AI is profoundly transitioning from an "information processing tool" to a "physical action agent." Its security risks have broken through the inherent boundaries of traditional cyberspace, forming a new risk paradigm of "virtual attack trigger—algorithmic decision failure—physical harm realization."
Currently, China has shortcomings in scenario-based security control, multimodal data compliance, tiered access certification, and in-process and post-event liability determination. The deep-rooted causes lie in the lag of legal adaptation to rapid technological iteration, multi-departmental management, and insufficient coordination of security responsibilities across the industrial chain. There is an urgent need to build a tiered regulatory system based on risk levels and application scenarios, refine data classification and ownership confirmation along with compliance guidelines, improve interdisciplinary standards and unified testing certification, strengthen full-lifecycle security control, and clarify the responsibility sharing among developers, manufacturers, and operators. Meanwhile, tools such as regulatory sandboxes and mandatory insurance should be explored to promote algorithm traceability and technology ethics review, balancing innovation and risks to safeguard the healthy development of the industry.
Four Aspects of Problems Highlight the Insufficient Regulatory Governance of China's Embodied AI Industry
Security Control: Shortcomings in Physical Security Control and Insufficient Scenario Risk Prevention and Control
Traditional industrial robot safety specifications mainly focus on hardware security such as mechanical and electrical aspects, lacking targeted control rules for large model decision anomalies, model hallucinations, and unexpected actions in dynamic environments. Embodied AI possesses the dual attributes of "autonomous decision-making + physical execution." Large model hallucinations and algorithm drift may translate into unexpected actions of physical mechanisms, posing risks of personal injury. Currently, embodied AI technology is still in a period of rapid development. Core technical paths such as large models and motion control are continuously iterating, posing extremely high requirements for the flexible updating capability of standards. From the perspective of differentiated scenario control, different environments have varying degrees of structuring, but a safety specification system matching scenario risk levels has not yet been formed. For example, in industrial scenarios, embodied AI in human-robot collaborative production lines lacks dynamic safety isolation and abnormal behavior circuit-breaker specifications. In service scenarios such as elderly care, mall shopping guides, and domestic humanoid robots, there is a lack of human-robot interaction boundary management. Meanwhile, security audit control for secondary development of open-source models and access of third-party algorithm plugins is weak, and risks may spread along the chain of components—models—complete machines.
Data Compliance: Multimodal Data Compliance Governance, Scenario Data Ownership, and Circulation Rules Need to Be Improved
Embodied AI is equipped with multimodal sensors such as vision, acoustics, and touch, enabling 24/7 uninterrupted continuous perception. It continuously collects massive amounts of information such as faces, voiceprints, human postures, environmental images, and on-site working conditions, giving rise to new privacy and data security risks caused by imperceptible collection. First, data collection lacks institutional basis. China has not yet issued special implementation rules for continuous imperceptible environmental data collection by mobile robots, and compliance boundaries such as informed consent, data retention scope, and automatic capture trigger conditions are relatively vague. Second, the data ownership system needs to be improved. For example, in industrial scenarios, regarding production process parameters and production line working condition data collected by embodied AI, there is still a lack of targeted institutional norms on data ownership and usage rights among enterprises, equipment manufacturers, and algorithm service providers. Third, the compliance governance mechanism is not sound enough. Compliance management such as data annotation traceability, anonymization processing, and dataset security evaluation for training data needs to be improved. For instance, home robots are equipped with a large number of cameras and sensing sensors, and will collect massive amounts of family privacy and user health data during operation. The security protection system in the industry's data storage, transmission, and usage links is imperfect, posing hidden dangers of data leakage and resulting in high compliance operation costs for enterprises.
Industry Access: Industry Access Mechanism and Testing Certification System Need to Be Improved
First, access classification standards still need continuous improvement. The embodied AI standard system covers multidisciplinary fields such as machinery, electronics, AI, materials, and safety ethics. There are mechanism barriers in collaborative compilation and implementation across disciplines and industries. At this stage, China has not yet established a tiered access list system based on risk levels and application scenarios, making it difficult to implement differentiated access control for products in different scenarios, which may lead to insufficient access constraints for high-risk embodied AI products. Second, the product certification system still needs improvement. Domestically, there is a lack of unified safety testing and certification agencies for general embodied AI complete machines. Meanwhile, standardized evaluation methods for algorithm trustworthiness, dynamic scenario robustness, and adversarial attack resistance are not yet sound, and the supply of relevant evaluation tools is insufficient. Testing is mostly concentrated on hardware security dimensions such as electrical and mechanical hardware, making it difficult to effectively identify and verify new security risks caused by AI autonomous decision-making.
In-Process and Post-Event Supervision: Liability Determination and Disposal Mechanisms Need to Be Sound
The current product liability legal system needs to fully adapt to the new characteristics of embodied AI's continuous autonomous learning and algorithm iteration. The relevant accident chain may involve multiple entities such as algorithm developers, complete machine manufacturers, operation service providers, and scenario users. The liability boundaries of all parties are relatively vague. Meanwhile, supporting mechanisms such as advance compensation and mandatory robot liability insurance are not yet sound. Once personal injury accidents occur, there are obstacles in traceability evidence collection and loss compensation disposal. In addition, for behaviors such as illegal algorithm iteration, illegal data collection, and unlicensed deployment in high-risk scenarios, there is a lack of refined regulatory means such as tiered penalties, product recalls, and remote operation restrictions. For embodied AI products that continue to iterate after being put into use, the capability of dynamic risk identification and control remains insufficient.
Deep-Rooted Causes Stem from Technology, Institutional Adaptation, and Industrial Ecology
Technical Connotation: Dual Technology Overlap Reconstructs the Risk Paradigm
Embodied AI is essentially "AI with a body," capable of achieving a paradigm leap from "virtual algorithmic intelligence" to "physical entity intelligence," bringing characteristics that traditional robots and AI large models do not possess. Compared with AI large models, the risk points of embodied AI are upgraded from "virtual information generation" to "physical behavior output." Governance risks of AI large models stay at the digital virtual level, requiring execution by humans or physical entities to cause real-world impacts; whereas decisions made by agents outside predetermined rules will directly translate into physical behaviors, easily triggering equipment out of control, production accidents, and even personal injury. Compared with traditional robots, the risk points of embodied AI are upgraded from "controllable operation" to "autonomous decision-making." Traditional robot risks mainly stem from hardware failures, program errors, or operational mistakes, with relatively clear and predictable forms of harm; whereas the risks of embodied AI stem from unpredictable autonomous decisions or even those contrary to the original design intentions made by the AI "brain." Its attack risk surface is complex and diverse, and the decision-making process has poor traceability, making it difficult to govern through the original "vulnerability discovery—patch repair" approach.
Institutional Adaptation: Legal Regulatory System Lags Behind the Speed of Industrialization
Currently, the embodied AI field still mainly relies on the Cybersecurity Law and the Data Security Law as legal bases, which are difficult to accurately adapt to the "algorithmic decision-making + physical execution" characteristics of embodied AI. In terms of tort liability, the determination of tort liability for embodied AI is currently mainly based on the "product liability" section in the Tort Liability Book of the Civil Code and relevant judicial interpretations. The determination targets are mainly set for human behaviors or traditional automated equipment, and tort liabilities such as "loss caused by autonomous decision-making" are still difficult to accurately define. In terms of algorithmic decision traceability, due to the multiple legal relationships involved in embodied AI algorithms, such as mechanical structure patent infringement, trade secret leakage of control algorithms, breach of open-source agreements for software code, and copyright or privacy infringement of training data, legal provisions on mandatory recording and judicial traceability of algorithmic decisions remain blank. In terms of special regulatory clauses, current regulatory standards for embodied AI in various regions have different focuses, leading to high cross-regional compliance costs for enterprises. There is also a lack of a unified testing and certification system. Special regulatory clauses targeting the "physical interaction" characteristics are still being explored, and the application of tools such as regulatory sandboxes is in its initial stage.
Industrial Ecology: Long Security Responsibility Chain but Insufficient Coordination
Embodied AI involves numerous links such as chips, sensors, algorithms, software, manufacturing, integration, and operation services. The industrial organization form and risk responsibility matching are insufficient. At the government level, embodied AI spans numerous links such as chips, sensors, algorithms, software, manufacturing, integration, and operation services. The industrial organization form is complex, objectively forming a multi-departmental management pattern of "hardware regulated by robot supervision, algorithms regulated by AI supervision, and special equipment regulated by industry supervision." The regulatory boundaries of competent departments such as the Ministry of Industry and Information Technology, Cyberspace Administration of China, State Administration for Market Regulation, Ministry of Emergency Management, Ministry of Housing and Urban-Rural Development, and mine safety administration overlap, lacking a clear framework for the division of powers and responsibilities. At the enterprise level, on the one hand, the embodied AI industry is still in the market cultivation period. Enterprises generally concentrate resources on function realization and cost control, and security investment is regarded as a "non-essential item." On the other hand, there is a lack of clear legal basis for the division of responsibilities among producers, software developers, and users, and enterprises lack institutional incentives to transform security investment into competitive advantages.
Countermeasures and Suggestions
Build a tiered, classified, and scenario-differentiated regulatory system.
First, based on the risk conditions of different embodied AI application scenarios, establish a tiered regulatory list of risk levels and application scenarios to implement differentiated control. For special operation scenarios such as hazardous chemical disposal and emergency rescue, implement management measures such as access approval, mandatory safety certification, and on-site scenario risk assessment, strictly limit autonomous decision-making authority, and mandate manual review for major operations. For medium- and low-risk embodied AI products such as closed industrial production lines and park inspection robots, explore systems such as market deployment filing and annual safety review, promote normalized safety testing, and reduce enterprise compliance costs.
Second, clarify the cross-departmental regulatory power and responsibility list. Establish a collaborative governance mechanism for the embodied AI industry, clarify the responsibilities of product access, algorithm security, data compliance, and scenario application security supervision, and eliminate regulatory vacuums and duplicate supervision.
Third, promote the regulatory sandbox pilot system. Focusing on fields such as industry, elderly care services, and special robots, open sandbox pilot areas to conduct testing of new products and new algorithms in controllable environments, implement "pilot fault tolerance, controllable risks, experience extraction, and rule iteration," and further balance innovation and security.
Refine the data compliance system to solve the governance difficulties of multimodal perception data.
First, explore the construction of data compliance guidelines related to embodied AI. Distinguish industrial production data, personal biometric information, and critical infrastructure sensitive data to implement classified and tiered protection.
Second, clarify the data ownership in scenarios related to embodied AI. Further clarify the data usage rights and processing permissions of equipment manufacturers, operators, and scenario users, and avoid unauthorized use of on-site collected data to train external commercial models.
Third, standardize the management of embodied AI training data. Encourage enterprises to establish a traceability mechanism for training datasets, promote the anonymization and de-identification of personal information involved, and strengthen the security assessment of external provision and cross-border transmission of data.
Strengthen the construction of the standard system and improve the layered and clear industry access and certification management system.
First, further improve the construction of the national standard and industry standard system for embodied AI. Promote the construction of detailed standards related to scenario safety specifications, algorithm trustworthiness evaluation, multimodal sensor data security, human-robot interaction ethics, and fault emergency disposal.
Second, improve the unified testing and certification system. Strengthen safety certification, promote the construction of a national-level embodied AI safety inspection and testing platform, integrate the evaluation of hardware functional safety, cybersecurity, algorithm robustness, and multimodal data security, and promote cross-regional and cross-departmental mutual recognition of testing results.
Third, promote the unique identification management of complete embodied AI products, implement a "one machine, one code" full-lifecycle traceability system covering the entire process from R&D and production, market access, sales and usage to scrapping and recycling, and continuously improve subsequent supporting management and execution mechanisms.
Strengthen the construction of security control capabilities and establish a sound in-process and post-event security control mechanism.
First, strengthen the construction of enterprises' main responsibility for full-lifecycle security. Encourage enterprises to establish an algorithm change review mechanism. Deployments in human-robot collaborative scenarios must be equipped with physical isolation, emergency braking, and manual takeover channels.
Second, strengthen digital regulatory monitoring. Strengthen the investigation of the security status and abnormal behavior data of embodied AI equipment to help achieve risk warning.
Third, build a clear accident liability and risk sharing mechanism. Issue judicial guidance opinions to divide the responsibilities of developers, manufacturers, and operation users based on control rights, benefit attribution, and risk prevention and control capabilities. Explore mandatory liability insurance for high-risk scenarios and industry risk compensation funds.
Fourth, promote the construction of policy tools for violation disposal. Aiming at behaviors such as illegal data collection, algorithm out-of-control risks, and unlicensed deployment, promote the construction of gradient disposal measures by setting warnings, time-limited rectification, suspension of operations, product recalls, and administrative penalties.
Fifth, further explore the establishment of relevant human-robot ethical norms and encourage enterprises to establish a technology ethics review mechanism.
Authors | Embodied AI Research Group, Institute of Science, Technology and Standards, China Center for Information Industry Development, Ji Shaoyu, Liu Jing
Editor | Wu Lilin
Art Editor | Ma Liya
Supervisor | Lian Xiaodong