Starting January 20, 2027, a new rule takes effect across the EU: anyone placing a machine with digital elements on the market must demonstrate that its safety functions cannot be compromised by unauthorized digital access. That may sound like a problem for plant builders and PLC manufacturers - but it applies just as squarely to connected torque tools whose torque and angle parameters are transmitted directly over the production network.
This article explains what the regulation specifically requires, why data integrity in torque tools is not an IT question but a safety and liability question - and which protection principles actually work in practice.
What the Machinery Regulation (EU) 2023/1230 genuinely changes
EU Machinery Regulation 2023/1230 replaces the previous Machinery Directive 2006/42/EC starting January 20, 2027, and introduces cybersecurity as an Essential Requirement for the first time. That is no small thing: the Machinery Directive 2006/42/EC shaped European mechanical engineering for more than fifteen years - while leaving cybersecurity entirely out of scope.
The new EU Machinery Regulation 2023/1230, which will fully supersede the old directive in all EU member states as of January 20, 2027, links cybersecurity and occupational safety in detail for the first time. The decisive passage appears in Annex III, Section 1.1.9: the Machinery Regulation explicitly obligates manufacturers, for the first time, to protect safety-relevant software and data against unintentional or deliberate corruption.
From 2027 onward, it will no longer be sufficient for a machine to be "mechanically safe." Under the EU Machinery Regulation, cybersecurity becomes an integral part of machine safety: networked controls, remote access, software updates, and data flows are officially part of the assessment. For machine builders and manufacturing companies, this means that network-based attacks, faulty updates, or manipulated settings will be treated with the same legal seriousness as defective emergency-stop buttons or missing safety guards.
Particularly significant: the Machinery Regulation explicitly extends the concept of a safety component to digital components, including software. Software that performs a safety function and is placed on the market separately qualifies as a safety component and is therefore subject to all applicable conformity obligations - from the risk assessment through the technical documentation to the CE marking.
Hard deadline — no transition period: From January 20, 2027, all machinery and safety components placed on the market for the first time must comply with the requirements of the new regulation — including the cybersecurity requirements in Annex III, Section 1.1.9. Products shipped before that date may still be conformity-assessed under the old Directive 2006/42/EC.
Why torque tools are affected
A hand-held mechanical torque wrench with no electronics does not fall under the new cybersecurity requirements. A connected electronic torque tool that transmits torque and angle values via Wi-Fi to an MES, receives parameters via remote access, and communicates with a PLC over Open Protocol most certainly does.
The definition of "digital elements" is intentionally broad: it covers any software running on the machine or required for machine operation, as well as any network or communication interface. In practice, this means that virtually every modern machine falls under the cybersecurity requirements.
As soon as a PLC, a variable-frequency drive with a network interface, or an HMI panel is installed, the new requirements apply. For connected torque tools with Wi-Fi data transmission and PLC integration, the classification is therefore unambiguous.
The real risk: manipulated parameters, not just stolen data
IT security discussions tend to focus on data loss. For safety-critical bolted joints, the risk of manipulation is more dangerous than the risk of data loss.
Consider this scenario: an attacker - or even an unintentional configuration error through an unsecured interface - shifts a tool's target torque by 15%. The tool continues to operate, the joint is documented, and the process is marked complete. The bolted connection, however, is either under-torqued (risk of loosening) or over-torqued (risk of fracture). The documentation formally exists - but it records a defective condition.
New and more stringent product liability provisions will continue to raise the bar for manufacturing quality documentation. The automotive industry in particular has taken a leading role here, compelling suppliers to adopt equivalent measures.
Manipulated measurement data is doubly problematic: it does not document the actual joint quality but a falsified state. In the event of a claim - such as a recall or a product liability case - documentation whose integrity cannot be verified is worthless. Safety-critical software and data must be protected against unintentional or deliberate manipulation in order to prevent malfunctions.
Attack surfaces of connected torque tools
Connected torque tools are typically integrated via three communication paths. Each one carries specific vulnerabilities.
| Kommunikationskanal | Funktion | Typisches Risiko | Schutzmaßnahme |
|---|---|---|---|
| WLAN | Echtzeit-Datenübertragung Messwerte → MES/QS-System | Unverschlüsselte Übertragung, Rogue Access Points, Man-in-the-Middle | WPA3-Verschlüsselung, dediziertes OT-WLAN-Segment, Zertifikatsauthentifizierung |
| Open Protocol / SPS | Parametrierung, Jobsteuerung, Poka-Yoke-Integration | Unbefugte Parameteränderung über Netzwerkzugang zur Steuerung | Rollenbasierte Zugriffssteuerung, Protokollierung aller Parameteränderungen, Netzwerksegmentierung |
| MES/ERP-Anbindung | Auftragssteuerung, Archivierung, Rückverfolgbarkeit | Manipulation archivierter Messdaten, ungesicherte API-Endpunkte | Signierte Datensätze, Audit-Trail, Zugriffsprotokollierung |
Wi-Fi data transmission is the most direct route for measurement data from the tool to the system. Every digital interface on the machine - Ethernet, USB, fieldbus, wireless connections - must be protected against manipulation. A dedicated OT Wi-Fi segment, isolated from the office network and from the internet, is the baseline requirement here.
PLC communication and Open Protocol enable direct integration of the tool into the production line - including job control and poka-yoke functions. If an attacker gains access to the machine controller via a network connection or a maintenance interface, they must not be able to manipulate or disable safety functions. This applies equally to torque parameters set through that interface.
MES/ERP integration is the interface to higher-level quality documentation. Attackers can sabotage production processes, resulting in defective products or production downtime. Even more critical: if archived measurement data is altered after the fact, the entire traceability chain is compromised.
Particularly problematic are legacy systems, unsecured remote access, and missing network segmentation. These three factors remain a reality in many production environments today.
Five protection principles for practice
The Machinery Regulation does not specify particular technologies - it requires proportionate measures based on a risk assessment. Manufacturers must identify and evaluate cyber risks on their machines and systems before placing them on the market, and must implement the necessary protective measures. For operators of connected torque tools, five operational principles can be derived from this.
Measured values (torque, rotation angle, tightening-case ID) must be immutable and traceable from the tool all the way to the archive. Cryptographic signatures or hash values at the record level provide proof that an archived value matches the actual measurement result. Only then does the documentation hold up in the event of a liability claim.
Who is allowed to change tool parameters? Who may create or delete jobs? Role-based access control (RBAC) with individual user accounts — no shared passwords — is the minimum requirement. Parameter changes must be logged with a timestamp, user ID, and before/after values.
Firmware and software updates are a critical attack vector. Updates should only be applied via signed packages from verified sources. Configuration changes — especially torque setpoints and tolerance windows — belong in a controlled change process with an approval workflow.
Torque tools and their controllers belong in a dedicated OT network segment, separated from the office network and the internet. VLANs are the proven approach. Data exchange with MES/ERP systems takes place through defined, monitored transition points — not through open network shares.
All security-relevant events — logins, parameter changes, connection attempts, error messages — must be logged and retained for a defined period. The Machinery Regulation explicitly requires evidence of both legitimate and illegitimate access to machine software.
Open interfaces and data ownership: not a contradiction
A common misconception: security requires closed systems. The opposite is true - closed black boxes impede verifiability and make independent security audits impossible.
The OPERATOR® EST01 with PLC communication and Open Protocol is an example of the right approach: open, standardized interfaces that can be monitored and audited. Open Protocol enables direct integration into MES systems and PLC controllers - and with it, complete logging of all parameter changes and tightening results at the system level.
The compatibility of the QUANTEC MCS® analysis tool with QuanLabPro, Ceus, and QS-Torque follows the same principle: the user retains data ownership. Measurement data is not stored in proprietary silos but in systems that the operator controls and can secure independently. This is not a convenience feature - it is a prerequisite for verifiable data integrity.
Data sovereignty as a security principle: When measurement data resides exclusively in the tool manufacturer's cloud, the operator cannot independently verify its integrity. Open interfaces to your own QA systems (QuanLabPro, Ceus, QS-Torque), on the other hand, enable your own backup, signature, and audit processes — and thus the ability to prove unaltered documentation in the event of a liability claim.
Compliance check: where does your tool infrastructure stand?
Use this interactive tool to quickly assess which areas of your connected torque tool infrastructure still require action - and which measures should take priority.
What this means for manufacturers and operators
The Machinery Regulation is directed primarily at manufacturers - but operators are not off the hook. If distributors, importers, or machine operators make changes that may affect safety, they are treated as manufacturers with all associated obligations.
This has a direct consequence: anyone who changes tool parameters through an unsecured interface - and thereby potentially affects the safety function of the tool - can assume manufacturer liability. A substantial modification occurs when a machine or associated product is physically or digitally altered after being placed on the market in a way that creates a new hazard or increases an existing risk.
For quality assurance, this means: the integrity of tightening documentation is not merely a QA matter - it is a liability matter. Particularly new is Annex III, Item 1.1.9, "Protection against corruption." Its purpose is to ensure that tampering with machines - whether unintentional or deliberate - does not lead to dangerous situations. The focus is on safety-relevant hardware, software, and data, as well as interfaces and remote access that can affect safe operation.
According to a 2025 Munich Re study, companies without a documented OT-ISMS pay up to 40 percent higher cyber insurance premiums. The business case is clear: investing now saves money later - both in insurance costs and in potential liability exposure.
Conclusion: Security-by-Design starts at the tool
EU Machinery Regulation 2023/1230 is not an abstract regulatory exercise. It draws a direct line from cybersecurity to physical safety - and therefore to liability. For connected torque tools, this means: the integrity of torque and angle data is just as safety-critical as the mechanical precision of the tool itself.
The good news: organizations that rely on open, documented interfaces - rather than proprietary black boxes - are better positioned. Open integration with QuanLabPro, Ceus, or QS-Torque, controlled PLC communication via the OPERATOR® EST01, and Wi-Fi data transmission within a secured OT segment are not trade-offs between flexibility and security. They deliver both at once.
Time remains before January 20, 2027 - but not unlimited time. The window between now and then is the phase for manufacturers and operators to incorporate cybersecurity into development and risk assessments, review OT networks and remote access concepts, and establish clear rules for passwords, updates, and access controls. Organizations that run pilot projects in 2025 and 2026 will avoid scrambling in 2027.
This article is for general informational purposes only and does not constitute legal advice. For a binding assessment of your specific situation, we recommend consulting an attorney specializing in product safety and cybersecurity.
