Most discussions about a substantial modification start with the wrong question: what exactly was added, replaced or reprogrammed? Under Regulation (EU) 2023/1230, that is secondary. The real question is what the change did to safety. A small software adjustment can have the same safety effect as a major mechanical rebuild if it creates a new hazard, increases an existing risk, or forces additional protective measures. That is why an extra guard or emergency stop is often only the visible consequence of a deeper change. If the change was not foreseen by the manufacturer, and it alters the original safety concept, the company making it may move into the role of manufacturer. The only defensible basis for a negative conclusion is a proper risk assessment in line with ISO 12100.
That does not mean every retrofit or update is a substantial modification. A like-for-like replacement, a manufacturer-documented option, or a parameter adjustment that stays within validated limits may remain outside the threshold. The point is not to assume yes or no from the size of the intervention. The point is to assess the modified configuration on evidence.
What turns a change into a substantial modification?
For machinery already placed on the market or put into service, Regulation (EU) 2023/1230 looks at changes introduced later, whether physical or digital. In practical terms, three questions matter.
- Was the change foreseen by the manufacturer?
- Did it create a new hazard or increase an existing risk?
- Did controlling that new situation require additional protective measures, especially changes to the safety-related control system, or measures relating to stability or mechanical strength?
If the answer moves toward yes on all three points, you are no longer dealing with a routine engineering tweak. You are moving toward a substantial modification.
The important shift is this: you are not assessing the added part in isolation. You are assessing what changed in the human-machine relationship, the machine function, the machine limits, the operating parameters, and the sequence of events that could lead to harm. A platform, a guard, a new drive, a restart routine, or a connection to ERP can each look modest on paper. From a safety perspective, any of them can change the risk picture materially.
In other words, substantial modification is not about volume of work. It is about whether the original safety case still holds after the change.
When a guard or emergency stop points to a substantial modification
A common mistake is to assess the protective measure instead of the change that made it necessary. In day-to-day projects, people often say that they only added a guard or only fitted an emergency stop. That description is understandable, but it is backwards from a safety perspective.
A guard is usually not the modification that matters. It is the response to a changed hazard situation. The same is true of an emergency stop. If a new emergency stop is needed in the middle of a line, the critical question is not whether the button itself changes legal status. The critical question is what changed in the machine or process so that the button became necessary.
A typical example is operator access into a hazardous area that was not previously part of normal operation. Once a person is introduced into that space, the human-machine relationship changes. A new hazard situation appears. The emergency stop does not create that risk; it reacts to it.
This matters because an emergency stop is a reactive measure. It is intended to avert an actual or impending danger, but it does not replace other protective measures. If the risk assessment shows that people can now enter a hazardous area during operation, you may also need preventive measures such as an interlocked guard, a light curtain, restricted movement in a defined operating mode, or other safety functions implemented through the safety-related control system. The visible hardware is only the consequence. The real issue is that the original safety structure has been disturbed.
Physical changes that may amount to a substantial modification
Adding a platform to a hazardous area
A platform is often treated as a usability improvement. It may improve access, ergonomics, cleaning, adjustment or maintenance. Yet it can fundamentally change exposure to risk. A platform can bring a person closer to moving parts, create access where none previously existed, change lines of sight, and alter how tasks are performed.
Once that happens, new protective measures may become necessary. The machine may now need interlocked access, monitored stop functions, or changed operating parameters in certain modes. If those measures require changes to the safety-related control system, the project is moving into substantial modification territory.
A new guard that creates a new risk
Guards are basic protective measures, but a retrofit guard is not automatically harmless. A poorly considered guard can change access routes, force more frequent opening, reduce visibility, worsen ergonomics, or add structural loads. In some cases, it can even encourage unsafe workarounds if routine tasks become impractical.
That is why the correct question is not whether adding a guard is safe by definition. The correct question is whether the changed arrangement creates new hazards or increases risk, and whether additional measures are needed to control that new situation. If the answer is yes, the change may meet the threshold for substantial modification.
Changing a drive or its operating parameters
Drive changes are especially deceptive because the machine may appear to do the same job after the retrofit. But a new drive, higher torque, different acceleration ramps, altered overload limits, or revised stopping behaviour can significantly change the development of a hazardous event.
For example, a conveyor or actuator that previously stalled under overload may now continue to apply force. That can change the outcome from a controlled stop to deformation, loss of stability, failure of load-bearing parts, or more severe trapping conditions. In that situation, the issue is not the new motor as a component. The issue is that the machine now behaves differently under fault or abnormal conditions. That may require new protective measures, verification of mechanical strength, or both.
Digital changes can also be a substantial modification
Many organisations still instinctively associate substantial modification with steelwork, guarding and access changes. That is too narrow. Regulation (EU) 2023/1230 also captures changes introduced by digital means. In practice, software and configuration changes can affect safety just as much as mechanical rebuilds.
Restart logic and unexpected start-up
One of the most underestimated changes is restart logic. Automatic resumption after a guard is closed, after power is restored, or after communication returns may improve productivity. It may also create a serious safety problem if people can no longer predict when motion will restart.
Unexpected start-up is not a minor software detail. If the operator loses control of the moment of restart, the hazard situation changes even though no new metal has been added to the machine. A risk assessment may then show that additional protective measures are required.
Changes to operating parameters
Adjustments to speed, torque, acceleration, travel limits or response times are often described as optimisation. From a safety standpoint, they are changes to machine limits and behaviour. They can shorten the time available for human reaction, reduce the effectiveness of existing protective measures, or increase the severity of a hazardous event.
This is why parameter changes cannot be dismissed as routine tuning. If the changed operating parameters alter the safety assumptions behind guards, stopping performance, access control or manual intervention, the modification needs structured assessment.
ERP integration and network access
Connecting a machine or an entire line to ERP, reporting tools or other external systems is another area where businesses often underestimate safety impact. On paper, the project may appear to be only data exchange. In reality, network integration changes the machine environment. It introduces new signal paths, new access routes, new timing dependencies and, in some cases, remote influence over settings or behaviour.
If the manufacturer did not foresee that architecture, the machine may begin to operate outside the assumptions used in the original risk assessment. Protective measures, including safety functions, are designed for a defined machine behaviour within defined limits. If external systems can alter commands, parameters, states or restart conditions, the effectiveness of those measures may no longer be assured.
The fact that the machine still appears to perform the same production task does not settle the matter. Safety depends on how it behaves in normal operation, fault conditions, restart, maintenance and foreseeable misuse. Digital integration can change all of those.
Changes to the safety-related control system
The most direct digital case is a change to the safety-related control system itself. If you modify safety logic, interlock conditions, reset behaviour, permission-to-move logic or the configuration of protective functions, you are not making an ordinary software edit. You are changing how risk is controlled.
Where that change affects the effectiveness of a safety function, changes its behaviour, or requires redesign, the argument for substantial modification becomes strong very quickly.
Why you cannot rule out a substantial modification without risk assessment
This is the point where many organisations want a quick assurance that the change is definitely not a substantial modification. In straightforward cases, an experienced engineer may identify an obvious yes quite fast. The harder judgement, and usually the more important one, is a credible no.
You cannot reach that conclusion honestly by eye, by intuition, or by a one-line project description. Statements such as added a guard, changed the program, connected the line to ERP, or increased motor torque do not tell you enough. The key question is always what the change did to risk.
That is exactly why ISO 12100 matters. A proper risk assessment requires you to:
- define the limits of the modified machine, including intended use and reasonably foreseeable misuse,
- identify hazards and hazardous situations,
- estimate and evaluate the risk,
- determine whether existing protective measures remain adequate,
- identify any additional protective measures needed for the modified configuration.
Without that work, there is no solid basis for saying that substantial modification did not occur. You may have a view. You may even have good engineering instincts. But from the perspective of safety and legal responsibility, that is not the same as due diligence.
A screening tool or checklist can still be useful. It can help identify obvious high-risk cases early. What it cannot do, on its own, is prove that a change is safely outside the threshold.
Legal consequence: responsibility, not just engineering
The reason this topic matters is not simply technical classification. A substantial modification can change who carries legal responsibility. Where the threshold is met, the entity introducing the change may assume the role of manufacturer for the modified machine, or for the modified part of an assembly of machinery.
That can mean responsibility for demonstrating conformity with Regulation (EU) 2023/1230, reviewing essential health and safety requirements, updating technical documentation and instructions, and addressing CE obligations before the modified equipment is placed on the market or put into service in its new configuration. The exact scope depends on the case, but the direction of responsibility is clear.
For end users, integrators and retrofit contractors, this is why the issue should never be treated as a narrow maintenance decision. A change to access, guarding, restart, drive behaviour or networked control can move a project from routine engineering into manufacturer-level accountability.
Final point on substantial modification
Substantial modification is not a detail of terminology. It is the moment when a change affects safety enough that the original basis of compliance may no longer be relied on without fresh analysis. The decisive question is not how much was changed. It is whether safety had to be rebuilt after the change.
If you can show, through a documented risk assessment, that the modified machine remains safe within its revised limits, you are in control of the situation. If you cannot, the real risk is not only technical. It is also legal, organisational and personal. That is why due diligence under ISO 12100 is not bureaucracy. It is the evidence that your decision about substantial modification is grounded in reality.