Before selling a humanoid robot in Spain, a manufacturer will have to demonstrate compliance, prepare technical documentation, guarantee continuous human oversight and register the system in a European database. That is the conclusion of Sonke Lund in an analysis published on the website of the law firm Ecija, which sets out the legal framework facing companies that want to bring these machines to market.
The starting point is no longer science fiction. In Spain, the CSIC, the public research body, is developing TEO, a humanoid robot designed to assist people. Several hotel chains and airports already use robots to greet the public.
Most humanoid robots are “high risk” under the EU AI Act
According to Lund, the European regulation on artificial intelligence, the AI Act, follows a simple logic: the more dangerous a system, the more obligations it carries. Most humanoid robots would fall into the “high risk” category, which requires risk management, high-quality training data, and a high level of robustness and cybersecurity.
The author stresses the requirement for effective human oversight: an operator must be able to understand what the system is doing, intervene and, if necessary, stop it. Lund links this design obligation to Asimov’s laws of robotics, which he uses as a common thread throughout his analysis. The rules take effect in stages between 2025 and 2027.
Three Spanish laws that apply to robot sales but were not written for them
Beyond the AI Act, the analysis identifies three areas of Spanish law that already apply to the sale of these machines, even though they were not designed for that purpose.
- Product safety, originally conceived for conventional consumer goods, not for machines that learn and react in unexpected ways.
- Civil liability for defective products, whose application to AI will raise questions until the future European directive on AI liability is transposed.
- Data protection, where the GDPR requires data minimisation, purpose limitation and proactive accountability. Lund notes that the AEPD, the Spanish data protection authority, has already fined technology companies in this area.
Intellectual property and liability across the supply chain
The article also covers the intellectual and industrial property rights attached to these machines. Embedded software is protected by copyright, algorithms can be protected as trade secrets, technical inventions can be patented subject to certain conditions, and the physical appearance of a humanoid robot can be registered as an industrial design.
The most complex question, according to Lund, arises if the robot produces an original creation on its own: for now, only a human being can be an author, a principle that technological progress may eventually call into question.
On liability, the AI Act divides obligations between the manufacturer, deployer, importer and distributor, which requires companies to put in place compliance programmes covering AI risks, including the criminal liability of legal entities. In practice, the author says, this means post-market monitoring, corrective action when defects arise, up-to-date cybersecurity, and distribution contracts that provide for technical warranties, a clear allocation of responsibilities, software updates and appropriate insurance.
A legal framework still being written
Lund concludes that Spain faces a regulatory puzzle whose pieces come from different boxes: who pays if a robot causes damage while acting on its own, and whether specific technical standards or mandatory insurance are needed. None of these questions has a settled answer. His advice to companies: work out which rules apply to them, build privacy protection in from the design stage, and prepare before entering a market whose rules are being written in real time.