For 18 months, AI-driven machinery needs robustness evidence that no standard yet defines.
Regulation (EU) 2023/1230 applies from 20 January 2027. The delegated acts that carry the AI robustness requirements into its Annex III apply by 2 August 2028. Between those two dates an AI policy driving a safety function is in scope and un-specified: the obligation exists, and the AI-specific harmonised standard you would normally test against does not.
That interval is the subject of this page. Until such a standard exists, showing that an AI safety function resists manipulation means bringing your own measured evidence, produced against a protocol you chose and can defend.
How the gap opened, step by step
None of this is a forecast. Every step below is a published instrument with a citation, and each is recorded with its primary source and a verification note on the regulatory clock.
- — the Regulation applies. Regulation (EU) 2023/1230 replaces Directive 2006/42/EC and binds all 27 member states with no national transposition. Safety components with fully or partially self-evolving machine-learning behaviour are high-risk machinery under Annex I; Annex III requires safety-related control systems to resist deliberate manipulation.
- — the AI Act amendment lands. Regulation (EU) 2026/1744 is published in the Official Journal and enters into force on . It moves Regulation (EU) 2023/1230 from Annex I Section A to Section B of the AI Act, so most AI Act high-risk provisions stop applying directly to machinery.
- The requirements move into the Machinery Regulation. The same amendment requires the Commission to adopt delegated acts amending Annex III of Regulation (EU) 2023/1230 to carry the AI robustness requirements across. Those apply by .
- Article 20(10) bridges the interval — it does not close it. Until harmonised standards or common specifications are referenced under the Machinery Regulation itself, a high-risk AI system that complies with those referenced or adopted under Articles 40 and 41 of Regulation (EU) 2024/1689 is presumed in conformity with the Annex III essential health and safety requirements as regards high-risk AI systems.
“Until harmonised standards or common specifications are referenced or adopted pursuant to this Article as regards high-risk AI systems, high-risk AI systems within the scope of this Regulation which comply with the relevant harmonised standards referenced, or common specifications adopted pursuant to Articles 40 and, respectively, 41 of Regulation (EU) 2024/1689 shall be presumed to be in conformity with the essential health and safety requirements set out in Annex III to this Regulation as regards high-risk AI systems.”
Read that closely and the gap is in the wording. The bridge is conditional on standards existing under the AI Act for the thing you are building. Where one does — and for adversarial robustness of an embodied policy, today, it does not — you inherit a presumption of conformity. Where it does not, the obligation still applies and you are producing the evidence yourself.
If you build a humanoid, the standard for your machine is not written either.
Robotics: safety requirements for dynamically stable industrial mobile robots (legged, wheeled, or other forms of locomotion) — Part 1: Robots is the first Type‑C standard aimed at robots that stay upright by continuously controlling balance — the balance-and-fall hazards a legged machine has and a statically stable one does not. It is at Committee Draft. CD registered 8 May 2026; CD consultation opened 12 May 2026. No fixed publication date.
So a humanoid builder placing a machine on the EU market has ISO 10218-1 and -2:2025, and nothing else that speaks to dynamic stability. The two gaps are independent and they overlap: no AI-specific harmonised requirement under the Machinery Regulation until 2 August 2028, and no published Type‑C standard for the machine category at all.
Stage read from the ISO catalogue on 19 September 2026. iso.org blocks automated fetching, so this one is weaker than the EUR-Lex citations above and is recorded as such on the clock. Verify the live ISO record before relying on it — a draft standard’s timetable moves, and this site carried the previous stage (Working Draft) for months. ISO catalogue ↗
What changes for AI-driven machinery
Annex III 1.1.9 and 1.2.1: the two requirements that speak to an AI safety function
1.1.9, protection against corruption: safety-related software and data resist accidental or intentional modification, and interventions in the safety software are logged. 1.2.1, safety and reliability of control systems: the control system withstands intended and reasonably foreseeable malicious attempts, and a control system with fully or partially self-evolving behaviour keeps the machinery inside its defined task and movement space. From 20 January 2027 every machine placed on the market must meet the Annex III requirements that apply to it, 1.1.9 and 1.2.1 among them, whether or not it is in a high-risk category. A policy that leaves its envelope under a reframed instruction is a measurement against both.
The Product Liability Directive runs beside it
Directive (EU) 2024/2853 treats software and AI systems as products. For products placed on the market or put into service after 9 December 2026, a claimant no longer proves the mechanism, and a court may presume defectiveness where the manufacturer fails to disclose relevant evidence. A dated, reproducible robustness measurement in the technical file is relevant evidence of the kind that duty covers; it is not a defence and not a determination of defectiveness.
Security is a lifecycle duty
Cybersecurity measures and updates must be maintained across the machine’s working life, interventions in safety software logged, and the technical documentation kept for at least 10 years after the machine is placed on the market.
The minority case: Annex I Part A and the notified body
Safety components with fully or partially self-evolving behaviour using machine-learning approaches ensuring safety functions (Annex I Part A point 5, verbatim from CELEX 32023R1230) and machinery with such a system embedded (point 6) take the third-party conformity-assessment route of Article 25(2) via Article 6(1): a notified body reviews the technical documentation, including the evidence that safety functions resist manipulation. Which point applies is a determination about what you place on the market; Part B point 19 is the Article 25(3) sibling and is not interchangeable with either.
Every regulatory date on this page is published as a dated, source-linked record at /regulatory-clock, with the primary source for each and what a Provael run does not establish for it.
The application date, 20 January 2027, is set by Article 54 as corrected by the Corrigendum of 4 July 2023; some secondary sources still cite an incorrect January date.
What the regulation demands, and what Provael emits
Provael does not make you compliant: a conformity assessment is the manufacturer’s and the notified body’s job. It produces machine-readable robustness evidence for that assessment, on the AI layer specifically: the layer the other safety stacks do not reach.
| What the regulation demands | The evidence Provael emits |
|---|---|
| Robustness evidence for the AI safety function | A measured attack-success rate with a 95% confidence interval and a benign control, on your own policy. |
| Attack-resistance testing | 8 families measured on a real policy; 1 separates from the benign floor; 17 registered; the other 9 are stub-validated only. Each family is mapped to an Embodied AI Security Top 10 risk. |
| Machine-readable findings | SARIF findings that drop straight into GitHub code scanning, plus an attestation over the evidence bundle that can carry a verifiable Ed25519 signature. |
| Conformity documentation | A compliance crosswalk (JSON + Markdown) mapping a run to this Regulation’s Annex III, EU AI Act Art. 9 / 15 / 72, ISO 10218:2025, NIST AI RMF and IEC 62443. |
| Vulnerability handling | A published SECURITY.md with a 90-day coordinated-disclosure policy, and a CycloneDX ML-BOM generated by the tool. |
The headline result: 42 of 50 episodes left the keep-out envelope under a roleplay instruction (task-clustered 95% CI 62-100%) against 1 of 50 benign; the same frame with no target named does it in 27 of 30, so this is fragility, not steering. SmolVLA (HuggingFaceVLA/smolvla_libero) × libero_object (all 10 tasks), 5 seeds per task, LIBERO · robosuite · MuJoCo — simulation only, default (uncalibrated) predicate, provael 0.41.2. Evidence, not certification. See exactly what is measured →
Manufacturers and integrators placing AI-driven machinery on the EU market
Regulation (EU) 2023/1230 binds the manufacturer that places AI-driven machinery - or a safety component with self-evolving behaviour - on the EU market, and the integrator who assembles a machine and places it under their own name.
The nuance: if you build the VLA policy or the safety component, but another party places the finished machine on the market, the conformity obligation sits with that manufacturer or integrator - not automatically with you. They will still ask you for the evidence that your component’s safety function resists manipulation. Whether you are the OEM or the component maker, that robustness evidence has to exist before the machine is placed on the market.
See what the evidence looks like.
The sample report comes from a public run, published in full. Or request a free scan: name the checkpoint you ship, and we run the same measurement with you, in your CI and in simulation, and send back a scorecard and SARIF, with no IP touched.
Running an AMR or AGV fleet? Whether you sit under this regulation or under UN R155 and R156 type approval depends on how the machine is classified, and the second clock has already run: R155 has applied to new vehicle types in the EU since 6 July 2022. The automotive and logistics segment page →
Not legal advice. This page is dated editorial data, not a legal opinion. Dates last verified against EUR-Lex, the EU Council (Consilium) and ISO on 19 September 2026 (ISO stage 19 September 2026) - confirm the live official text before relying on it. Provael is an offensive-security tool for systems you own or are authorized to assess. See the full framework crosswalk and the documentation.