EU Machinery Regulation 2023/1230 Technical File Gap Checker

What it does (for agents & pipelines): give it a machinery technical file (or its table of contents / section text) as text or a public URL/PDF, and it returns a structured readiness / gap report against EU Machinery Regulation (EU) 2023/1230 — the topics your file covers (each with a verbatim quote), then the missing Annex III essential health & safety requirements (EHSR) and Annex IV technical-file contents, with special emphasis on the NEW 2023 requirements (cybersecurity, software updates, AI/autonomous behaviour, connectivity, human-robot collaboration) that files ported from the old Directive 2006/42/EC almost always lack. Machine-readable, pay-per-document, no seat license.

Returns, as structured JSON:

• ✅ Covered topics the file actually addresses, each with a verbatim source_quote — nothing invented
• ✅ Detected features (connected / software / AI / collaborative) that determine which requirements apply
• ✅ Annex III EHSR gaps and Annex IV technical-file gaps — the missing items, each with its Annex reference, a critical/high/medium severity, and a plain-English why
• ✅ new_requirement_gaps — the differentiator: the new-under-2023/1230 requirements (cybersecurity Annex III 1.1.9, software updates, AI/self-evolving behaviour, connectivity, human-robot collaboration) your file doesn't address — the exact blind spot when a 2006/42/EC file is reused
• ✅ An overall readiness signal (likely-incomplete / partial / substantially-documented)

Built for machinery manufacturers, EU authorised representatives, and CE-compliance consultants preparing for the hard 20 January 2027 application date (no grace period). Where an hour of consultant time or a Notified Body is the only alternative, this triages a technical file in seconds so effort goes to the real gaps.

Why the gaps are trustworthy

The model only extracts which topics the file covers, with verbatim quotes. It never decides what's missing and never judges conformity. Deterministic code compares that coverage to a curated checklist (rules/ce-techfile-rules.json) built from Annex III (EHSR) and Annex IV (technical documentation) of Regulation (EU) 2023/1230, and it only demands the connectivity/cybersecurity/AI/collaboration requirements when the file's own text shows those features. Every gap carries its Annex reference.

Input

{
  "documents": [
    { "id": "machine-1", "product_type": "packaging machine",
      "text": "Technical File ... Risk assessment per EN ISO 12100 ... connects to the plant network ..." },
    { "id": "machine-2", "url": "https://example.com/public-technical-file.pdf" }
  ]
}

1–20 documents per run. Provide text (paste the technical file or its contents list — fastest and most reliable) or a url to a public page/PDF (fetched best-effort). Optional product_type and id are echoed back.

Output (per document)

{
  "detected_features": ["connected", "software"],
  "new_requirement_gaps": [
    { "id": "protection-against-corruption", "annex_ref": "III 1.1.9", "severity": "high", "new_2023": true,
      "label": "Cybersecurity — protection against corruption ...",
      "why": "NEW under 2023/1230 (Annex III 1.1.9): connecting a device or allowing remote communication must not create a hazard ..." }
  ],
  "ehsr_gaps": [ /* non-new Annex III gaps */ ],
  "techfile_gaps": [ /* Annex IV contents missing */ ],
  "readiness": "partial",
  "counts": { "covered_items": 8, "ehsr_gaps": 1, "techfile_gaps": 2, "new_requirement_gaps": 2 },
  "disclaimer": "..."
}

vs. TÜV / Intertek / Nemko and CE consultants

Notified Bodies and CE consultants (TÜV, Intertek, Nemko) do the authoritative assessment — and for Annex I high-risk machinery you still need them. But there is no self-serve, per-document tool to triage a technical file before you engage one. This Actor fills that gap: pay-per-document, API-first, agent-friendly, and focused on the highest-value question for the 2027 deadline — does your existing file even address the new cybersecurity / software / AI requirements? Use a Notified Body for conformity assessment; use this to know where your file stands and what to fix first.

Limits (read this)

• NOT a conformity assessment, NOT a Notified Body opinion, and NOT legal advice. It is a readiness/gap triage. It cannot certify compliance.
• Gap detection is heuristic pattern matching (v0.1) over the text you provide — a topic mentioned counts as "addressed," so a thin mention can mask a substantive gap, and applicability of each EHSR still needs your engineering judgement. Confirm requirements and the conformity-assessment route against the Regulation text; for Annex I high-risk machinery, engage a Notified Body.
• Extraction is text-only and depends on document quality. Garbage in → low quote_hit_ratio → not billed.

Fair charging

Pay per successfully processed document (techfile-checked). Failed fetches, non-technical-file text, low-verification extractions, and documents skipped after your run's charge limit is reached are not charged. Every source_quote is re-verified verbatim against the document before the run is billable.

Development

pnpm install
pnpm typecheck   # tsc --noEmit
pnpm test        # vitest: rules table, validate layer, gap analysis
pnpm smoke       # offline end-to-end (no network, no LLM)
pnpm golden      # real-LLM acceptance vs hand-labeled technical-file samples (needs DEEPSEEK_API_KEY)

Architecture (single-direction deps): main → fetch/extract/validate/match → rules → domain. Same three-layer engine as the GovCon and CPSC actors; the Annex III / Annex IV checklist is the moat.

Current-source verification

Checklist grounded in primary sources retrieved 2026-07-18: full text (Annex III EHSR, Annex IV technical documentation) — Regulation (EU) 2023/1230, EUR-Lex; 20 January 2027 application date and the new AI/cybersecurity/IoT/software-update requirements — TÜV Rheinland; cybersecurity in Annex III 1.1.9 / 1.2.1 — Nemko.