A Robot Handoff Needs Evidence of Who Held Motion Authority

When a mobile robot moves between autonomous operation and remote assistance, a mode indicator cannot show which commands its controller actually accepted. That calls for a witnessed, criteria-based test before the capability is switched on.

This article proposes an examination approach, not a safety test procedure for unsupervised use. It is not a machinery-safety assessment, legal opinion, conformity assessment, safety certificate or report of an operating examination. Any testing requires competent personnel and a machine-specific risk assessment.

Three decisions for leadership

• Require a witnessed record of the controller’s command decisions across handoffs, obtained under a written, risk-assessed test plan in a controlled environment. Examine delayed, duplicated, former-authority and reconnected commands.
• Verify that a communications failure does not defeat the machine’s required protective response. Rejecting invalid motion commands does not establish that safety-related stopping and other protective functions remain effective.
• Before citing a robotics standard or regulation, establish which machine, operating mode, jurisdiction and duty-holder it actually applies to. Manufacturer duties and employer duties are different.

The decision is whether to switch on remote assistance

Consider a mobile tug that normally travels autonomously but accepts remote steering when it cannot get past an obstruction. An operator sends a motion command. The communications link fails, the controller changes mode, and the earlier command arrives late. The operator’s screen might correctly show the new mode, but that does not prove how the controller handled the old command.

Motion authority means the command source currently permitted to direct the machine’s motion under its defined control-state rules. It is not the same as a valid login, an authenticated session or a recent message. ODA3 Institute proposes one acceptance requirement: the controller accepts motion commands only from the source authorised for its current state, including transition and recovery states, subject to the machine’s protective functions. This article does not show that any deployed machine meets that requirement.

The question for the robot safety lead is specific: what original evidence supports switching on remote assistance for this configuration, at this site? The board should ask three things: who approved the criteria, who witnessed the examination, and which failures remain open. Supplier specifications describe intended behaviour. Records of controller decisions, together with measured motion, show whether that behaviour actually occurred.

A command can be authorised when sent and invalid when received

Illustrative scenario — synthetic, not based on a real machine or incident. Not an instruction to perform fault injection on an operational floor.

The timings are invented to raise a test question, not to describe an observed failure. They do not imply that a robot should return to autonomous motion after a lost link. Where EU machinery law applies, remote-controlled machinery must stop automatically if, among other cases, the driver loses control (see below). The required loss-of-link and recovery response must be determined by the machine-specific risk assessment and applicable safety requirements, not by the illustrative timeline. A lost link does not itself authorise autonomous motion or automatic restart.

Three distinct matters require examination.

Current authority. A command from an operator who was permitted a moment ago can be invalid once authority transfers. The controller must apply the defined state and source rules at the point where it decides, including during ambiguous transitions. Session or authority epochs and sequence identifiers are possible engineering mechanisms, not prescribed universal ones.

Message validity. A command can come from the correct source and still be too old, duplicated or replayed. Expiry, ordering and reconnect handling should be tested separately from source authority. A timestamp alone cannot prove the sender still held authority.

Protective safety behaviour. Under the proposed criterion, a stale or former-authority motion command should not be accepted merely because its session was once valid. That rule does not govern safety-related stop functions. A command to stop that has already been given must not be rendered ineffective by a communications failure where Annex III §1.2.6 applies. Nor does that provision prescribe unconditional acceptance of every late or replayed packet labelled “stop”. Competent designers must distinguish safety-related stopping, ordinary operational commands, authenticity and replay controls, and the required response after link loss. A robot may already be moving when the fault occurs; the effectiveness of stopping, braking and other protective measures must be examined against the applicable risk assessment. If the required protective response depends on a new remote command traversing the failed link, that dependency requires design review rather than weakened acceptance criteria.

What the law requires, and of whom

Manufacturers placing machinery on the EU market

Regulation (EU) 2023/1230 on machinery generally applies from 20 January 2027, with earlier provisions including Articles 26–42 from 20 January 2024 and Article 50(1) from 20 October 2026 [1][2]. On that date, it repeals Directive 2006/42/EC. Article 52 nevertheless protects continued making available of machinery lawfully placed on the market under that Directive before 20 January 2027; certain surveillance provisions and existing EC type-examination certificates have their own transitional treatment. This does not mean that every existing machine or declaration must automatically be reissued on that date [1].

Supervision is not remote control. The Regulation separates the two. Its definitions treat a supervisory function as remote, non-permanent surveillance that can receive information or alerts and give limited orders. Under §3.2.4, it may only stop or start the machine remotely, or move it to a safe position and state, and only when the supervisor can see the machine’s movement and working area and the protective devices are operational [1]. By contrast, a driver is defined to include an operator who guides the machinery by remote control [1]. Remote steering of the kind in the scenario is therefore remote control, not supervision. Classification still has to be established for the actual machine and each of its modes.

Four provisions bear directly on how the examination should be designed:

• §1.2.6. Interruption of a communication network connection, its re-establishment after an interruption, or its fluctuation must not lead to hazardous situations. The provision addresses several scenarios, including unexpected starting, ineffective stopping after a stop command was given, and loss of protective effectiveness [1]. The reconnect case is therefore relevant, but the provision does not prescribe a universal packet-filtering algorithm.
• §3.3. Remote-controlled machinery must respond only to signals from the intended control units. For autonomous mobile machinery, the control system must perform its safety functions itself, even when actions are ordered through the remote supervisory function [1].
• §3.3.3. Remote-controlled machinery must stop operation automatically and immediately in specified situations, including when the driver loses control [1].
• §1.1.9. A new requirement addresses protection against corruption [1].

These are design-and-construction duties of the manufacturer for machinery within scope. They do not prescribe the injected-command test that ODA3 Institute proposes here, and they say nothing about whether any manufacturer meets them.

A retrofit can change the duty-holder. Under Articles 3(16) and 18, a person making a substantial modification to machinery after placing on the market or putting into service may be treated as its manufacturer. The definition concerns an unplanned physical or digital change that creates a new hazard or increases risk and meets the Regulation’s specified additional-protection conditions. Retrofitting a remote-control capability therefore warrants a documented determination; simply activating a feature already planned and assessed by the manufacturer is not automatically a substantial modification. Article 18 includes an exception for a non-professional user modifying machinery for their own use. The classification depends on the actual change, responsible party and applicable law [1].

Standards and presumption of conformity. Under Article 20, conformity with relevant harmonised standards confers a presumption of conformity only for the essential health and safety requirements they cover, where their references have been published in the EU Official Journal. The 2026 amendments also add a specific interim bridge in Article 20(10) for certain AI-related harmonised standards or common specifications. Merely citing an ISO edition or an ANSI standard, without checking its status, scope and relevant provisions, establishes no such presumption [1][3].

Machine-learning safety functions and the AI Act interface. The Machinery Regulation’s Annex I, Part A identifies certain safety components and machinery with embedded systems using fully or partially self-evolving machine-learning behaviour to ensure safety functions. Where a product falls into one of these categories, its conformity-assessment route involves a notified body; the presence of ordinary software or AI alone does not establish that classification [1].

The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, expressly deleted the Machinery Regulation entry from Section A and added it as point 21 of Section B of Annex I to the AI Act (Article 1(41)) [3]. The amended AI Act Article 2(2) identifies the provisions applicable to Article 6(1) high-risk AI systems related to Section B products, while the amendment to Machinery Regulation Article 8 requires Commission delegated acts integrating relevant AI health and safety requirements into Annex III to apply by 2 August 2028 [3]. These are different legal mechanisms from the Digital Omnibus’s separate, conditional power to limit requirements for products remaining in Section A.

This article does not classify the tug’s motion-authority logic as an AI Act “safety component” or determine whether any particular component or fully or partially self-evolving machine-learning safety function falls within Annex I, Part A of the Machinery Regulation. The amended Article 3(14) definition refers to components that perform a safety function or whose failure or malfunction endangers health, safety or property, and further defines a safety function by its intended purpose of preventing or mitigating such risks [3]. Product function, intended purpose, the AI system and relevant law must be assessed before any classification or AI Act obligation is inferred. The amendment is not a blanket exemption for AI used with machinery.

Cybersecurity and liability (EU)

A robot and its remote-assistance software may fall within the scope of the Cyber Resilience Act, Regulation (EU) 2024/2847, depending on the product, economic operator and statutory exclusions. For products within scope, Article 14 reporting obligations concerning actively exploited vulnerabilities and severe security incidents have applied since 11 September 2026; the Regulation generally applies from 11 December 2027 [4]. These reporting duties should not be confused with reporting every machinery handoff fault.

The revised Product Liability Directive, Directive (EU) 2024/2853, includes software in its product framework. Following the 7 May 2026 corrigendum to Article 2(1), its new framework concerns products placed on the market or put into service after 8 December 2026; Article 22(1) separately sets 9 December 2026 as the deadline for national transposition. Those dates govern different provisions; their practical effect requires examination of the relevant national implementing law [5][11].

Under Article 8(2), a person who substantially modifies a product outside the original manufacturer’s control and then makes it available on the market or puts it into service may be treated as a manufacturer for this Directive’s liability framework. This test is not identical in wording or consequence to the Machinery Regulation’s substantial-modification rules. A software or remote-steering retrofit should therefore be assessed separately under the applicable product-safety and product-liability regimes [5].

The Directive’s compensation categories include qualifying personal injury, but exclude property used exclusively for professional purposes (Article 6). Damage to business-only warehouse stock and business interruption cannot simply be treated as compensable under this Directive, although other national liability, contractual or insurance regimes may be relevant. A defect, injury, causation and responsibility still require case-specific examination [5].

Employers using the equipment

Product-design obligations and workplace-use obligations must be analysed separately. The Machinery Regulation addresses manufacturers and other economic operators; deploying employers may also have national work-equipment duties. Two examples:

• Great Britain: PUWER 1998, regulation 29, requires employers to ensure that remote-controlled self-propelled work equipment that poses a risk while in motion stops automatically once it leaves its control range [6].
• Ireland: Regulation 40(b)(viii) of the 2007 General Application Regulations requires, among other provisions, remote-controlled self-propelled equipment to stop automatically once it leaves its control range [7].

Neither quoted rule directly specifies command acceptance during an authority handoff. Both concern the distinct hazard of remote-controlled equipment leaving its control range; a temporary network drop does not automatically prove that circumstance. Competent advisers must assess the particular machine, control range and handoff hazard. The employer cannot assume manufacturer conformity alone discharges site-use obligations.

Other jurisdictions

• Great Britain: the Machinery Regulation does not apply. The Supply of Machinery (Safety) Regulations 2008 continue to govern supply, and the UK Government has said it will update them along similar lines [8].
• Northern Ireland: the EU Machinery Regulation applies under the Windsor Framework [8].

Standards

ISO 3691-4:2023 covers driverless industrial trucks and their systems, and gives autonomous mobile robots and tuggers as examples. Its published scope covers several cases [9]:

• automatic modes that an operator starts;
• additional manual modes;
• a maintenance mode;
• riders.

It excludes remotely controlled trucks, “which are not considered to be driverless trucks” [9]. This is a limitation of the standard’s scope, not an exemption from applicable machinery-safety or workplace requirements. So it would be unsound to assume either that a hybrid machine falls entirely outside the standard or that its remote-steering mode is fully covered by it. Ask the supplier for a mode-by-mode applicability rationale and the clause-level basis behind it. If a mode falls outside a cited standard, its safety requirements must still be established through applicable law, risk assessment and other relevant standards; absence of coverage by one standard does not imply absence of duties. In the United States, A3 describes ANSI/A3 R15.08-2 as setting requirements for integrating, configuring and customising industrial mobile robots and fleets at a site [10]. R15.08-2 is an ANSI-accredited voluntary consensus standard, not a federal regulation. Neither published scope substitutes for the full normative text.

The evidence exchange starts before testing

Each party supplies different evidence:

• The supplier provides the control-state specification, the rules for transferring authority, how command expiry and queues behave, the system configuration, firmware and software versions, the regulatory basis it claims for each mode, and any original controller-level decision records.
• The site operator defines zones, permissible speeds, network conditions, the required response when communication is lost or restored, and the operating procedures that apply.
• The purchaser and robot safety lead write down, before testing, the expected authority and the accept or reject outcome in each state, including ambiguous transitions.

The independent examination should then test against those pre-agreed criteria, rather than accept a demonstration the supplier chose alone.

What the test should actually record

Make the examination safe before testing

Fault injection can create unexpected motion. It must not be copied into a live working environment on the strength of this article. Before any such examination, competent machinery-safety personnel should prepare and approve a written, machine-specific test risk assessment and plan, including:

• A segregated, access-controlled test area with no people in the danger zone, appropriate physical separation and provision for foreseeable travel and stopping distances.
• Pre-test verification that required protective devices, interlocks and stopping arrangements work; emergency stopping must not depend solely on the communications link or the software behaviour being challenged.
• Risk-assessed limits on speed, load and kinetic energy, with representative operating conditions addressed only when the test plan can maintain safety.
• Clear test supervision, communication, abort criteria and recovery/restart procedures, with no unplanned restart on reconnect or delivery of queued commands.
• No bypass, defeat, weakening or unauthorised modification of safety-related controls. If a scenario cannot be tested without defeating a safeguard, do not execute it under this proposal; redesign the examination with a competent specialist.
• Baseline configuration identifiers and appropriate change-impact review when firmware, controller logic, networking, routes, loads or environmental conditions change.

Observe authority and physical behaviour separately

In that controlled environment, a qualified team may examine handoffs in both directions and commands before, during and after transitions, under approved criteria. The proposed examination should distinguish motion commands from safety-related stop behaviour. Cases to consider include:

• valid positive controls;
• delayed messages;
• commands from the former authority;
• duplicates or replays;
• commands queued during an interruption and delivered on reconnect;
• protective response to loss of the link, with stopping effectiveness and restart prevention observed separately;
• the disposition of a stop command already given before the connection fails, without assuming every later untrusted stop-labelled message must be accepted.

For every attempted command, the team should keep:

• the command identifier, source and session;
• the sequence number or authority epoch, where applicable;
• the controller’s authority state and the relevant timing;
• the accept or reject decision and its reason;
• the original records, with provenance.

Motion and stopping performance should be observed independently against a suitable calibrated time reference, including the state before the fault, motion during transition, time/distance to the defined safe condition where applicable, and behaviour after reconnection. Log rejected commands, commands causing no movement and protective-function outcomes, not only successes.

If a criterion fails, the team should investigate, fix the problem and retest. Any decision to accept the remaining risk must go through authorised safety governance and must not be presented as the failed criterion becoming a pass. Hiring an independent examiner does not take the deployment or safety decision away from management. A test can support only a bounded finding about the examined command-handling behaviours for the configurations and conditions observed, not blanket safety or legal conformity. Passing this test is not a machinery-safety assessment: it does not by itself establish person/obstacle detection, stopping distances, braking performance, emergency-stop independence, functional safety integrity or control of other hazards. These require a wider risk assessment and appropriate validation by competent specialists.

What this means for underwriting and risk transfer

Unexpected motion could cause injury, property damage or business interruption, but these are potential consequences, not losses observed here. An insurer looking at a specific operation might find a scoped command trace useful when asking how remote operation, loss-of-link controls and shared controller versions affect the exposure. The organisation could provide its test criteria, original results, exceptions and change history instead of relying only on supplier statements.

That usefulness is ODA3 Institute’s conditional analysis, not an observed underwriting practice. First-party property or interruption losses and third-party liability need separate examination. A technical defect does not by itself establish a financial loss. A loss does not automatically establish legal responsibility, and responsibility does not settle insurance coverage. The revised EU product-liability framework may affect how a product-defect claim is analysed; it does not determine coverage or automatically allocate responsibility between supplier and deployer. Policy wording, exclusions, facts and jurisdiction govern any coverage assessment. Running the same firmware or remote platform across a fleet also raises a plausible correlated-exposure question, but no portfolio loss has been demonstrated.

Actions before the switch-on decision

Board checklist — before remote assistance is switched on

• ☐ Was a competent person’s written test risk assessment approved, with a segregated area, no personnel in the danger zone, required safeguards active and independent stopping arrangements verified?
• ☐ Has the controller’s handling of commands across a handoff been witnessed under that plan, not just described?
• ☐ Were invalid stale, replayed and former-authority motion commands handled against agreed criteria without impairing a stop command already given or another safety function?
• ☐ Was the required safe condition reached after link loss without reliance on a new command over the failed link, and were stopping, braking, detection and prevention of unexpected restart separately assessed?
• ☐ Which scenarios failed or remain untested, and who accepted any residual risk through safety governance?
• ☐ Have both the manufacturer’s conformity route and the employer’s own work-equipment duties been confirmed for this jurisdiction?
• ☐ Which software, firmware or site changes trigger re-examination?
• ☐ Has the insurer or broker been told that remote assistance is in use?

Notably Absent

• No operational robot, incident, injury, field control log or independent handoff examination was assessed for this article. The example and its timings are synthetic.
• No competent machinery-safety specialist or EU product-law counsel has independently signed off this publication. No controlled fault-injection study, risk-assessment validation, stopping-performance evaluation or person-detection examination was performed for it.
• Incident and injury databases were not searched systematically. How often handoff faults cause harm is unknown.
• Nothing reviewed shows that the proposed test is required by ISO 3691-4:2023, ANSI/A3 R15.08-2 or any law cited. The EU provisions were checked at clause level. Only the published scope of the two standards was checked, not their full normative text.
• No adopted delegated acts adding the future AI-related machinery requirements were examined; the substance of such future requirements is not asserted.
• No product-specific AI Act “safety component” classification, Machinery Regulation Annex I Part A machine-learning safety-function classification, machinery conformity assessment, functional-safety integrity determination or legal analysis was carried out. No substantial-modification classification, pre-2027 transition determination, EU harmonised-standard citation check, Radio Equipment Directive assessment or jurisdiction-specific product-liability claim analysis was carried out.
• US federal and state workplace rules and Indian machinery and workplace rules were not assessed. Neither were national transpositions of Directive 2009/104/EC beyond the two examples cited.
• The sources examined did not establish any insurer requirement for command traces, any premium effect, any claims outcome or any frequency data. No insurer acceptance of the proposed method was verified.
• Nothing obtained shows that the proposed command-control design works at any named site, or that it stays effective across untested versions and operating conditions.

A bounded decision, not a safety certificate

A decision to switch on remote assistance deserves more than an operator’s mode display. It needs:

• an agreed control boundary;
• original records of what the controller accepted;
• independent observation of motion and stopping;
• a protective response tested against the same fault under an approved, safeguarded examination plan;
• clarity on which legal duties sit with the manufacturer and which with the site.

The evidence can inform a decision only within its stated scope. Until an actual examination takes place, this article describes how to ask for evidence, not evidence already obtained. A passed command-handoff check would remain only one input to the overall machinery-safety assessment.

References

[1] European Union. “Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023 on machinery.” Official Journal of the European Union, L 165, 29 June 2023; Annex I Part A; Annex III §§1.1.9, 1.2.6, 3.1.1, 3.2.4, 3.3, 3.3.3; Article 54. https://eur-lex.europa.eu/eli/reg/2023/1230/2026-07-27/eng (accessed 9 November 2026).

[2] European Union. “Corrigendum to Regulation (EU) 2023/1230.” Official Journal of the European Union, 4 July 2023 (application date corrected to 20 January 2027). https://eur-lex.europa.eu/eli/reg/2023/1230/corrigendum/2023-07-04/oj/eng (accessed 9 November 2026).

[3] European Union. “Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI).” Official Journal of the European Union, 24 July 2026; in force 27 July 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj (operative amendments checked against the official EUR-Lex text, accessed 9 November 2026).

[4] European Union. “Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act),” Article 71. Official Journal of the European Union, 20 November 2024. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847 (accessed 9 November 2026).

[5] European Union. “Directive (EU) 2024/2853 on liability for defective products.” Official Journal of the European Union, 18 November 2024. https://eur-lex.europa.eu/eli/dir/2024/2853/oj (Articles 2 and 22 checked against the official EUR-Lex text; read Article 2 with the 7 May 2026 corrigendum, accessed 9 November 2026).

[6] UK. “The Provision and Use of Work Equipment Regulations 1998,” regulation 29. legislation.gov.uk. https://www.legislation.gov.uk/uksi/1998/2306/regulation/29 (accessed 9 November 2026).

[7] Ireland. “Safety, Health and Welfare at Work (General Application) Regulations 2007,” regulation 40(b)(viii) (revised). https://revisedacts.lawreform.ie/eli/2007/si/299/section/40/revised/en/html (accessed 9 November 2026).

[8] UK Department for Business and Trade. “Supply of Machinery (Safety) Regulations 2008: Great Britain” (statutory guidance, updated 24 March 2025), and “Government response to the call for evidence on machinery safety legislation.” https://www.gov.uk/government/publications/supply-of-machinery-safety-regulations-2008/supply-of-machinery-safety-regulations-2008-great-britain (accessed 9 November 2026).

[9] ISO. “ISO 3691-4:2023 Industrial trucks — Safety requirements and verification — Part 4: Driverless industrial trucks and their systems” (published scope). NSAI Standards Store; published 12 June 2023. https://shop.standards.ie/en-ie/standards/iso-3691-4-2023-1182044_saig_iso_iso_3293487/ (accessed 9 November 2026; full normative text not assessed).

[10] Association for Advancing Automation. “ANSI/A3 R15.08-2 Safety Standard for Industrial Mobile Robot Systems and Applications Now Available.” A3, 9 October 2023. https://www.automate.org/news/ansi-a3-r15-08-2-safety-standard-for-industrial-mobile-robot-systems-and-applications-now-available (accessed 9 November 2026; publisher description, not normative text).

[11] European Union. “Corrigendum to Directive (EU) 2024/2853” (OJ L, 2026/90364, 7 May 2026), correcting Article 2(1) from “after 9 December 2026” to “after 8 December 2026”. https://eur-lex.europa.eu/eli/dir/2024/2853/corrigendum/2026-05-07/oj (accessed 9 November 2026).

© 2026 ODA3 Pvt Ltd