Machinery Risk Assessment for CE Marking: From EN ISO 12100 to Performance Level
If you manufacture machinery and want to sell it in Europe, the risk assessment sits at the center of your entire CE marking process. Every other document in your technical file traces back to it. This post explains what that process involves, what it produces, and what your team needs to provide to make it work.
The machinery risk assessment differs from what other EU directives require. Under the Low Voltage Directive or the Radio Equipment Directive, demonstrating compliance with harmonized standards generally covers the essential requirements. Under theEU Machinery Regulation, EN ISO 12100 defines a structured engineering process that must be executed, documented, and justified at every step. When safety functions are involved, that process extends further into Performance Level determination and functional safety calculations.
If Your Engineers Already Work to ANSI B11.0
American manufacturers often assume EU compliance means starting from scratch. In practice, the methodology your engineers already use maps closely to what EN ISO 12100 requires.
ANSI B11.0 and EN ISO 12100 share the same core logic: define the limits of the machine, identify hazards across its lifecycle, and reduce risk through a structured hierarchy of measures. A machine designed to ANSI B11.0 already satisfies most of what EN ISO 12100 demands in terms of risk assessment methodology.
The differences are real but specific. EN ISO 12100 applies exclusively during the design phase and addresses only the machinery manufacturer: the responsibility for the risk assessment sits entirely with the company placing the product on the EU market. ANSI B11.0 also covers the end user’s obligations once the machine is in operation. That layer does not exist in the CE marking framework.
The more significant gap is the Performance Level layer.
When a machine includes safety functions,EU compliance requires determining the required Performance Level (PLr) for each one and verifying that the designed system achieves it. That requirement has no direct equivalent in the ANSI framework, and it has concrete consequences for component selection, control architecture, and documentation.
What EN ISO 12100 Actually Requires
The standard structures the risk assessment around three sequential steps.
The first step defines the LIMITS of the machine across its entire lifecycle: intended use, foreseeable misuse, the people who will interact with it, the environments where it will operate, and the phases it will go through from installation to decommissioning. A machine used in a food processing facility in Texas and the same model exported to a manufacturing plant in Germany may have different limit definitions if their operating environments and user profiles differ.
The second step identifies and analyzes all HAZARDS associated with the machine across those defined limits. Mechanical hazards, electrical hazards, thermal hazards, noise, vibration, hazardous materials: each one gets documented with its associated hazardous situation and the potential harm it could cause.
The third step applies RISK REDUCTION according to a fixed hierarchy. Design changes come first: if a hazard can be eliminated through geometry, material selection, or mechanical arrangement, that takes priority over any protective measure. Guards and protective devices come second. Information to the user, including warnings and instructions, comes last. The standard treats residual risk communicated through warnings as the least effective form of risk reduction, not a substitute for design solutions.
How Risk Gets Reduced in Practice
The risk assessment document records the estimated risk level for each identified hazard before any measures are applied. That initial estimate combines three factors: the severity of potential harm, the frequency and duration of exposure, and the possibility of avoiding the hazard if it occurs. The combination produces a risk level that determines how much reduction is needed.
From that starting point, the process runs iteratively. The engineering team proposes a risk reduction measure, the document records it, and the residual risk gets re-estimated with the measure in place.
If the residual risk still sits above acceptable levels, another measure gets added and the cycle repeats. Each iteration updates the document.
The final risk assessment captures the complete history of that process:every hazard, the initial risk estimate, every measure applied, and the residual risk after each one. A reviewer reading the document should be able to follow every design decision and understand why each measure was chosen. That traceability is what makes the document defensible in a market surveillance inspection or a post-accident investigation.
A risk assessment that lists hazards without documenting the reduction measures and their effect on residual risk does not satisfy EN ISO 12100. The iterative process and its output are the substance of the document.
When the Performance Level Enters the Picture
Not every machine triggers the Performance Level requirement. Machines without safety functions in their control systems, or with only basic electrical safety measures, complete the process at the EN ISO 12100 stage.
When a machine includes safety functions, the analysis goes further. A safety function is any function whose failure could lead directly to an increase in risk: an emergency stop, an access guard interlock, a presence-detection system, a two-hand control. For each one, the risk assessment must determine the required Performance Level, expressed as PLr on a scale from a to e.
The PLr for a given safety function depends on the same three parameters used in the general risk estimation: severity of harm if the safety function fails, frequency of exposure to the hazard it controls, and the possibility of avoiding that harm. The same emergency stop circuit may require PLc on a packaging line and PLe on a press where a single failure could cause a fatal injury. The standard does not assign PLr values: the risk assessment determines them, function by function, based on the specific machine and its hazard profile.
That determination has direct consequences for the design. The PLr defines the reliability requirements for the safety-related parts of the control system. It influences which components get specified, how they get connected, whether redundancy is required, and how the system must respond to internal faults.
How the Performance Level Gets Calculated and Documented
Once the PLr is defined for each safety function, the engineering team designs the safety-related control architecture and calculates whether it achieves the required level. That calculation follows EN ISO 13849-1 and accounts for the structural category of the circuit, the mean time to dangerous failure of the components, the diagnostic coverage, and the common-cause failure resistance of the system.
SISTEMA, the software tool developed by the IFA (the German Institute for Occupational Safety and Health), automates that calculation and produces a structured report. The engineer inputs the architecture, the component reliability data, and the diagnostic parameters, and SISTEMA outputs the achieved PL for each safety function. If the achieved PL falls below the PLr, the design needs revision. SISTEMA is widely used because it directly implements EN ISO 13849-1 and produces documentation that notified bodies and market surveillance authorities recognize.
Other commercial tools exist and perform equivalent calculations, and some engineering teams handle straightforward architectures through well-structured spreadsheets. What matters for the technical file is that the calculation method is traceable, the inputs are documented, and the result is verifiable.
For machines with complex programmable safety systems, PLC-based safety controllers, or safety functions implemented in software, EN IEC 62061 offers an equivalent route based on Safety Integrity Levels (SIL) rather than Performance Levels. The underlying logic is the same: determine the required integrity level from the risk assessment, design the system to meet it, and document the calculation. This post focuses on the ISO 13849 / PL / SISTEMA path because it covers the majority of conventional industrial machinery.
The calculation report, whether produced by SISTEMA or another tool, becomes part of the CE marking technical file along with the full EN ISO 12100 risk assessment.
What the Process Produces and How Long It Takes
The complete documentation package includes:
the EN ISO 12100 risk assessment with all hazards, initial risk estimates, mitigation measures, and residual risk levels;
the PLr determination for each safety function;
the PL calculation with the supporting architecture documentation;
and the component data sheets for every safety-related part of the control system.
For a machine of average complexity, the full process runs four to eight weeks. The variable is almost always documentation availability on the manufacturer’s side. A project where the engineering team can provide complete drawings, component specifications, and a clear description of intended use on day one moves significantly faster than one where that information arrives incrementally.
The risk assessment process depends entirely on information the manufacturer supplies. The consultant or safety engineer working on the document needs machine drawings sufficient to understand the geometry and all hazardous zones, technical specifications for the safety-related components already selected or under consideration, a clear description of intended use and reasonably foreseeable misuse, and a description of the operating environment including who will operate and maintain the machine.
The completeness of that package at the start of the engagement determines the timeline more than any other single factor.
Ready to Start Your Machinery Risk Assessment?
The risk assessment is the first phase of the CE marking process for machinery, and the quality of that document shapes everything that follows. If you’re preparing to enter the EU market and want to understand the scope and timeline for your specific machine, request a quoteand we’ll map out the process based on your product.
