Most teams start with the wrong question. They ask: what exactly did we add, how big was the rebuild, or was it only a software tweak? From a machinery safety and compliance perspective, those are secondary questions. The real issue is whether the change altered risk. A substantial modification does not begin when a lot has been changed. It begins when the machine’s safety profile changes in a way the original manufacturer did not foresee, creating a new hazardous situation or increasing existing risk and requiring additional protective measures. Under Regulation (EU) 2023/1230, that can happen through physical changes, control system changes, parameter changes, or digital integration. If the change forces you to redesign safety rather than simply maintain it, you may have crossed into substantial modification territory, with all the compliance and liability consequences that follow.
Substantial modification: the wrong question most companies ask
In practice, assessment often starts from the visible item:
- We added a guard.
- We installed an emergency stop.
- We changed the drive settings.
- We connected the line to the ERP or MES layer.
That framing is understandable, but it is backwards.
The safeguard is usually not the modification. It is the response to the modification.
If a new protective measure has become necessary, that normally means something changed beforehand in the human-machine interface, machine function, operating limits, access conditions, or event sequence leading to harm. In other words, the important issue is not the component you added, but the change in the machine’s safety structure.
Regulation (EU) 2023/1230 approaches this from exactly that angle. The deciding factors are whether the change was not foreseen by the manufacturer, whether it affects safety by creating a new hazardous situation or increasing risk, and whether it requires additional protective measures, especially measures involving the safety-related control system or mechanical strength.
So the right question is not: “Did adding this device count?” The right question is: “What changed that made this device necessary?”
Why substantial modification is about risk, not the scale of the rebuild
A small technical change can have major safety consequences. A large rebuild may, in some cases, leave the original safety concept fundamentally intact. That is why judging by size, cost, or visible scope is unreliable.
What matters is the effect on:
- the relationship between operator and machine,
- the intended use and reasonably foreseeable misuse,
- the machine’s limits,
- the sequence of events in a potential hazardous event,
- the adequacy of existing protective measures.
This is why a digital change can carry the same compliance weight as a mechanical one. A modified restart sequence, updated safety PLC logic, altered speed limit, or external system connection can change machine behaviour just as significantly as a new platform or drive.
In many cases, the key trigger is simple: after the change, do you need new or modified protective measures to control the risk? If yes, you are no longer looking at a routine adjustment. You may be dealing with a substantial modification.
Substantial modification and the common mistake of assessing the safeguard instead of the change
One of the most frequent errors is to assess the added safety measure in isolation.
For example:
- We only added an emergency stop pushbutton.
- We only fitted a light curtain.
- We only added an interlocked guard.
Those statements do not describe the real modification. They describe the mitigation.
If the machine now needs an emergency stop in a new position, why? If it needs a light curtain, what new access or exposure exists? If it needs an interlock, what changed in the process or operator task that made preventive control necessary?
This distinction is critical because emergency stop devices are reactive. They are intended to avert an actual or impending dangerous situation, but they are not a substitute for inherently safe design or preventive safeguarding. Machinery legislation and established risk reduction principles make that clear.
So if a change has introduced operator access into a danger zone and the answer is to add an emergency stop, the real problem is not the missing button. The real problem is that the change created a new hazardous situation. The emergency stop is just one visible symptom.
Examples of physical changes that may amount to substantial modification
Adding a platform or new access route
A platform often looks like an ergonomic improvement. It may reduce maintenance time or improve operator access. But it can also:
- enable access to a danger zone that was previously inaccessible,
- reduce separation distance from moving parts,
- change the way tasks are performed,
- alter visibility and supervision of the process.
Once a person can approach a hazard in a new way, the hazardous situation changes. If this then requires interlocked guarding, presence sensing devices, limited speed functions, or mode-dependent safety logic, the change is no longer merely architectural or ergonomic. It may meet the threshold for a substantial modification.
Adding a guard that creates new risk
Guards are fundamental protective measures, but a newly added guard can itself change the risk profile. It may:
- force more frequent access,
- worsen ergonomics,
- restrict visibility of the process,
- require position monitoring or locking,
- introduce structural loads or pinch points.
If the added guard generates new hazardous situations or requires new safety functions to be effective, it is not just a simple improvement. It is part of a change that affects the overall safety concept.
Changing a drive or drive parameters
This is one of the most underestimated scenarios. The machine may appear to operate as before, but altered torque, acceleration ramps, overload thresholds, stopping performance, or motion limits can radically affect safety.
For example, a conveyor that previously stalled under overload may, after a drive change, continue producing force, leading to deformation, instability, or damage to load-bearing parts. In that case, the issue is not the motor as a component. The issue is that the hazardous event develops differently and may now require:
- new force or torque limiting functions,
- revised stopping logic,
- verification of structural strength,
- mechanical redesign.
That is exactly the kind of safety impact that can move a change into substantial modification territory.
Digital changes can also be a substantial modification
Many organisations still associate machinery modification mainly with fabrication, guarding, and mechanics. That view is outdated. Regulation (EU) 2023/1230 explicitly captures changes introduced by digital means as well.
Software changes are often underestimated because they are less visible. The frame stays the same. No new metal appears. Yet the machine may behave very differently.
Restart and restart-permission logic
Seemingly small changes such as automatic restart after guard closure, power restoration, or communication recovery can be safety-critical. If the operator no longer controls the moment of restart, the hazardous situation changes even though the machine has not been mechanically rebuilt.
Unexpected start-up remains one of the most serious machinery hazards. Any change that affects prevention of unexpected start, restart interlocks, reset logic, or permissive conditions needs very careful review.
Operating parameter changes
Changes to speed, acceleration, travel range, response times, or process timing are often introduced as optimisation measures. From a risk perspective, they may reduce available reaction time, undermine existing safeguards, or increase injury severity. This is not mere tuning. It is a change to the machine’s operating conditions.
Integration with external systems
Connecting machinery or a line to ERP, MES, analytics platforms, middleware, or remote access architecture is another commonly underestimated area. The argument is often: the machine still does the same thing.
That may not be true from a safety standpoint.
Once networked integration is introduced, the machine’s environment changes. New signals, access paths, command sources, configuration pathways, and potential cyber-physical interactions appear. If the manufacturer did not foresee that architecture, then assumptions underpinning the original risk assessment may no longer be valid.
That can affect:
- validation of incoming data,
- access control,
- software integrity,
- control behaviour,
- the effectiveness of safety functions designed for the original operating envelope.
The issue is not that the ERP connection exists. The issue is whether that connection changes machine behaviour in a way that affects safety.
Changes to safety-related software
The clearest case is any change to safety-related control functions: safety PLC software, interlock logic, muting logic, reset conditions, enabling conditions, safe speed functions, or guard monitoring configuration. These are not ordinary IT changes. They directly affect how safety functions perform.
If the change alters effectiveness, response, architecture, or required performance of the safety function, the case for substantial modification becomes strong very quickly.
Why you cannot honestly say “this is definitely not a substantial modification” without risk assessment
This is the point where many businesses want a simple answer. Unfortunately, an honest answer is often impossible without a proper risk assessment.
That is not consultant caution. It is a direct consequence of the legal and technical definition. A substantial modification is determined by the change’s effect on safety:
- Did it create a new hazardous situation?
- Did it increase existing risk?
- Did it require additional protective measures?
You cannot answer those questions reliably by instinct, by a short checklist alone, or by looking at the added component in isolation. The assessment has to examine:
- machine limits,
- tasks and access patterns,
- hazardous situations,
- possible hazardous events,
- risk estimation and evaluation,
- the adequacy of protective measures under the modified conditions.
That is the logic of ISO 12100, and it remains the right foundation for demonstrating due diligence.
An experienced machinery safety engineer can often identify indicators very quickly, especially when the answer is likely yes. But saying no with confidence is much harder. Without a structured assessment, there is no credible basis for claiming that no substantial modification has occurred.
Substantial modification is ultimately about legal responsibility
Many businesses still treat this as a technical classification exercise. In reality, it is a responsibility threshold.
When a change to a machine or assembly of machinery meets the criteria for substantial modification, the entity making that change may assume the role of manufacturer for the modified part or configuration. That means responsibility for compliance, conformity assessment, technical documentation, and demonstrating that the modified machine still meets the applicable essential health and safety requirements.
This is why the topic should never be reduced to “how much did we change?” The real question is whether the machine’s safety has been altered in a way that requires it to be reassessed and intentionally redesigned.
Every meaningful change can affect:
- how the machine is used,
- its operating limits,
- human access and exposure,
- the sequence and consequences of hazardous events,
- the effectiveness of safeguards and safety functions.
Those are not minor details. They are the core inputs to machinery risk assessment and compliance.
So the practical closing question is simple: after this change, can you justify that the machine remains safe, not by intuition but with evidence? If you can, you are in control. If you cannot, that is precisely where real risk begins.