Most teams start with the wrong question. What exactly did we change? How much hardware did we add? Was it a major rebuild? From a safety perspective, and under Regulation (EU) 2023/1230, those are secondary questions. A substantial modification does not start when someone changes a lot. It starts when safety changes.
That is the practical line engineers need to hold. The regulation covers changes introduced after machinery has been placed on the market or put into service. It covers physical changes, and it covers digital changes too. The key issue is not whether the work looked extensive. The key issue is whether the change was not foreseen by the manufacturer, whether it created a new hazardous situation or increased an existing risk, and whether it forced additional protective measures, including changes to a safety-related control system or action to ensure mechanical strength.
So stop counting added components. Start tracking what the change did to risk.
What substantial modification really means
In practice, a substantial modification is assessed through consequences, not appearances. You are not evaluating the size of the rebuild. You are evaluating whether the machine now behaves in a safety-relevant way that the manufacturer did not originally design for.
That means looking at the machine as a system:
- its function,
- its limits,
- the human-machine relationship,
- access to hazardous areas,
- the sequence that can lead to a hazardous event,
- and the effectiveness of each protective measure.
This is why apparently small changes can have large consequences. A new platform, a changed drive parameter, a different restart logic, a link to ERP or MES, a modified PLC routine, a new access path for maintenance. Any of these can change the risk picture. Any of these can push a machine into substantial modification territory.
The rule is simple, even if the assessment is not: if safety had to be rebuilt around the change, you are no longer dealing with a trivial alteration.
Why substantial modification is not about the added component
One of the most common mistakes is to assess the protective measure instead of the change that made it necessary.
You hear it all the time:
- We added a guard.
- We installed a light curtain.
- We put in another emergency stop device.
That sounds reasonable. It is also backward.
The protective measure is usually not the modification. It is the response to the modification. If a new protective measure became necessary, something changed earlier: access changed, machine function changed, machine limits changed, or the human-machine relationship changed. The visible hardware is the result. It is not the root cause.
That is why the question 'does adding a guard mean substantial modification?' is usually the wrong question. The right one is this: what changed that made the guard necessary?
That shift matters. It moves the discussion away from components and back to the actual safety structure of the machine.
The emergency stop device case: the button is not the story
A classic example looks harmless. Someone says: we are only adding an emergency stop device in the middle of the line for extra safety.
At that point, the description tells you almost nothing. It describes the response, not the change.
The real question is: why is that emergency stop device needed now?
In many real cases, the answer is that an operator has been introduced into a hazardous zone that was previously inaccessible during operation. That changes the human-machine relationship. It creates a new hazardous situation. The added emergency stop device is not the modification. It is evidence that the safety conditions have already changed.
And there is another hard truth here. An emergency stop device is reactive. It helps a person respond to an actual or imminent danger. It supports other protective measures. It does not replace them. A risk assessment under ISO 12100 may show that an e-stop is not enough at all. The machine may also need a preventive safety function through the safety-related control system, for example:
- stopping when an interlocked guard is opened,
- stopping when a light curtain is interrupted,
- limiting movement in a specific operating mode,
- or changing restart logic so the machine cannot resume unexpectedly.
That is the real lesson. The problem wasn’t the button. The problem was the change.
Physical changes can trigger substantial modification fast
Many substantial modification cases begin with changes that look practical, sensible, even safety-minded. Better access. Better ergonomics. Faster service. Higher output. Good intentions are common. They are also irrelevant if risk was altered.
Adding a platform or access route
A platform to a hazardous zone is often treated as a usability improvement. In reality, it can completely change the safety conditions around the machine.
A new platform may:
- enable access to a hazardous zone that was previously out of reach,
- change how cleaning, adjustment, or setup is performed,
- reduce distance to moving parts,
- change visibility of the process,
- and place people into the path of a hazardous event that was not previously credible.
If that access now requires an interlocked guard, a light curtain, reduced speed, restricted motion, or a new safety function, you are no longer looking at a simple platform. You are looking at a change that may meet the conditions of substantial modification.
A guard that creates new risk
Adding a guard sounds obviously correct. Sometimes it is. Sometimes it is the start of a new problem.
A guard added late to an existing machine can:
- force frequent opening for normal tasks,
- change access paths,
- reduce visibility,
- worsen ergonomics and increase exposure time,
- or impose new loads on the structure that affect mechanical strength.
If the guard itself creates a new hazardous situation, or if it only works when combined with new interlocking, monitoring, or revised control logic, then the issue is not the sheet metal. The issue is the altered safety concept.
Changing the drive or drive parameters
This is one of the most underestimated areas. Replace a drive, raise torque, change acceleration ramps, alter overload limits, and people often say the same thing: the machine still does the same job.
Functionally, maybe. From a safety standpoint, maybe not.
If the original system would stall or stop under overload, and the new drive keeps delivering force, the hazardous event can change completely. A conveyor that once stopped may now deform a frame. A mechanism that once tripped may now keep pushing. That is not a tuning exercise. That is a change in the way danger develops.
In those cases, you may need:
- a new safety function for torque or force limitation,
- different stopping behavior,
- verification of mechanical strength,
- or redesign of part of the mechanism.
Again, the problem is not the new motor by itself. The problem is the changed risk picture.
Digital changes can trigger substantial modification too
Code weighs as much as steel. That point still gets missed.
Many organizations still treat substantial modification as a mechanical issue: guards, structures, drives, access. But Regulation (EU) 2023/1230 explicitly covers changes introduced by digital means as well. If software changes machine behavior in a safety-relevant way, it can matter just as much as a physical rebuild.
Digital changes are often underestimated because they are less visible. No new platform appears. No new frame is welded. No new enclosure arrives. People assume the machine is basically the same. That assumption can be dangerously wrong.
Restart logic and automatic restart
Few software changes are more deceptively small than modified restart logic.
Automatic restart after an interlocked guard closes, after power returns, or after communication is restored may look convenient. It may also be a critical safety change. If the operator no longer controls the moment of restart, the hazardous situation changes even if no mechanical part was touched.
Unexpected startup is not an abstract legal phrase. It is a real failure mode with real injury potential. A small logic edit can be enough to create it.
Process parameter changes are safety changes
Speed, torque, acceleration, travel range, response times, dwell times, sequencing. These settings are often changed for productivity. But they directly affect the time available for human reaction, the severity of contact, and the effectiveness of existing protective measures.
Calling that 'parameter optimization' does not make it harmless. If the machine dynamics change, the risk assessment assumptions may no longer be valid.
ERP, MES, middleware, and network access
This is one of the most overlooked cases. A plant connects a machine or an entire line to ERP, MES, reporting tools, analytics layers, or middleware. The language around it is usually casual: we are only exchanging data.
Maybe. Maybe not.
Once a machine is connected to external systems, its operating environment changes. New signals appear. New access paths appear. New data sources appear. New opportunities for unintended influence appear. If the manufacturer did not foresee that architecture, especially the way middleware handles data validation, access management, software integrity, or control interaction, then machine behavior can change outside the assumptions used in the original risk assessment.
That can mean:
- drive parameters changed from a supervisory level,
- unexpected commands reaching the control layer,
- configuration changes applied remotely,
- or machine behavior that no existing safety function was designed around.
And that is the point. The issue is not that ERP was connected. The issue is that the machine may now behave differently in a way that affects safety.
Changing a safety function in PLC logic
This is the most direct case of all. A change in PLC logic, or in the configuration of a safety-related control system, is not just an automation task when it affects safety functions.
Change reset conditions, interlocks, movement permissions, monitoring logic, or safe state behavior, and you may be changing the way risk is controlled at its core. If effectiveness is altered, if behavior changes, or if the function had to be rebuilt, the route to substantial modification is very short.
Why you cannot honestly say this is not a substantial modification
This is the part many companies do not like. They want a quick reassurance. They want someone to say: relax, this definitely is not a substantial modification.
In many cases, that cannot be said honestly without a proper risk assessment.
The reason is simple. Regulation (EU) 2023/1230 does not define substantial modification through a fixed list of technical changes. It defines it through the effect on safety. Did a new hazardous situation appear? Did existing risk increase? Were additional protective measures required? Those questions cannot be answered by instinct alone.
A credible answer requires the logic of ISO 12100:
- define the machine limits,
- identify each hazardous situation,
- consider the possible hazardous event,
- estimate and evaluate risk,
- and verify whether the protective measures are adequate for the changed conditions.
No simple checklist can give you 100% certainty. A checklist can screen. It cannot prove. Without a documented risk assessment, you do not have a solid basis to claim that substantial modification did not occur. More importantly, you cannot convincingly demonstrate due diligence.
There is a practical rule worth remembering: saying yes can sometimes be fast. Saying no requires evidence.
Substantial modification changes responsibility, not just hardware
This is where the discussion stops being a technical debate and becomes a responsibility issue.
A substantial modification is not just an engineering label. It is the point at which a physical or digital change can move the party making that change into the role of manufacturer for the modified scope. That means responsibility for compliance, for safety, and for being able to justify that the machine in its changed configuration still meets the required level of protection.
That is why the size of the rebuild is not the key question. Industry habit is not the key question. Good intent is not the key question either.
The key question is whether, after the change, the safety of the machine was reassessed and deliberately designed for the new conditions.
Because every meaningful change alters more than configuration. It can alter:
- how the machine is used,
- the limits of the machine,
- the human-machine relationship,
- the path to a hazardous event,
- and the effectiveness of each protective measure.
Those are exactly the foundations of risk assessment. Ignore them, and you are not being efficient. You are simply operating without proof.
So here is the closing test. After the change, can you justify that the machine is still safe, not by intuition, not by habit, but through a structured risk assessment and documented due diligence?
If the answer is yes, you are in control of the situation. If the answer is no, that is where the real risk starts.