Robotics & Physical AI
Where the physical world meets algorithms. Legal support at the interface between machinery, data and responsibility.
The matter at hand
An interdisciplinary matter at the intersection between technology and law
Robotics, artificial intelligence (AI) and cyber-physical systems (CPS) are shaping the digital transformation of the economy and society. They combine machine intelligence, sensor technology and networked data processing to create autonomous or semi-autonomous systems that physically interact with their environment and adapt independently to new conditions. Applications range from industrial automation, intralogistics, defence and security and medical and care technology to everyday mobility, energy supply and smart devices.
Whilst robotics focuses on the physical operation of mechanical systems, AI concentrates on data-driven decision-making and learning processes; cyber-physical systems act as a bridge, linking digital models with real-world actuators and sensors in real time. As autonomy increases, legal and ethical questions come to the fore:
- Who is liable if a learning machine makes the wrong decision?
- How should the data collected be used and protected?
- And what framework conditions promote innovation without jeopardising security or fundamental rights?
Robotics & Physical AI is therefore not an isolated area of law, but an interdisciplinary matter. It combines product safety, AI regulation, liability, IT security, data protection and data law, IT contract law and competition law — and requires an interdisciplinary approach across the entire innovation cycle.
Comprehensive support — from the initial idea to international scaling
We support companies in developing, implementing and commercialising robotics, AI and CPS technologies. Our interdisciplinary team combines expertise in technology, intellectual property, data and data protection, liability and regulatory law, and develops practical solutions throughout the entire innovation cycle. In addition, we advise on transactions and financing (due diligence, M&A, joint ventures, interests), CE marking, conformity assessment and communication with authorities, as well as on dispute resolution and litigation. For cross-border projects, we draw on the CMS network in over 50 countries.
The wave of regulation
A whole host of new EU regulatory frameworks are coming into force almost simultaneously
Physical AI / Embodied AI is one of the first areas in which several new European regulatory frameworks are being introduced within the space of a few years. The AI Act (Regulation (EU) 2024/1689) addresses high-risk AI; the new Machinery Regulation (Regulation (EU) 2023/1230) explicitly covers AI components, cybersecurity and human-robot collaboration (HRC) for the first time; the Cyber Resilience Act (Regulation (EU) 2024/2847) requires "security by design" and structured vulnerability management; the new Product Liability Directive (Directive (EU) 2024/2853) explicitly classifies software and AI as "products". These are complemented by the Data Act (Regulation (EU) 2023/2854) for connected products, NIS2 (Directive (EU) 2022/2555) for the IT security of operators, as well as data protection law (GDPR/German Federal Data Protection Act (BDSG)) and unfair competition law (German Unfair Competition Act (UWG), keyword "AI washing").
Physical AI touches on several areas of law at once
| Pillar | Focus |
| Data protection & data law | Data on board. GDPR/German Federal Data Protection Act (BDSG) for camera, audio and sensor data; the Data Act and data licensing for connected robots, e.g. for training foundation models. |
| IT contract law | Contracts & models. SLA, licensing, open-source compliance, "Robotics as a Service" and IP structuring. |
| Liability | Who is liable? Product liability and product monitoring in relation to autonomous and learning systems; supply chain and evidential issues. |
| IT security | Security by design. NIS2 and CRA: vulnerability management, reporting channels and evidence in technical documentation. |
| Product safety & conformity | CE & conformity. Machinery Regulation, AI Act, conformity assessment, CE marking and harmonised standards. |
| Competition | Fair statements. German Unfair Competition Act (UWG) and "AI washing": misleading claims about autonomy, security and compliance in marketing. |
In day-to-day consultancy practice
Questions that arise for manufacturers, integrators and operators
- Who owns the data generated by connected robots and what obligations regarding access and portability arise under the Data Act?
- How should the processing of camera, audio and sensor data be organised in accordance with data protection regulations?
- Which players in the life cycle – manufacturers, integrators, operators – have which obligations?
- When is a robot considered a high-risk AI system and how do the AI Act and the Machinery Regulation interact?
- Who is liable if an autonomous or learning system causes damage?
- What requirements do the CRA and NIS2 set out regarding cybersecurity, "security by design" and reporting channels?
- Which contracts (development, service, supply, end customers) need to be amended? What new sales models are emerging (e.g. "Robotics as a Service")?
- How can statements regarding autonomy, security and CE conformity be formulated in a legally compliant manner?
- What specific rules apply in the defence sector (AI Act exemption, dual-use, export control)?
- What deadlines are coming up and when – and how can these be turned into a robust compliance roadmap?
Building the legal stack for Physical AI.
Legal experts for Robotics & Physical AI
Local market knowledge. Global outlook
We provide future-facing legal advice to help your organisation thrive. Combining local market knowledge and a global perspective, and with lawyers in locations worldwide, your organisation benefits from the expertise it needs, even across borders.
About CMS