Physical AI, Chapter 8: Safety, Trust, and Regulation

This is Part 8 of a series walking through my book Physical AI: Engineering Embodied Intelligence for the Real World. In the previous chapter, we fit the policy onto the robot. This one is about what happens when it is wrong.

A software bug in a chatbot produces an embarrassing reply. A software bug in a humanoid produces a collision. A cyberattack on a recommender produces biased outputs; a cyberattack on an autonomous warehouse produces injured workers. That translation — from digital failure into physical hazard — is the fact the entire safety, trust and regulatory apparatus of Physical AI is built around, and it moves the engineering discipline from testing to safety assurance.

Robotics has had decades of practice at this: torque limits, mechanical hard stops, fail-safe brakes, fenced cells, light curtains, safety-rated controllers. What is new is that the source of the motion is no longer a hand-written program whose behaviour can be enumerated but a learned model characterised only statistically. The old apparatus is necessary and no longer sufficient. A fence still keeps people away from the robot; it says nothing about whether the robot inside is going to do what its operators expect.

Monitors, fallbacks, and an argument you can audit

The engineering answer has three parts. Runtime monitors run alongside the policy and are deliberately simpler than it, so that their own behaviour can be characterised: an action-distribution monitor flagging outputs outside the trained distribution, a perception-consistency monitor checking that depth agrees with RGB and that the IMU agrees with apparent camera motion, a proprioceptive-consistency monitor comparing actual motion against commanded (the most reliable of the four, because the underlying physics is well understood), and a watchdog on loop timing.

Fallbacks form a hierarchy rather than a switch: clamp the action to the nearest in-distribution sample; return to a pre-validated rest pose; execute an ISO 10218 Category 1 controlled stop; cut power. Degraded-mode operation — falling back from VLA-driven behaviour to a hand-coded library of safe ones — has become common precisely because those low-level controllers still represent real useful capability.

And assurance cases tie it together into a structured argument, in Goal Structuring Notation, that the system is safe for a stated operational design domain. Here the learned model forces a compromise: it cannot be formally verified, so the case rests on statistical evidence about the model, envelope evidence that the monitors bound its outputs, and structural evidence that a non-learned safety layer catches what the model gets wrong.

The rules, and the adversary

The chapter maps the regulatory terrain in detail — the EU AI Act with its high-risk obligations applicable from August 2026 and fines reaching 7% of global turnover, the Machinery Regulation it interlocks with, the revised Product Liability Directive extending liability to AI components, against the US patchwork of Colorado’s SB 24-205, the aftermath of California’s SB-1047 veto, NYC Local Law 144 and federal sectoral regulation — and then the standards layer where compliance is actually achieved: ISO 10218, ISO/TS 15066 with its biomechanical force and pressure limits, ISO 26262, ISO 21448 (SOTIF), SAE J3016, IEC 61508 and 62443.

Then the adversarial dimension, where failure is caused rather than suffered: adversarial patches that survive printing and photographing, backdoor attacks needing only a few percent of poisoned training data to produce a model that is indistinguishable from clean under standard evaluation, communication-channel attacks whose consequence is physical, and supply-chain compromise. The chapter closes with a full safety configuration for a humanoid in a collaborative cell — ODD, motion envelope, separation monitoring, four monitors, a four-level fallback hierarchy, intent signalling, cybersecurity posture, assurance record — and the wrapper that enforces it, small enough to inspect and conservative enough to predict.

Tomorrow: enough theory. Chapter 9 goes industry by industry — healthcare, manufacturing and logistics, autonomous driving, agriculture and surgery — and asks what is actually deployed and what is still a video.