A customer that makes industrial automation equipment and software raised concerns about these EU laws, which prompted us to look at what they mean for translation.
Two EU laws bring new documentation requirements in 2027. For translation teams, the work will continue long after launch: keeping manuals available for years and helping users understand security updates.
The EU Machinery Regulation replaces the Machinery Directive on 20 January 2027. On 11 December, the main rules of the Cyber Resilience Act (CRA) take effect for a wide range of connected hardware and software. If a product falls under either law, missing instructions or the wrong language can keep it off the EU market. Importers and distributors must also check the documents before selling the product.
Machinery makers have translated manuals for years. Now they need to plan for manuals that stay online for a decade or more, while software and device makers face new demands for security guidance. Translation teams will have more products and updates to work on.
The Machinery Regulation: manuals that stay online for years
The law covers machinery and related equipment, including lifting accessories and safety components. It also covers partly completed machinery. Safety components can be software, so software teams may need to be involved too.
Manufacturers must give users clear instructions and safety information in a language they can easily understand. Each EU country decides which languages satisfy that rule. Companies also have to translate the EU declaration of conformity, the document that states the product meets EU requirements, into the languages each country requires. Assembly instructions for partly completed machinery follow a similar rule. There is a narrow exception for maintenance instructions used by specialists appointed by the manufacturer: one official EU language those specialists understand is enough.
The old law already required translated instructions. The new rules spell out how manufacturers can deliver them digitally and how long users must be able to find them.
Manufacturers can provide digital instructions, but users must be able to find, print and download them. They must also be able to save a copy so they can read it when a machine breaks down. Manufacturers have to keep the instructions online for as long as they expect the machine to last and for at least 10 years after it goes on the market. A buyer who asks for paper instructions at purchase must get a free copy within a month. Machines that non-professionals might use still need essential safety information on paper.
A manual might still need to be available years after the team that wrote it has moved on. Translation teams need to know which language versions belong to which machines and which versions an update affects. The rules also cover instructions built into the software inside a machine.
A small edit can mean checking terms, reviewing translations and making sure the right version goes online. Add more machines and languages, and there’s more room for mistakes.
Selling in four EU countries doesn’t mean translating into all 24 official EU languages. Check what each country requires for the products you sell. Moving into another market may mean adding a language and keeping that version up to date.
The Cyber Resilience Act: helping users keep products secure
The CRA covers a broad range of connected hardware and software, including some of the remote services those products rely on. It became law in December 2024, and some duties have already started. Since 11 September 2026, manufacturers have had to report vulnerabilities that attackers are actively exploiting and severe security incidents, including for products already on the market. The main product rules start on 11 December 2027.
The CRA requires instructions in a language that users and the authorities checking the product can easily understand. Manufacturers must keep this information available for at least 10 years after the product goes on the market, or until support ends if that’s longer. The declaration of conformity must also be in the languages each country requires.
The instructions need to tell users what the product is designed to do, which security risks they need to know about and who to contact about a vulnerability. They also need to explain how to install security updates and, where relevant, turn off automatic updates or stop using the product and remove user data safely. Buyers must be able to see when support ends, at least the month and year, before they buy.
If an update changes what users need to do to stay secure, the instructions may need to change too.
The CRA doesn’t give a separate language rule for security advisories, release notes or incident notices. It does require manufacturers to tell affected users about severe incidents and what they can do, and to publish information about vulnerabilities they’ve fixed. If users need Polish or Portuguese to follow that advice, the manufacturer needs a way to get it translated quickly. Waiting for the next manual release may be too late.
The people writing these notices may work in engineering or cybersecurity and have little experience with translation. They need to know who to call and how to get an urgent update published in several languages.
Adding languages to an interface should generally not count as a ‘substantial modification’ under the explanatory notes in the CRA. In other words, translation alone shouldn’t normally trigger a new assessment of whether the product meets the rules.
When both laws apply
A connected machine can fall under both laws, so the people translating the manual and security guidance need to work together. They need a shared glossary.
Take safety and security. English distinguishes the two; German can use Sicherheit for both, and Spanish can use seguridad. A warning about physical injury and a warning about hackers need wording that makes the difference clear. Agree on those terms before translating, and check that the machine translation uses them correctly.
We expect the work to change in five ways:
-
More to translate. Teams may need to translate instructions for installing updates or removing data, support notices, vulnerability contact pages and security alerts, alongside the manual.
-
More languages. An English-only manual may no longer be enough for the countries where you sell. Expansion plans need to include translation.
-
Work after launch. The manuals need to stay available for years, and product updates can bring more translation work. A few changed pages can add up across languages and product versions.
-
Urgent jobs between releases. A security incident may call for translated advice before the next scheduled release. The CRA doesn’t set a separate translation deadline for these notices; the practical challenge is getting advice to users in time to act.
-
More care with safety and security advice. If a mistranslation could lead someone to use a machine unsafely or miss a security update, give it extra review. Keep a record of who checked it and what they changed.
Suppose a company sells a networked industrial controller in 12 EU countries. The engineers fix a vulnerability, but the fix also changes how operators install security updates. The security team writes an advisory, and the documentation team revises the instructions. Translators now have to update the versions used in those countries and make sure they all describe the fix the same way. Users still need to be able to find the right manual years later.
Engineering and cybersecurity need to tell the translation team what changed. The compliance team checks what the law requires, while translators and reviewers prepare the new versions. Decide who will publish each version, so approved translations don’t sit in a queue while users wait.
What to do before 2027
-
Find out which products and languages are affected. Ask the compliance team which laws apply to the products you sell and what languages you need in each country where you sell them.
-
List everything users need to read. Include manuals, declarations of conformity, support dates, security notices and instructions shown on the device. Give each item an owner.
-
Agree on safety and security terms. Build a glossary for each language and check that the translation tools you use use those terms correctly.
-
Plan how updates will get translated. Connect the documentation tools to the translation management system so teams can find changes and update the right language versions. Keep a record of each version, and plan a faster process for urgent security notices.
-
Decide what needs human review. Work with compliance to choose where automated checks are enough and where a person needs to review the translation. Base that decision on what could happen if the text is wrong.
With Intento Language Hub, teams can connect content and translation tools, apply glossaries and choose translation engines for different kinds of content. Intento LQA checks the results against requirements the team sets, helping reviewers decide what needs attention.
