The upcoming Machinery Regulation comes into force in January next year, followed by the Cyber Resilience Act in December 2027. Many OEMs will find themselves having to upgrade the PLCs in their machines, and this creates additional challenges. ABB’s Carl Eely explains how to prepare PLC systems for the new regulatory requirements with minimum disruption.

Much of the discussion around the new Machinery Regulation (EU 2023/1230) has centred around cybersecurity. Many OEMs – and particularly those that use PLCs in their equipment – might be looking at the requirements and wondering where to start. Companies may lack in-house cybersecurity expertise, while the additional administrative work of creating paper trails and establishing record-keeping processes can feel like a burden for already-stretched engineering teams.

Compliance is therefore an important consideration for OEMs. Equipment that does not meet the new requirements cannot achieve a CE mark and may not be sold in the European market. OEMs ought to consider whether hardware selected and ordered today will support future compliance requirements once the regulation comes into force.

Compounding matters further is the fact that smaller companies may lack the resources to dedicate to redesigning or modifying their machines. As the deadline for compliance approaches, OEMs might find themselves competing for resources and expertise. Taking action now is the best way to ensure a smooth transition and avoid a late rush to comply with the legislation.

Why PLCs are different

Unlike other devices like drives, which can be swapped in and out with relative ease, PLCs are essentially the “brains” of a machine. Changing the PLC may therefore mean reconsidering the whole control architecture. As such, it is not only PLC devices that need to be upgraded, but programs too. PLC upgrades require planning and engineering time, which means OEMs need to consider migration as part of their wider product development strategy rather than as a last-minute rush to achieve compliance.

To meet the requirements of the regulation, OEMs must also provide evidence that their products have been developed and assessed against modern cybersecurity standards. ABB, along with other automation vendors, is working to help make the transition towards compliance as straightforward as possible. The latest generations of PLC technology were developed with cybersecurity requirements in mind, helping OEMs to navigate the new regulation with confidence.

For existing AC500 users, ABB has established a clear migration path to the latest generation of the platform. OEMs using the V1 or V2 platform should start planning their migration to the latest V3 platform. To simplify this process, ABB has published a “Converting an AC500 V2 Project to an AC500 V3 Project” guide to help engineers understand the steps involved and minimise disruption.

The process of migrating is relatively straightforward. The main differences from V2 to V3 concern the hardware, e.g. different interfaces, different memory layouts, different handling of addresses – generally minor changes. For most customers, only the CPU and base will need to be changed, as everything else is backwards compatible and can operate within the exact same footprint as before with the same I/O cards.

No need for a complete redesign

Responsibility for addressing and mitigating cybersecurity risks now lies firmly with the machine builder. OEMs must demonstrate that cybersecurity risks have been identified, assessed, and mitigated. While this might sound challenging, it doesn’t necessarily require wholesale changes. Indeed, machines designed with modern cybersecurity principles in mind may already satisfy many compliance requirements.

In practice, the goal should be to understand where the risks are within the control system, how they are mitigated, and ensure a proper paper trail to provide evidence of the decision-making process, even if no direct mitigation action was required. Ultimately, it is not about mitigating every possible threat, but about showing that cybersecurity has been considered as part of the design and lifecycle of the machine.

Using the regulation as an opportunity

Beyond compliance, the regulation is also an opportunity to modernise control systems and take advantage of new technologies and capabilities to enhance their products. Modern PLC platforms offer far greater processing power, improved communication capabilities, and greater integration with digital systems, including cloud-based platforms. OEMs can move beyond purely functional machine control towards more connected, data-driven machines that are easier to monitor, maintain, and optimise.

The result is not only improved cybersecurity readiness, but also potentially enhanced machine performance, along with better reliability, productivity and serviceability. In essence, compliance can become the springboard for building better machines.