Substantial modification is one of the most common concepts in EU product compliance. It describes what happens when a product that already carries CE marking is changed after it has been sold or put into service, whether through a new component, a retrofit or a software update.
Most changes leave the original CE marking intact. Some go further, and the law then treats the modified product as a new one, with a new manufacturer responsible for it.
This article explains where that line sits under the general CE marking rules, under the new Machinery Regulation, which defines the term in binding law from January 20, 2027, and under the Cyber Resilience Act.
What substantial modification means across all CE marking legislation
The concept applies to every product that carries CE marking, from electrical equipment under the Low Voltage Directive to radio devices and toys. Its general description comes from the European Commission’s Blue Guide, the reference document on how EU product legislation works.
According to the Blue Guide (2022 edition, section 2.1), a product that has gone through important changes after being put into service must be treated as a new product when three things happen TOGETHER:
Its “original performance, purpose or type is modified, without this being foreseen in the initial risk assessment”.
“The nature of the hazard has changed or the level of risk has increased”.
The modified product is made available on the market, or put into service where the legislation covers that.
When those conditions are met, the person who made the changes becomes the manufacturer.
The modified product then has to go through the conformity assessment again, as if it were new.
The Blue Guide is guidance. It explains how the Commission reads the law, and courts and market surveillance authorities follow it closely, but it carries no legal force of its own. For most product types, that’s still the only definition available.
How the new Machinery Regulation defines substantial modification
Regulation (EU) 2023/1230, the new Machinery Regulation, gives machinery the first legal definition of substantial modification in EU product legislation. It applies from January 20, 2027.
Under the new rules, a change to a machine is a substantial modification:
when the original manufacturer didn’t foresee it,
when it creates a new hazard or increases an existing risk,
and when the fix requires either new protective devices that involve modifying the safety control system or extra measures for stability or mechanical strength.
The definition builds on what came before. Under the Machinery Directive 2006/42/EC, each EU country interpreted substantial modification in its own way, and the most influential reading came from Germany, where the Federal Ministry of Labour and Social Affairs (BMAS) published an interpretation paper in 2015.
The BMAS test asked whether simple safeguards, such as fixed guards or interlocked movable guards, could bring the new risk back to an acceptable level. If they could, the change wasn’t substantial. The Regulation takes that same logic and writes it into binding law.
The legal definition, word for word
Here is the definition exactly as it appears in Article 3(16) of the Machinery Regulation:
‘substantial modification’ means a modification of machinery or a related product, by physical or digital means after that machinery or related product has been placed on the market or put into service, which is not foreseen or planned by the manufacturer, and which affects the safety of that machinery or related product, by creating a new hazard, or by increasing an existing risk, which requires:
(a) the addition of guards or protective devices to that machinery or related product the processing of which necessitates the modification of the existing safety control system; or
(b) the adoption of additional protective measures to ensure the stability or mechanical strength of that machinery or related product;
Source: Regulation (EU) 2023/1230, Article 3(16).
The four conditions in plain English
A change to a machine counts as a substantial modification only when all four of these conditions apply:
It happens after the machine was placed on the market or put into service. Design changes before the first sale are part of the original conformity assessment.
The original manufacturer didn’t foresee or plan it. Changes the manufacturer anticipated, for example in the instructions, fall outside the definition.
It affects safety by creating a new hazard or increasing an existing risk. A change with no safety impact can’t be substantial, however large it is.
The resulting risk calls for one of two specific fixes. Either new guards or protective devices that can only work if the existing safety control system is modified, or extra measures to keep the machine stable or mechanically strong.
If one condition is missing, the change isn’t a substantial modification.
The words “by physical or digital means” matter too. A software update can be a substantial modification in exactly the same way as a new mechanical part.
Compared with the Blue Guide, the fourth condition is what’s new. A change can create a new hazard and still stay outside the definition, as long as the fix doesn’t require touching the safety control system or reinforcing the structure.
What doesn’t count as a substantial modification
Several kinds of change stay outside the definition:
Repair and maintenance that doesn’t affect the machine’s compliance. Recital 26 of the Regulation says so explicitly.
Like-for-like replacements, such as a worn part swapped for an identical one.
Changes with no effect on safety, like a new paint finish or an upgraded HMI screen that doesn’t touch any safety function.
New risks solved with simple safeguards. If a fixed guard or an enclosure brings the risk down and the safety control system stays as it is, the fourth condition isn’t met.
Changes the manufacturer foresaw and documented, within the limits the manufacturer set.
The fourth point is the one most guides miss. A modification can make a machine more dangerous and still not be substantial, because the definition looks at what the fix requires, not at the size of the change.
Does your retrofit cross the line? Six common cases
Every case depends on the machinery risk assessmentfor the specific machine. The table shows how the four conditions usually play out.
Change
Substantial?
Why
Adding a cobot to an existing production line
Likely yes
The robot brings new hazards, and protecting against them usually means connecting new protective devices to the line’s safety control system
Increasing the speed or output of a press
Depends
It raises an existing risk. It becomes substantial if the guarding has to be redesigned around the safety control system or the frame needs reinforcing
Replacing safety relays with a safety PLC that performs the same functions
Likely no
No new hazard and no higher risk. The new safety functions still need validating
Software update that changes how a safety function behaves
Depends
It counts when the update creates a new hazard or raises a risk that then requires new protective devices tied into the safety control system
Adding a fixed guard to cover a hazard the change created
No
A simple safeguard solves the risk without modifying the safety control system
Replacing a worn motor with an identical one
No
Like-for-like replacement, no change to the risk
Who becomes the manufacturer after a substantial modification?
The person or company that carries out the substantial modification becomes the manufacturer, and only for the machine the change affected, as shown in the risk assessment. That second part is what keeps a single retrofit from turning an entire production line into a new product.
Article 18 of the Machinery Regulation sets this out. Here is its full text:
A natural or legal person that carries out a substantial modification of machinery or a related product shall be considered to be a manufacturer for the purposes of this Regulation and shall be subject to the obligations of the manufacturer set out in Article 10 for that machinery or related product or, if the substantial modification has an impact on the safety of only machinery or a related product that is part of an assembly of machinery, for that affected machinery or related product, as demonstrated in the risk assessment.
The person who carries out the substantial modification shall in particular, but without prejudice to other obligations set out in Article 10, ensure and declare on its sole responsibility that the machinery or related product concerned is in conformity with the applicable requirements of this Regulation and shall apply the relevant conformity assessment procedure as provided in Article 25 (2), (3) and (4) of this Regulation.
A non-professional user who carries out a substantial modification to his or her machinery or related product, for his or her own use, shall not be considered to be a manufacturer for the purposes of this Regulation and shall not be subject to the obligations on the manufacturer set out in Article 10.
Source: Regulation (EU) 2023/1230, Article 18.
In practice, the new manufacturer takes on the full list of obligations in Article 10. That means a new risk assessment, an updated technical file, the conformity assessment procedure, a new EU Declaration of Conformity, the CE marking and updated instructions.
If the machine falls into one of the high-risk categories in Annex I of the Regulation, the conformity assessment can require a Notified Body, exactly as it would for a brand-new machine.
The assembly rule in the first paragraph of Article 18 is the part with the biggest practical impact. When a modification affects the safety of only one machine in a line, the obligations apply to that machine. The risk assessment has to show it, so that document becomes the evidence that limits your exposure.
The exception in the third paragraph covers private individuals modifying their own equipment for personal use. It doesn’t apply to companies.
Who usually ends up as the new manufacturer
Three profiles come up again and again.
The first is the end user, typically a plant that upgrades its own equipment to increase output or add automation. The plant becomes the manufacturer of the modified machine, even though it never planned to manufacture anything.
The second is the system integrator who carries out the retrofit for a customer. The law points at whoever carries out the modification, so when an integrator does the work for a plant owner, the contract should state which of the two signs the new Declaration of Conformity.
The third is the used machinery dealer who rebuilds machines before reselling them. If the rebuild goes beyond repair and crosses the four conditions, the dealer places a new product on the market. That makes the dealer the manufacturer, with the concept of placing on the market applying from the date of resale.
How to keep planned changes from becoming a substantial modification
The key phrase in Article 3(16) is “not foreseen or planned by the manufacturer”. Modifications the original manufacturer anticipated don’t meet the definition.
That gives buyers a practical lever. When you purchase a machine you expect to upgrade later, ask the manufacturer to describe in the instructions which modifications are foreseen and within which limits. Later changes inside those limits stay outside the definition.
For manufacturers, the same logic works in reverse. Documenting foreseen upgrades, such as optional modules, speed ranges or approved add-ons, protects your customers from becoming manufacturers by accident.
The other habit worth building is timing. Run the risk assessment before the change, while the design can still be adjusted to avoid touching the safety control system.
Substantial modification under the Cyber Resilience Act
The Cyber Resilience Act has its own definition, built around cybersecurity rather than physical safety. Under Article 3(30), a substantial modification is a change to a product with digital elements after it has been placed on the market that affects its compliance with the essential cybersecurity requirements in Annex I, Part I, or that changes the intended purpose the product was assessed for.
The test is different from the machinery one. A software update doesn’t become a substantial modification just because it changes code. It has to affect compliance with the cybersecurity requirements or change what the product is meant to do.
The consequence is the same, though. Under Article 22, a person other than the manufacturer, importer or distributor who carries out a substantial modification and makes the product available on the market is considered its manufacturer.
The CRA’s main obligations apply from December 11, 2027. Connected machines will fall under both definitions, which is one of the overlaps covered in our guide to the Machinery Regulation and the Cyber Resilience Act.
A substantial modification is one of the few events that can turn a buyer into a manufacturer overnight. It’s also one of the changes that can break a CE marking long after the product was sold, alongside the others covered in does CE marking expire.
For machinery, two questions settle most cases before any work starts. Does the change create a new hazard or raise an existing risk? If it does, can you solve it without touching the safety control system or reinforcing the structure?
If you’re planning a retrofit or an upgrade and aren’t sure which side of the line it falls on, we can review the change against the four conditions before you commit. Get a quote and tell us what you’re planning.
