A $4,900 robot: compliance is no longer a problem for the future
This week the humanoid robot market takes a leap that changes the rules of the game. The Unitree R1 — 1.23 metres tall, 29 kg, able to run, do somersaults and respond to voice commands — is available for shipping at a price of $4,900, on consumer platforms such as AliExpress. We are no longer in the realm of six-figure laboratory prototypes: this is an item a company can buy with an ordinary office purchase order. And it is not alone. The Agibot A2 passed 5,100 units delivered in 2025; UBTECH's Walker S2 already operates on production lines 24/7; in China there are over 140 manufacturers, with the goal of deploying up to 100,000 humanoids in factories by the end of 2026.
When a company can consider buying a humanoid robot as an operational asset, compliance stops being an academic topic and becomes an immediate governance issue. European businesses weighing the purchase of a humanoid robot must contend with a complex regulatory framework covering personal data protection, product safety, health and safety at work, civil liability and European artificial intelligence law. In this article we focus on the two regimes that most affect the governance of humanoid robot use: the GDPR (Reg. EU 2016/679) and the AI Act (Reg. EU 2024/1689). The prohibited AI practices have applied since 2 February 2025, while the obligations for GPAI models have applied since 2 August 2025; the general regime of the AI Act becomes fully applicable on 2 August 2026, with some further exceptions for certain high-risk systems.
Not just any software
A humanoid robot moves through the physical environment and has cameras, microphones, proximity sensors, and often voice and facial recognition modules. It collects personal data even without the operator being fully aware of it — simply by "seeing" and "hearing" while carrying out its primary function.
The volume and sensitivity of the data processed depend on the context of use. A robot used in a warehouse, where it interacts with a few operators in a controlled environment, will have a relatively limited impact on data protection: the cameras serve for navigation, the microphones for receiving operational commands. The case of a robot at reception or working as a help desk is very different: there the robot interacts with a continuous flow of people — visitors, customers, suppliers, candidates — filming their faces, recording their voices, processing their natural-language requests. It may end up processing identification data and, if it uses specific technical processing for unique identification, also biometric data; in some cases it might even infer or process data on emotional state. The number of data subjects, the variety of data categories and the difficulty of obtaining truly informed consent grow exponentially. There is no single compliance step valid for every use: the analysis must start from the specific context. For GDPR purposes, images and footage of faces are not automatically biometric data in the "strict" sense: they become so when they result from specific technical processing and are used to enable or confirm the unique identification of the person.
GDPR compliance
Before switching the robot on, the data controller must be clear about which data the device will collect, why and on what legal basis. Every active sensor must serve a specified, explicit and legitimate purpose. If the camera is there for autonomous navigation, it cannot also be used for other purposes without a separate analysis. If the robot uses facial recognition to uniquely identify people, we are in highly problematic territory, with the general prohibition on processing biometric data and the exhaustive exceptions that accompany it. More precisely, Article 9 GDPR comes into play when biometric data are processed to uniquely identify a natural person.
Meeting the information obligation poses a specific practical challenge. How do you inform a visitor entering an environment where a humanoid robot operates? The EDPB Guidelines 3/2019 point the way: visible signage, layered notices with a concise first layer referring to the full notice, and — in the case of a robot that interacts directly — an initial communication declaring the presence of active cameras and microphones.
The DPIA (Art. 35 GDPR) will be mandatory in most cases. A humanoid robot in a business environment combines systematic monitoring, the use of new technologies, potentially large-scale processing and the possible involvement of biometric data — two of these criteria are enough to trigger the obligation. The DPIA must be carried out before commissioning and updated periodically. In particular, where biometric technologies or advanced forms of video surveillance are involved, the EDPB stresses the need to comply strictly with the principles of necessity, proportionality and minimisation.
An often underestimated issue is that of suppliers and data flows abroad. The robot manufacturer, the AI platform provider and the cloud provider should not all be put in the same bucket: some may process data on the company's behalf, following its instructions; others may act for their own activities, such as technical support, maintenance, security or infrastructure management. For this reason, before putting the robot into operation, you need to understand precisely who does what, which data pass through each party and with what contractual safeguards. If data then leave the European Economic Area, you must check to which countries they are transferred and which protection tools apply; in the absence of an adequacy decision, the safeguards provided for in Chapter V of the GDPR come into play, such as standard contractual clauses and, if necessary, a Transfer Impact Assessment.
There is also an aspect that deserves particular attention. Current Chinese humanoid robot models were designed for a rapidly expanding global market, with declared priorities on performance, price and production speed. This does not mean they are incompatible with the European framework, but it does mean they must undergo a careful analysis to assess their compliance with the requirements of privacy by design and by default (Art. 25 GDPR): which data do they collect by default? Can unnecessary sensors be disabled? Can data flows be limited to the bare minimum without compromising functionality? Do the factory settings respect the principle of minimisation? These are questions the controller must answer before the purchase, not after.
Finally, the principles of minimisation and storage limitation require attention at the design stage. If the camera is used for navigation, the images should not be retained beyond real-time processing. The temptation to "collect everything because it might come in handy" is particularly strong with a device that has eyes, ears and memory: it is exactly the temptation the GDPR asks us to resist.
The AI Act: what to do
The AI Act does not regulate the robot as a physical machine, but the artificial intelligence systems that power it — and a humanoid robot typically embeds more than one: locomotion, computer vision, natural language processing, possibly emotion recognition. Each must be assessed separately for the purposes of risk classification.
Some applications have been prohibited as a general rule since 2 February 2025: these include emotion recognition in the workplace and in educational institutions, except for medical or safety reasons. Social scoring is also prohibited. A robot in a company's lobby that analysed employees' mood in order to flag who appears "unmotivated" would fall under the prohibited practice. This is not science fiction: it is a feature that some manufacturers already offer and that European law has decided to ban.
Many uses will qualify as high-risk, in particular when the robot is used in worker management or in access to essential services. For these systems the AI Act requires a risk management system, governance of training data, technical documentation, logging, transparency and above all human oversight: an operator must be able to understand the robot's capabilities, monitor its operation and stop it at any time.
Even where a system is not high-risk, the transparency obligations under Art. 50 still apply: people interacting with the robot must know that it is an AI system. A humanoid robot is recognisable as a machine, but if it handles phone calls or sends emails, the obligation to declare the artificial nature of the interlocutor becomes fully operative again. If the device is then powered by a GPAI model, the Chapter V obligations fall on the provider of the general-purpose AI model; the provider of the AI system relies on the information supplied under Art. 53(1)(b). The deployer, for its part, has every interest in carrying out careful due diligence on the integrated GPAI model: it is not a formal obligation on its side, but it is a precaution no company should neglect.
Before switching the robot on
Anyone intending to adopt a humanoid robot should follow an orderly sequence. The first step is to map all the device's sensors and AI modules, establishing for each which data it collects, where it sends them, who processes them — and to classify each AI system according to the AI Act categories. The documentation follows from this: privacy notices, record of processing activities, DPIA, agreements under Art. 28, and a Transfer Impact Assessment where applicable. For high-risk systems, it is necessary to verify the supplier's technical documentation, set up human oversight and distinguish precisely between the obligations of the provider and those of the deployer.
Internal governance is the glue: designate who oversees the robot, who handles incidents, who responds to data subjects' requests. Train staff. Update the company policy on AI use and, where applicable, integrate the process with the NIS2 framework for security incident management. Monitor continuously with periodic audits and a review of the DPIA at every change to the firmware or AI models.
The price falls, the complexity rises
A humanoid robot for less than $5,000 removes the economic barrier to entry. But the regulatory barrier remains intact — indeed, with the AI Act, it gets higher. The real risk is buying a robot because it "costs little" and discovering that making it run in compliance requires an investment in analysis, documentation and governance that far exceeds the purchase price.
The good news is that the GDPR and the AI Act, read together, offer a coherent framework. Those who already have maturity in data protection will find in the AI Act a natural extension of the principles they already apply. The humanoid robot does not change the rules of the game: it makes them more visible, and more urgent.
In the interest of transparency, we should point out that: the regulatory framework is evolving. It cannot be ruled out that in the coming months new European provisions specific to embodied robotics will arrive, or that the Italian Data Protection Authority (the Garante) will publish dedicated guidelines or decisions. With this article we chose to move early, starting from the regulatory instruments already in force and applicable today. If and when the framework is updated, we will update these pages too.