Planned standard for protection against corruption

In summer 2024, Technical Committee 44X (Safety of machinery and equipment: electrotechnical aspects) of CENELEC, the European Committee for Electrotechnical Standardisation, started work on a harmonised standard prEN 50742 (Safety of machinery - Protection against corruption) to cover the relevant sections 1.1.9. and 1.2.1. of Machinery Regulation 2023/1230.¹

This standardisation project is currently in the survey phase. The corresponding draft standard for public comment was published by Austrian Standards on 15 January 2026. Feedback on the document can be submitted via the national standardisation institutes until 15 February 2026.

According to the contents of the draft standardisation request to the European standardisation organisations from the EU Commission, harmonised standards to cover the requirements of the Machinery Regulation should be adopted by 20 January 2026 at the latest. 

According to the CEN/CENELEC project plan, the standard is expected to be published in March 2026 at the earliest. Ideally, it should then be included in the EU Official Journal in accordance with the Machinery Regulation before January 2027. However, as the draft standard was not published until early 2026, it is more likely to be published by the end of 2026.
 

Section 1.1.9. of Annex III to the new EU Machinery Regulation 2023/1230 defines requirements for protection against interference, or in the wording ‘corruption’ (Protection against corruption). The legislator requires that neither the connection of a device (meaning all interfaces and connections to other equipment) nor the connection to ‘remote devices’, i.e. via the Internet, may lead to dangerous situations. 

prEN 50742 specifies these requirements. Its aim is not to define general IT security, but to ensure that the control functions – in particular safety functions – of a machine cannot be compromised by external unauthorised interference. 

The publication of prEN 50742 creates, for the first time a normative framework for protecting machines against safety-related manipulation (corruption). The standard shows a way to meet the requirements of Annex III, points 1.1.9 ‘Protection against corruption’ and 1.2.1 ‘Safety and reliability of control systems’ of the Machinery Regulation (EU) 2023/1230. 

prEN 50742 addresses the question of how defeating software, data and interfaces can impair the effectiveness of protective measures. It becomes clear that the focus is not on new hazards, but on maintaining the effectiveness of already identified safety functions throughout the entire life cycle of the machine.
 

The standard generally applies to: 

• Machines, safety-related products and incomplete machines 
• Hardware, software and data, insofar as they affect safety 

It is also intended to cover all lifecycle steps, including development, manufacture, commissioning, operation, maintenance and decommissioning.

All interfaces are covered, including, for example: 

• Networks (fieldbus, Ethernet, WLAN) 
• Service and engineering interfaces (USB, SD cards) 
• Remote access and cloud connections 

The standard does not apply to machinery installed before the publication of EN 50742.
 

The basis for this is a dynamic risk assessment that accompanies the entire life cycle of the machine. This risk-based approach is implemented in a three-stage model. 

1. Identification of critical assets 

In this initial phase, the focus is on a holistic view of the machine control system in order to identify those components whose defeat would have a direct impact on functional safety. The analysis concentrates on safety-relevant software, communication between sensors and actuators, and all physical and digital interfaces, for example for remote maintenance or cloud connection. Only by defining the elements to be protected is it possible to develop a security strategy that is optimally tailored to a particular machine and thus effective. 

2. Threat analysis and assessment of the probability of corruption 

The second step, threat analysis, focuses on the interaction between potential vulnerabilities and active threat factors. In this phase, a systematic investigation is carried out to determine which vectors – such as physical interfaces or network access points – could be used to defeat the previously identified critical assets. The likelihood of a successful attack is determined by comparing the capabilities of potential attackers with the effort required to carry out a defeat. In this way, new threats and current attack methods can also be continuously incorporated into the assessment. 

3. Determination of the required security level (SL)

Finally, the findings from asset identification and threat analysis are brought together in the final risk assessment. In this phase, the decisive consideration is made between the severity of potential physical damage and the probability of successful digital defeating. 

The aim is to define an appropriate security level at which the robustness of the digital barriers increases in proportion to the hazard to people and the environment. This approach ensures that cyber resilience is in harmony with functional safety requirements. The result is a requirements profile that not only guides the technical design, but also provides the necessary documentation basis for proof of conformity within the framework of the EU Machinery Regulation. 

To this end, the standard works with the SRSL (Safety-Related Security Level) and defines its levels from SRSL0 (low security, for completely isolated networks) to SRSL3 (significant or critical attack potential, i.e. a highly probable or almost guaranteed attack).