When AI controls physical systems, such as robots and autonomous machines, it isn’t enough for the technology to work. The product must also be safe and meet EU requirements before it can be placed on the market. The problem is that the requirements are spread across several pieces of legislation at once, and it isn’t always clear which ones apply. Here are the eight questions we get asked most often about physical AI, and our answers.
The short version:
-
“Physical AI” isn’t a legal term. The rules follow what a product is and does, not what we call it.
-
It’s rarely just one piece of legislation. Expect several at once, for example the Machinery Regulation (which replaces the Machinery Directive in January 2027), the AI Act and the Cyber Resilience Act (CRA).
-
The timelines have been pushed back, but that doesn’t mean you can ease off. A lot already applies.
Not in the mood to read? Watch our video instead!
1. What is physical AI?
Put simply, it’s AI that doesn’t stay on the screen. These are systems that use sensors to perceive their surroundings, make decisions and then actually do something in the physical world: a warehouse robot, an autonomous truck, a humanoid or a robotic arm that learns from experience.
That’s also what makes the subject special from a regulatory point of view. If a chatbot gets something wrong, you get a strange answer. If a robot gets something wrong, something can break, or someone can get hurt.
2. Which regulations apply to physical AI in the EU?
There is no “Physical AI Regulation.” Instead, you face a patchwork of different rules. The most common are:
-
The Machinery Regulation (replacing the Machinery Directive), for robots and other machinery.
-
The AI Act, for the AI part itself.
-
The Cyber Resilience Act (CRA), for connected products. More on that in question 8.
-
The Radio Equipment Directive (RED), the EMC Directive and the Low Voltage Directive, for electronics, wireless communication and electrical safety.
-
The Batteries Regulation, if the product contains a battery.
-
The GDPR, if the robot films people or collects personal data.
The trick is to go through the product piece by piece: Does it move? Is it connected? Does it have a camera? Does it have a battery? Every “yes” adds another piece of legislation.
3. Does my physical AI product need a CE mark?
In practice, almost always. A product that is both electrical and moving almost certainly falls under at least one CE marking regulation, and in that case the mark is required to sell it on the EU market.
And here’s an important point: the AI Act is not a substitute for CE marking, but an addition to it. For some products, the AI requirements are built into the assessment you have to carry out anyway. Not sure how to CE mark your product? Check out our step-by-step guide: How to CE Mark Your Product.
4. I bought a CE-marked product and modified it a bit. Is the marking still valid?
It depends on what you’ve changed.
The CE mark applies to the product as the manufacturer placed it on the market. If you modify it in a way that affects its safety or how it meets the requirements (new software controlling its movements, new sensors, a different tool on the arm), you may be considered to have made a substantial modification. You can then become responsible as the manufacturer, and you’ll need to carry out a new assessment and draw up a new declaration of conformity.
Minor changes that don’t affect safety are a different matter, but the line isn’t always obvious. A good rule of thumb: if you’re unsure whether a mod affects safety, treat it as if it does, and document how you reached your conclusion.
5. Can we do a self-assessment, or do we need a third party?
It depends on the legislation and the product. For many products, self-assessment is enough, meaning you as the manufacturer carry out the assessment yourself. For higher-risk products, a notified body is required: an independent body that examines or tests the product.
With physical AI, it’s worth double-checking. The Machinery Regulation singles out certain high-risk products that require third-party assessment, and the AI part can affect which route applies. So find out what applies to your specific product before you assume you can do it yourself.
6. Is there really a difference between a physical AI robot and my robot vacuum?
Legally, it’s less about how smart the product is and more about what it’s meant to be used for and what risks it poses. A robot vacuum is a consumer product for the home and falls under the rules for household appliances. A humanoid meant to work alongside people in a warehouse is a machine with entirely different forces, weights and risks, and that’s where the Machinery Regulation kicks in.
So yes, there is a difference, and it isn’t because one is smarter than the other. It comes down to the environment each one is built for.
7. What is the Digital Omnibus?
The Digital Omnibus is the European Commission’s “clean-up package” for digital legislation, published on 19 November 2025 with the aim of simplifying the rules. It touches several laws, including the GDPR, NIS2 and the Data Act, but the part most relevant to physical AI is the amendments to the AI Act.
Here it’s primarily about timing. The Council approved the final amendments on 29 June 2026. This means the rules for stand-alone high-risk AI are postponed to 2 December 2027, and for AI embedded in regulated products to 2 August 2028. A robot usually falls into the latter group.
But don’t miss this: it doesn’t mean the AI Act is on hold. The prohibited practices and the rules for general-purpose AI models weren’t touched by the negotiations. And the fact that the requirements come later is no reason to start later. Technical documentation and risk analysis take time to build.
8. What is the CRA?
The CRA is the Cyber Resilience Act, the EU’s law on cybersecurity for products with digital elements. Put simply: anything that is connected or contains software must be built to withstand attacks, and the manufacturer must handle vulnerabilities throughout the product’s lifetime.
For physical AI, this is especially relevant. A robot that can be hacked is a real safety problem, not just a data privacy problem. Manufacturers will need to, among other things, build in security from the start, report actively exploited vulnerabilities and provide security updates. The rules are being phased in. The reporting obligations started to apply on 11 September 2026, while most of the requirements, including CE marking under the CRA, apply from 11 December 2027.
Where to go from here
Physical AI sits at the intersection of several pieces of legislation, which is exactly why it so easily gets messy. The best thing you can do is start early and go through your product systematically, step by step.