AI regulation and governance for robots

Robots increasingly rely on artificial intelligence for perception, planning, grasping, speech and decisions about people, such as which worker gets which task. Governments have responded with laws aimed at AI systems in general, alongside the sector rules covered in lessons 5 to 7. The result is a fast-moving and uneven landscape: the European Union has a comprehensive AI Act whose timetable changed in 2026, Canada has no general federal AI statute after its proposed law died in 2025, and the United States has a federal policy that favours light regulation and challenges state laws, while some states legislate anyway. This lesson explains what these frameworks require of robot makers and deployers, and how companies build AI governance that works across jurisdictions. Facts here are stated as of October 2026, and this area changes quickly enough that readers should check the current position before relying on any detail.

The EU AI Act

The EU's Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. It classifies AI systems by risk. A short list of practices is prohibited outright, including manipulative techniques that cause significant harm, social scoring, untargeted scraping of facial images and emotion recognition in workplaces and schools except for medical or safety reasons; these prohibitions have applied since 2 February 2025. High-risk systems face detailed requirements. Systems that interact with people or generate content face transparency duties, such as telling people they are dealing with an AI system. Obligations for general-purpose AI models have applied since 2 August 2025. Most other systems face no specific obligations.

High-risk AI systems come in two groups. Annex I covers AI that is, or is a safety component of, a product already regulated by EU harmonization law, such as medical devices, toys, lifts and vehicles. Annex III lists stand-alone uses, including AI used in employment for recruitment, task allocation, monitoring and evaluation of workers, in education, in access to essential services such as credit, in critical infrastructure and in law enforcement. High-risk systems need a risk management system, data governance, technical documentation, automatic logging, transparency to deployers, human oversight measures, appropriate accuracy, robustness and cybersecurity, a quality management system, conformity assessment, registration, post-market monitoring and reporting of serious incidents. Deployers also have duties, such as using systems according to instructions, assigning human oversight to competent people and, for some deployers, assessing impacts on fundamental rights.

The timetable for high-risk obligations was changed by the Digital Omnibus on AI, which was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the date for Annex III stand-alone high-risk systems from 2 August 2026 to 2 December 2027 and the date for Annex I product-embedded systems to 2 August 2028. Importantly for robotics, it took AI embedded in machinery covered by the Machinery Regulation out of the AI Act's direct high-risk rules, providing instead that the Commission may adopt AI-specific health and safety requirements under the Machinery Regulation itself. A machine's AI safety functions are therefore assessed through machinery law, discussed in lesson 5, while AI used by the same company to manage workers remains under the AI Act's employment rules.

Penalties under the AI Act reach 35 million euros or 7 per cent of worldwide annual turnover for prohibited practices, with lower ceilings for other breaches. Like the GDPR, the Act applies to providers outside the EU who place systems on the EU market and, in some cases, to systems whose outputs are used in the EU, so Canadian and American robot makers selling into Europe must comply.

Canada

Canada has no comprehensive federal AI law in force. The Artificial Intelligence and Data Act (AIDA), Part 3 of Bill C-27, would have regulated high-impact AI systems, but the bill died on the Order Paper when Parliament was prorogued on 6 January 2025. After the April 2025 election, the government appointed a Minister of Artificial Intelligence and Digital Innovation, who indicated that AIDA would not return in its old form and that future rules would aim to be light and targeted; the government consulted on an AI strategy and possible regulatory approaches in 2025 and 2026, but no general AI bill had passed at the time of writing. In the meantime, AI used in robots is governed by existing laws: OHS laws for workplace hazards, product liability and consumer protection, human rights codes prohibiting discrimination in employment and services, the Competition Act for misleading claims about AI capabilities, PIPEDA and provincial privacy laws for personal information, and sector regulators such as Health Canada for machine-learning-enabled medical devices. Quebec's Law 25 has, since September 2023, required organizations that make decisions based exclusively on automated processing of personal information to inform the person, explain on request the personal information and principal factors used, and allow the person to have the decision reviewed by a human. Ontario's Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 enables rules on AI use by public sector bodies. Federal institutions follow the Treasury Board Directive on Automated Decision-Making, and a voluntary code of conduct for generative AI systems was published in 2023.

The United States

The United States has no comprehensive federal AI statute, and federal policy since January 2025 has emphasized removing barriers to AI development, including a December 2025 executive order directing the Justice Department to challenge state AI laws seen as inconsistent with federal policy. Existing federal laws still apply: the Federal Trade Commission acts against deceptive AI claims, anti-discrimination law applies to automated decisions, and the FDA and NHTSA regulate AI in devices and vehicles. The voluntary NIST AI Risk Management Framework is widely used. Canadian robot makers selling in the United States should expect these federal laws and an evolving set of state laws to apply.

States have legislated despite federal pressure, mostly on automated decisions about people rather than on robots' physical safety. Colorado passed the first broad state AI law in 2024, covering high-risk systems used in consequential decisions such as employment, but delayed its start to 30 June 2026, and in May 2026 repealed and replaced it with a narrower law, effective 1 January 2027, focused on transparency and consumer rights for covered automated decision-making technologies: developers must document intended uses and limitations for deployers, deployers must give notice before use in consequential decisions and explain adverse outcomes, consumers may seek correction and human review, and the attorney general enforces it with no private right of action. Other states have passed laws on specific topics, such as California's 2025 transparency law for developers of frontier AI models, laws on AI in hiring such as New York City's bias audit rule for automated employment decision tools, and Illinois's amendment to its human rights law on AI in employment. A robot company that uses AI to schedule, evaluate or monitor workers in several states must track these.

Building AI governance in a robot company

Because laws differ and change, robot companies increasingly build an internal AI governance programme that meets the most demanding requirements they face and adapts as laws evolve. International standards provide structure: ISO/IEC 42001:2023 specifies requirements for an AI management system, in the way ISO 9001 does for quality, and can be certified; ISO/IEC 23894:2023 gives guidance on AI risk management; and the NIST AI Risk Management Framework offers a flexible process. For safety-relevant AI, these complement the functional safety standards of lessons 3 and 4 and ISO/IEC TR 5469 on AI in safety functions.

# A simple triage of AI uses in a robot product line against common regulatory triggers
uses = [
    dict(name="grasp planner", affects_people=False, safety_function=False, decisions_about_people=False, emotion=False, medical=False),
    dict(name="AMR person detection (safety)", affects_people=True, safety_function=True, decisions_about_people=False, emotion=False, medical=False),
    dict(name="worker scheduling and scoring", affects_people=True, safety_function=False, decisions_about_people=True, emotion=False, medical=False),
    dict(name="camera mood detection of staff", affects_people=True, safety_function=False, decisions_about_people=False, emotion=True, medical=False),
    dict(name="rehab exoskeleton gait model", affects_people=True, safety_function=True, decisions_about_people=False, emotion=False, medical=True),
]
def triage(u):
    flags = []
    if u["emotion"]:
        flags.append("EU: prohibited in workplaces unless medical/safety")
    if u["medical"]:
        flags.append("medical device rules (Health Canada / FDA / EU Annex I)")
    elif u["safety_function"]:
        flags.append("machinery functional safety; EU Machinery Regulation for ML safety functions")
    if u["decisions_about_people"]:
        flags.append("EU Annex III employment; Quebec Law 25; Colorado ADMT law; human rights law")
    if not flags:
        flags.append("internal governance only")
    return flags
for u in uses:
    print(f"{u['name']:32s} -> " + "; ".join(triage(u)))

grasp planner                    -> internal governance only
AMR person detection (safety)    -> machinery functional safety; EU Machinery Regulation for ML safety functions
worker scheduling and scoring    -> EU Annex III employment; Quebec Law 25; Colorado ADMT law; human rights law
camera mood detection of staff   -> EU: prohibited in workplaces unless medical/safety
rehab exoskeleton gait model     -> medical device rules (Health Canada / FDA / EU Annex I)

A triage like this does not decide legal questions, but it routes each use to the right experts and standards and makes sure nothing is missed. The highest-risk use in the list, emotion recognition of staff, is one a company might adopt casually as an add-on feature of a camera system without realizing it is prohibited in the EU and raises privacy and human rights concerns in Canada and the United States.

Honest claims are part of governance. Regulators in both countries have acted against exaggerated AI marketing: the US Federal Trade Commission has brought cases against companies making unsupported claims about AI capabilities, and Canada's Competition Act prohibits false or misleading representations and, since 2024 amendments, has given the Competition Bureau stronger tools against misleading claims. Describing a level 2 driver assistance system as self-driving, or a robot's person detection as guaranteeing safety, creates legal risk and, worse, encourages unsafe reliance.