The EU rules for a humanoid in your store. What applies now, and what starts in 2027.

This guide lists every date that matters, with its source, and explains who has to do what.

This is a plain-language overview as of 29 September 2026, not legal advice.

The timeline at a glance

1. Since 1989 and 2009

   Employers must assess risks when choosing work equipment, and keep it safe for its working life

   Framework Directive 89/391/EEC, Articles 5 and 6(3)(a); Work Equipment Directive 2009/104/EC, Articles 3 and 4
   The store, as employer
2. 19 July 2023

   Machinery Regulation enters into force. Most of it waits until 2027

   Regulation (EU) 2023/1230, Article 54
3. 20 January 2024

   Rules for notified bodies (the independent testers) apply, so they can get ready

   2023/1230, Articles 26 to 42
   Testing bodies
4. 13 December 2024

   General Product Safety Regulation applies, as a safety net for risks no other rule covers

   Regulation (EU) 2023/988
   Makers, importers
5. 2 February 2025

   AI Act bans apply, including AI that reads emotions at work

   Regulation (EU) 2024/1689, Article 5(1)(f)
   Everyone using AI
6. 1 August 2025

   Cybersecurity rules for internet-connected radio equipment apply. A robot on Wi-Fi is in scope

   Delegated Regulation (EU) 2022/30, as amended by (EU) 2023/2444
   Makers, importers
7. 12 September 2025

   Data Act applies. Whoever rents or leases you a connected product must tell you, before you sign, what data it generates and how you get it

   Regulation (EU) 2023/2854, Article 3(2)
   Seller or lessor
8. 27 July 2026

   AI Omnibus in force. Machinery moves to a lighter part of the AI Act; AI rules for robots will come through the Machinery Regulation instead

   Regulation (EU) 2026/1744
   Makers
9. 11 September 2026

   Makers must report actively exploited security flaws and severe incidents within 24 hours

   Cyber Resilience Act (EU) 2024/2847, Article 14
   Makers
10. 12 September 2026

    Connected products placed on the market from now on must be designed so users can reach their data

    2023/2854, Article 3(1)
    Makers
11. Today · 29 September 2026
12. 20 October 2026

    National penalties for breaking the Machinery Regulation apply

    2023/1230, Article 50(1)
    Everyone in the supply chain
13. End of 2026 (expected)

    First list of harmonised standards under the new Machinery Regulation

    European Commission
    Makers, integrators
14. 9 December 2026

    New Product Liability Directive covers robots placed on the market or put into service from this date. Software and AI count as products

    Directive (EU) 2024/2853, Article 2(1)
    Makers, importers, anyone who substantially changes a robot
15. 20 January 2027

    Machinery Regulation applies. The Machinery Directive 2006/42/EC is repealed

    2023/1230, Articles 51(2) and 54
    Makers, importers, anyone who substantially changes a robot
16. 18 February 2027

    Digital battery passport for industrial batteries over 2 kWh

    Regulation (EU) 2023/1542, Article 77(1)
    Battery makers, importers
17. 2 December 2027

    AI Act high-risk rules apply to uses listed in its Annex III, such as AI that monitors or evaluates staff

    2024/1689, Article 113, as amended by 2026/1744
    The store, but only if it uses AI that way
18. 11 December 2027

    Cyber Resilience Act applies in full, including security updates; it takes over from the radio cybersecurity rules

    2024/2847, Article 71(2); Delegated Regulation (EU) 2026/339
    Makers, importers, distributors
19. By 2 August 2028

    AI requirements added to the Machinery Regulation by delegated acts must apply. AI Act rules for AI inside regulated products start

    2023/1230, Article 8, as amended by 2026/1744; 2024/1689, Article 113
    Makers, anyone who substantially changes a robot

Planned, not yet law: the "Omnibus IV" simplification package would make the signed safety declaration digital (a web address or QR code) and add a digital contact for every maker. Council and Parliament reached a provisional agreement in June 2026; the Parliament plenary vote is indicatively set for 23 November 2026. If adopted, those changes apply 30 months after it enters into force (COM(2025) 504, procedure file).

Why 20 January 2027 matters most

The Machinery Regulation decides what has to be checked and signed before a robot starts working. It is written for machines that move, learn and connect, which the 2006 directive was not.

There is no transition period. A robot placed on the market under the old directive before 20 January 2027 can still be sold and used (Article 52(1)). Anything placed on the market or put into service after that date must meet the new rules. Industry groups asked in January 2026 for part of the cybersecurity requirements to be delayed. We have found no Commission proposal to postpone the regulation, so plan for the date as written.

What is new for a robot in a store:

• Self-learning safety needs an independent tester. If a robot's safety functions rely on machine learning that keeps evolving, the maker cannot self-certify. A notified body must assess it (Annex I, Part A, points 5 and 6). Notified bodies have limited capacity, and 2027 will be busy.
• Robots that move on their own get their own rules. Autonomous mobile machinery must take account of the area it moves through, avoid collisions when it goes to charge, and stay within its defined task and movement space (Annex III, Part 3, and section 1.2.1).
• Working near people is spelled out. The risk assessment must cover robots that share space with people, and the psychological stress they can cause. A robot must respond to people appropriately and show what it is about to do (Annex III, sections 1.1.6 and 1.3.7).
• Cybersecurity is now a safety question. Safety software must be protected against tampering and malicious attacks, and the robot must record interventions and software versions for five years. Data on safety-related decisions of self-learning systems must be kept for one year (Annex III, sections 1.1.9 and 1.2.1).
• Paperwork lasts ten years. The technical file and the signed declaration must be kept for at least ten years, and instructions can be digital (Article 10).

The standards are still catching up. No harmonised standards are listed under the new regulation yet; the European Commission expects the first list before the end of 2026. The updated industrial robot standards, EN ISO 10218-1 and -2:2025, were cited in September 2026, but under the old directive (Implementing Decision (EU) 2026/2015). The revised service robot standard, ISO 13482, is at final draft (ISO). The first standard for legged and other dynamically stable industrial robots, ISO 25785-1, is still a committee draft (ISO). For a humanoid in a store, that means no single standard gives an easy route. The risk assessment for your site carries more of the weight.

When a change makes someone the manufacturer

This is the part most store owners have not heard about.

The regulation calls it a substantial modification: a physical or digital change, made after the robot was put on the market, that the maker did not foresee and that creates a new hazard or raises an existing risk so that new guards or protective measures are needed (Article 3(16)). Whoever makes that change is treated as the manufacturer and takes on all the maker's duties: risk assessment, technical file, conformity check, signed declaration and CE marking (Articles 10 and 18). The only exemption is for a non-professional changing a machine for their own use. A store is not exempt.

In a store, changes that could qualify:

• fitting new grippers, arms or sensors the maker did not plan for,
• loading different control software, or retraining the robot for a new kind of job,
• moving a robot from the back room to the aisles, among customers,
• swapping in a different model with a different safety setup.

Everyday work usually does not: setting routes, planning shifts, or repairs with original parts.

The same logic runs through the other rules. Under the Product Liability Directive, whoever substantially modifies a product outside the maker's control becomes liable as its maker (Article 8(2)); we explain that in who is liable when a robot in your store causes harm. Under the Cyber Resilience Act, an importer or anyone else who substantially modifies a product takes on the maker's cybersecurity duties (Articles 21 and 22).

The AI Act: what it does and does not ask of a store

The AI Act changed in July 2026. The short version for a store owner:

• Already banned: AI that infers the emotions of people at work, except for medical or safety reasons (Article 5(1)(f), since 2 February 2025).
• AI inside the robot is regulated through the Machinery Regulation. The AI Omnibus moved machinery to a part of the AI Act where most high-risk rules do not apply directly. Instead, the Commission must add AI requirements to the Machinery Regulation through delegated acts that apply by 2 August 2028. Those land on the maker, or on whoever substantially modifies the robot.
• Your own duties start only if you use AI on your staff. If a store uses AI to allocate tasks based on behaviour, or to monitor and evaluate staff, that is a high-risk use under Annex III from 2 December 2027. The store would then have to assign trained people to oversee it and inform staff and their representatives before using it (Article 26(2) and 26(7)).

If the robot's AI only does store work, such as restocking, scanning or patrol, and is not used on your staff, these duties do not arise.

Cybersecurity, data and batteries

• Cybersecurity. A robot that connects to Wi-Fi has had to meet the radio cybersecurity rules since 1 August 2025. From 11 December 2027 the Cyber Resilience Act takes over: security built in, vulnerabilities handled, security updates supplied. The importer must check that the maker has done its part before the robot is sold or rented in the EU (Article 19). Most humanoids are made outside the EU, so the importer matters.
• Data. Under the Data Act, whoever rents you the robot must tell you, before you sign, what data it generates, where it is stored, for how long, and how you can access or delete it (Article 3(2)).
• Batteries. From 18 February 2027, industrial batteries over 2 kWh need a digital battery passport. That is a duty for the battery maker or importer, not for the store.

What stays with you as the store

Some duties cannot be handed to anyone else. An employer stays responsible for the safety of its staff even when it brings in outside experts (Framework Directive, Article 5).

You sign these. The question is who does the work behind them.

Who does what when you rent from ovibot

Why it makes sense to let ovibot handle it

A robot you can swap, move or update is a robot that changes. The rules treat a substantial change as a fresh start: new risk assessment, new safety file, a new signature. That is fine if one party owns every change. It gets expensive and risky when a maker, an installer and a store each touch the robot, and nobody is sure who signed last.

That is why we built the contract around it.

• One party signs, every time the robot changes. We pick, install, certify and run the humanoid, and every change is made by us or by partners working as our subcontractors, so your store never becomes the robot's manufacturer. When you swap to another model at month 12 or 24, or move the robot to another store, we redo the paperwork at our cost. It is in the monthly fee.
• AI and safety layers, certified. AI is part of how a humanoid learns and does store work, and fitting a robot safely into a real store will often mean adding safety layers. Both can trigger a new conformity check, and where AI plays a role in a safety function, an assessment by a notified body. We take responsibility for that certification, whichever maker built the robot.
• One record for the whole life of the robot. Installation, updates, software versions, inspections and swaps, kept for as long as the rules ask. If something goes wrong, the evidence exists, and you can see it.
• Your own paperwork done for you. The rules that stay with you still need doing. We prepare the risk assessment input, inspection record, staff briefing, notices and GDPR impact assessment in whatever language your staff need. You read it and sign.
• Sensitive data kept out, and local if you want it. Our software filters sensitive data out before anything is stored. If you prefer, your data is processed and stored locally, inside your store. Our team only connects remotely when a robot needs an operator to step in.
• Your data stays yours. You can export it any day, free of charge.

The rules will keep moving: standards are due by the end of 2026, AI requirements for machinery by 2028, and the simplification package is still in negotiation. Keeping up with that is our job, not yours.

Questions to ask any robot supplier

Frequently asked questions