Insights

Humanoid robots and EU rules – CE marking, the AI Act and the Machinery Regulation

Which EU rules apply to humanoid robots? CE marking, the 2027 Machinery Regulation, the AI Act after the Digital Omnibus, and product safety.

RegulationPublished 28 October 20266 min read

In legal terms, a humanoid robot is not a new kind of product. It is a machine with motors, a radio connection, a battery, cameras and AI software. Each of those parts falls under existing EU legislation. Anyone who places a humanoid robot on the EU market, buys one or deploys one therefore faces a stack of rules. This article sets out the most important ones, with dates as they stand in October 2026.

Please note: this is a general overview, not legal advice. For concrete plans, consult a specialist or a notified body.

CE marking: the foundation

A product with CE marking declares that it complies with all EU legislation that applies to it. That responsibility lies with the manufacturer. If the manufacturer is outside the EU, for example in China, the importer takes on heavier obligations: it must check that the technical documentation, the declaration of conformity and the marking are in order.

For a humanoid robot, several sets of rules usually apply at the same time:

  • Machinery legislation for mechanical and functional safety.
  • The Radio Equipment Directive (RED) for Wi-Fi, Bluetooth and mobile connections, including cybersecurity requirements.
  • EMC and low-voltage rules for electromagnetic compatibility and electrical safety, for example of the charger.
  • Battery rules for the battery pack.
  • Product safety rules for consumer products.
  • The AI Act for the AI software, phased in over time.
  • The GDPR as soon as the robot processes camera images or voice data of people.

From Machinery Directive to Machinery Regulation (20 January 2027)

The Machinery Directive 2006/42/EC still applies today. It is being replaced by the Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027. A regulation applies directly in all Member States, without national transposition.

For humanoid robots, these changes matter most:

  • AI and learning systems. The regulation explicitly addresses software that performs safety functions using learning techniques. Safety components with fully or partially self-evolving behaviour based on machine learning, and machinery with such systems embedded, are listed in Annex I Part A. According to Baker McKenzie, that means mandatory assessment by a notified body; self-certification is not enough.
  • Autonomous mobile machinery. Robots that move around on their own are explicitly covered, EU-OSHA writes.
  • Substantial modifications. Anyone who substantially modifies a machine after delivery, for example with new software that changes its safety behaviour, may be treated as the manufacturer.
  • Digital instructions are permitted.

Practical advice often heard in the sector: do not wait too long before approaching a notified body, as demand for assessments is expected to rise sharply around 2027.

The AI Act after the Digital Omnibus

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. In 2026 the timeline was adjusted by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. According to the European Commission, the timeline now looks like this:

  1. 2 February 2025: prohibited AI practices and the AI literacy obligation.
  2. 2 August 2025: rules for general-purpose AI (GPAI) models.
  3. 2 August 2026: the Act becomes generally applicable, including transparency rules. People must, for example, be told when they are interacting with an AI system.
  4. 2 December 2027: rules for stand-alone high-risk use cases (Annex III), such as AI in recruitment and workforce management, education or critical infrastructure.
  5. 2 August 2028: rules for high-risk AI embedded in regulated products (Annex I), such as machinery, lifts and toys.

For most humanoid robots, step 5 is the key one. If the AI performs a safety function in a product covered by machinery legislation, the system can be classed as high-risk. That brings requirements for risk management, data quality, documentation, logging, human oversight and robustness. According to the Commission, the Omnibus also clarifies how the AI Act interacts with product legislation such as the Machinery Regulation.

If a humanoid robot is used at work to evaluate employees or allocate tasks, the "employment" category of Annex III may also apply.

Product safety and liability

  • General Product Safety Regulation (GPSR). Regulation (EU) 2023/988 has applied to consumer products since 13 December 2024. A product from outside the EU must have a responsible economic operator in the EU. Online marketplaces have their own obligations too. This matters for anyone ordering a humanoid robot directly from abroad: without a European responsible party, recourse is difficult if something goes wrong.
  • New Product Liability Directive. Directive (EU) 2024/2853 covers products placed on the market after 9 December 2026 and explicitly treats software as a product, as an analysis by Taylor Wessing explains. For robots that receive updates over the internet, this is a significant change.

Cybersecurity

A connected robot with cameras and microphones is also an IT system. Two sets of rules are important:

  • Since 1 August 2025, cybersecurity requirements under the Radio Equipment Directive (Delegated Regulation 2022/30) apply to devices that connect to the internet.
  • The Cyber Resilience Act (Regulation (EU) 2024/2847) has required manufacturers since 11 September 2026 to report actively exploited vulnerabilities and severe incidents. The remaining requirements apply from 11 December 2027, as McCann FitzGerald summarises.

Standards: guidance still in development

Standards make legislation concrete. For industrial robots, the revised ISO 10218 was published in 2025, incorporating the collaborative-robot requirements from ISO/TS 15066. For robots that actively maintain their balance, such as humanoids, ISO 25785-1 is being developed. That standard is not finished yet. Our article on safety around people, in Insights, goes into more detail.

What does this mean in practice?

For businesses that want to deploy a humanoid robot:

  1. Request the EU declaration of conformity and check which directives and standards it lists.
  2. Establish who is responsible in the EU: manufacturer, importer or authorised representative.
  3. Carry out your own workplace risk assessment, as occupational health and safety law requires.
  4. Document what data the robot collects, where it goes and how updates are handled.
  5. Factor 20 January 2027 (Machinery Regulation) and 2 August 2028 (AI Act, embedded AI) into contracts and planning.

For consumers: preferably buy from a seller with an EU presence, check the CE marking and safety information in your language, and read how the robot handles camera images and voice data at home.

Today, in development, later

  • Today: CE marking under the Machinery Directive, RED cybersecurity, the GPSR, the GDPR and the first parts of the AI Act already apply.
  • In development: dedicated safety standards for dynamically balancing robots, and AI Act guidance and harmonised standards.
  • Later: the Machinery Regulation (2027), full CRA obligations (December 2027) and high-risk requirements for embedded AI (August 2028).

In closing

EU rules do not make introducing humanoid robots simpler, but they do make it more predictable. For users, they are an important safeguard. KYNOR intends to bring robots from the Chinese ecosystem to Europe only along that route of selection, documentation and support. Read more on China to Europe or stay informed through Early Access.

Sources

  • https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
  • https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force
  • https://osha.europa.eu/en/legislation/directive/regulation-20231230eu-machinery
  • https://www.bakermckenzie.com/en/insight/publications/resources/product-risk-radar-articles/machinery-regulation
  • https://www.bakermckenzie.com/en/insight/publications/resources/product-risk-radar-articles/general-product-safety-regulation
  • https://taylorwessing.com/-/media/taylor-wessing/files/germany/2024/12/tw24_dla-deep-dive-cra-pld_english.pdf
  • https://www.gov.uk/government/publications/radio-equipment-regulations-2017/regulation-eu-202230-factsheet
  • https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/cyber-resilience-act-reporting-obligations-apply-from-11-september-2026
  • https://www.therobotreport.com/iso-10218-industrial-robot-safety-standard-receives-major-overhaul/
  • https://www.iso.org/standard/91469.html

This article is based on public sources and reflects the situation on the date of publication. It is not advice on any specific purchase.