customers outside the EU.
Working with COBACK
New rules in one place
Every day COBACK reads official journals, authorities, parliaments, sanctions lists and specialist media, for example EUR-Lex, BAFA and the US Office of Foreign Assets Control (OFAC). Everything new ends up in one place.
Assessments for products and sites
Each relevance score from 0 to 100 comes with its reasoning, the sources and the facts from the twin it relies on, such as product ranges, plants, sales companies and export markets. Where a fact is missing, COBACK asks instead of guessing.
Decision and tasks
A person on your side decides whether a change is relevant. It then becomes tasks with steps, owners and deadlines for engineering, export control or sales.
Optional module for substances in products
Manufacturers can add the product compliance module. It checks bills of materials against the REACH Candidate List, Annex XVII to REACH, RoHS and PFAS lists, shows data gaps and produces reports.
Frequently asked questions
Does COBACK cover export control and sanctions?
Yes. COBACK reads new sanctions packages, amended control lists and notices from the authorities and checks them against your products, group companies and markets. Whether a licence is needed is for your specialists to decide. COBACK does not give legal advice.
How does COBACK handle several plants and sales companies?
The digital twin knows your group companies and sites, partly from public registers such as GLEIF. The reasoning behind an assessment therefore names the company or plant that could be affected.
Do we have to upload documents?
No. COBACK fills the twin from connected systems such as SharePoint, Google Drive, Confluence or Slack, from public registers, from your website and from a questionnaire.
Is the product compliance module required?
No, it is optional. Monitoring new rules works without it.
