Navigating the legal maze: AI, autonomous robots, and the EU’s regulatory overhaul

As artificial intelligence (AI) continues to shape the future of technology, the EU is taking proactive steps to ensure that its development and deployment remain trustworthy, safe, and human-centric. Among the most impactful developments are the EU AI Act and the Revised Product Liability Directive. These instruments aim not only to regulate AI at a systems level but also to ensure accountability when it is integrated into complex products like autonomous robots. 

In this blogpost, we break down key aspects of this legal transformation, with a particular focus on high-risk AI systems, the application of these frameworks to autonomous robots, and the updated liability rules that aim to bridge gaps in accountability. 

1. The high-stakes category: high-risk AI systems 

What is a high-risk AI system? 

The EU AI Act, adopted in June 2024, introduces a risk-based regulatory framework. At the core of this approach is the concept of high-risk AI systems, which are allowed but heavily regulated due to their potential to impact health, safety, and fundamental rights. 

A system qualifies as “high-risk” in two main ways: 

1. Safety Component of a Regulated Product: If an AI system is part of a product that falls under specific EU harmonization legislation – such as the Machinery Regulation or Medical Device Regulation – and requires third-party conformity assessment, it is deemed high-risk. 
2. Annex III Use Cases: Even standalone systems may be high-risk if they perform tasks outlined in Annex III of the AI Act. These include: 

• Biometric identification 
• AI in education, recruitment, and employment 
• Law enforcement applications 
• Migration and border control 
• Access to essential services like healthcare or insurance 
• Administration of justice and democratic processes 

Interestingly, the EU AI Act recognizes that not all systems within these use cases are inherently high-risk. If the AI serves a narrow, procedural role, assists a human’s prior assessment without undue influence, or merely detects patterns, it may be excluded – unless it performs profiling of individuals, which is automatically high-risk. 

Key requirements for high-risk AI systems 

To ensure safety and accountability, high-risk systems must comply with rigorous obligations, including: 

• Risk Management Systems: Continuous identification, evaluation, and mitigation of potential hazards. 
• Bias-Free Data Governance: Datasets must be appropriate, representative, and statistically sound. 
• Transparent Documentation: Full technical documentation and logs must be maintained. 
• Human Oversight: Systems must allow for meaningful human intervention. 
• Cybersecurity Safeguards: Adequate protection against tampering and misuse. 
• Pre-Market and Post-Market Control: CE marking, incident reporting, and ongoing monitoring are mandatory. 

The intention is clear: even as AI becomes more autonomous, it must remain subject to human-centric governance and robust accountability mechanisms. 

2. When AI has legs: Application to autonomous robots 

While the AI Act doesn’t explicitly mention “robots,” its relevance is unmistakable. Autonomous robots, often relying on machine learning for navigation, task execution, or decision-making, can easily fall into high-risk territory. 

The assessment hinges on several key questions: 

A. Is the robot considered “machinery”? 

According to the new Machinery Regulation (replacing the Machinery Directive in 2027), machinery is defined broadly enough to include many types of robots. The standard ISO 8373:2021 describes a robot as a “programmed actuated mechanism with a degree of autonomy”, which overlaps significantly with the EU’s definition of AI systems. 

If a robot qualifies as machinery and incorporates a high-risk AI system as a safety component, it is automatically subjected to the AI Act’s high-risk regime. This is particularly relevant for robots used in manufacturing, logistics, or healthcare – sectors where safety is paramount. 

B. Does the robot use AI for high-risk functions? 

A robot may contain one or more AI systems, some of which could independently qualify as high-risk based on their functionality. For example: 

• A healthcare robot that determines patient treatment options 
• A security robot using biometric recognition 
• A recruitment bot screening applicants based on personality traits 

In such cases, even if the robot isn’t machinery under the EU framework, individual AI modules might still be regulated under the AI Act. 

C. Are there multiple high-risk systems within one robot? 

It’s possible for a single robot to include multiple AI components, each regulated differently. For instance: 

• A safety navigation AI might be regulated through the Machinery Regulation 
• A facial recognition AI might fall under Annex III high-risk use cases 

Each AI system must be assessed independently, creating a layered compliance scenario. Developers will need to map out each AI component, determine its regulatory category, and ensure each meets applicable obligations.

D. Is the robot in research or commercial use? 

Importantly, scientific research is excluded from the AI Act. As long as autonomous robots are used purely for experimental purposes and not marketed or deployed, the full regulatory burden doesn’t apply – yet. Once commercialized, they are fully within scope. 

3. The legal catch-up game: Revised Product Liability Directive 

Another foundational shift comes from the Revised Product Liability Directive, adopted in 2024 and applicable from December 2026. This updated framework finally addresses longstanding questions about how liability applies to software, data, and AI systems - including those integrated into robots. 

A. From hardware to code: Software as a product 

One of the directive’s biggest advancements is its formal recognition of software as a product. 

This includes: 

• Operating systems and firmware 
• AI modules 
• Updates and patches 

In short, if a piece of software is essential for the functioning of a robot – or can cause harm independently – it is subject to the same liability rules as physical products. 

This resolves ambiguity under the 1985 directive, which didn’t clearly cover digital goods. Now, AI systems deployed within or alongside robots can trigger product liability, even if sold separately. 

B. Liability chain: Who is responsible? 

The revised directive also clarifies the chain of accountability, extending liability to: 

• Manufacturers of AI or robots 
• Importers and distributors 
• Component or software providers 
• Service providers integrating AI 

Notably, multiple actors can be held jointly and severally liable, and manufacturers cannot contractually waive this responsibility. If the origin of a defect is unclear, courts can order disclosure of evidence from defendants and presume liability if key information is withheld. 

C. New Damages Covered 

Another major upgrade is the inclusion of: 

• Psychological injuries 
• Loss or corruption of data 
• Non-material losses related to physical damages 

However, purely financial losses - such as bad investment advice from a robo-advisor - are still excluded unless linked to tangible harm. 

4. Final Thoughts: Legal Precision in a Robotic Age 

The EU’s new legal framework acknowledges that technology is evolving faster than traditional regulatory systems. Autonomous robots – once sci-fi curiosities – are now real products interacting with human environments in ways that blur the lines between code, machine, and legal responsibility. 

Together, the EU AI Act and Revised Product Liability Directive offer a layered but coherent structure for governing this complexity: 

• The AI Act ensures safe and ethical AI design and deployment 
• The Product Liability Directive ensures accountability when things go wrong 

For developers, manufacturers, and deployers of autonomous robots, this means navigating new compliance obligations, documentation standards, and liability risks. 

The road ahead is more regulated, but also more predictable. In the end, the EU’s strategy reflects a simple truth: the power of autonomous systems must be matched by equally robust responsibility. 

If you have more questions on AI and robotics, please contact Niels Vandezande. 

This research was conducted as part of the CONVINCE project, funded under the Horizon Europe Programme under Grant Agreement No 101070227. Views and opinions expressed are however those of the author only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the granting authority can be held responsible for them.