The analysis

Analysis

Weekly posts on Physical AI safety. Data-backed. Source-cited.

A specialist publication for the people building, regulating, and capitalising the next decade of Physical AI. Every post starts from a primary source, cites the source, and argues for one thing at a time. No speculation where data exists. No data where speculation would be more honest.

Featured

After the attack: the security patch. When does it make you a new manufacturer?

Regulation2026-10-292 min read

Part 9 of 12. After an attack, the robot gets patched, and sometimes its model gets retrained. Under EU machinery law, a modification 'by physical or digital means' that wasn't foreseen, raises a risk and needs new protective measures can turn whoever made it into the manufacturer. The Cyber Resilience Act wants security fixes shipped apart from new features where feasible.

Read the featured post

Illustration: AI-generated

Regulation

After the attack: the security patch. When does it make you a new manufacturer?

Oct 29, 2026Read →

Regulation

After the attack: Europe's clock starts at 24 hours. The US clock depends on the sector.

Part 8 of 12. Since 11 September 2026, the Cyber Resilience Act gives makers of most connected products, robots included, 24 hours to warn about an actively exploited vulnerability. In the US, vehicle makers report safety defects within 5 working days, and the federal critical-infrastructure reporting rule still isn't in force.

Oct 28, 2026Read →

Engineering

During the attack: who reaches the safe state?

Part 7 of 12. EU machinery law says the stop must beat the start, and the emergency stop must work 'at all times, regardless of the operating mode'. It doesn't say where the stop must run. When an attacker holds the AI's computer, that question decides whether the robot stops.

Oct 27, 2026Read →

Regulation

Before the attack: the US has no physical AI cybersecurity law. It has sector rules.

Part 6 of 12. Europe writes one horizontal duty for machines from 20 January 2027. The US splits it: a binding cybersecurity duty for medical devices since March 2023, recall rules and voluntary guidance for vehicles, no OSHA standard for robots, and a voluntary label for consumer devices.

Oct 22, 2026Read →

Standards

Before the attack: five documents touch physical AI cybersecurity. One mentions AI, and it sets no requirements.

Part 5 of 12. IEC 62443, IEC TS 63074, IEC 61508, ISO/IEC TR 5469 and the draft FprEN 50742 all touch the security side of machine safety. Read through their publishers' own public pages, only one names AI, and it's a Technical Report. None is cited yet under the EU Machinery Regulation.

Oct 21, 2026Read →

Regulation

Before the attack: four duties EU law puts on a physical AI maker from 20 January 2027

Part 4 of 12. The Machinery Regulation answers 'what must the maker build in?' with four lines, all in the safety annex: withstand the attacker, protect the software and data the safety depends on, keep a self-evolving machine inside its task, and send machine-learning safety components to a third party. The EU hasn't cited a single harmonised standard under the Regulation yet.

Oct 20, 2026Read →

Engineering

If the attacker owns the AI's computer, what else does he own?

An attacker who owns an AI's computer owns every safety check running on it. My own papers name the sharing and put an estimate on it: across anonymised architectures, software-only redundancy approaches 100% common-cause failure. A nuclear regulator's 1994 report doubted the same assumption decades earlier. This post asks who reaches the safe state. It does not answer.

Oct 15, 2026Read →

Engineering

They talked the physical AI into it

RoboPAIR jailbroke three LLM-controlled systems, hitting 35 for 35 on a real quadruped, a real wheeled robot, and a set of driving video clips with no vehicle at all. The paper calls only the quadruped's actions physically realized. Its own limit: none of the three reason about harm on their own.

Oct 14, 2026Read →

Engineering

A hacked chatbot says something wrong. A hacked physical AI moves.

Part 1 of 12 on Physical AI cybersecurity as a safety problem. When an AI drives a motor, a compromise ends in motion. From 20 January 2027, EU machinery law makes withstanding attackers a safety duty. The US splits the question by sector.

Oct 13, 2026Read →