After the attack: the security patch. When does it make you a new manufacturer?

The attack is over. The maker ships a fix. For a physical AI, that fix might be new code. It might be a retrained model. Is it still the same machine?

EU machinery law answers with one definition. Article 3(16) calls a change a "substantial modification" when it's made

by physical or digital means after that machinery or related product has been placed on the market or put into service, which is not foreseen or planned by the manufacturer, and which affects the safety of that machinery or related product, by creating a new hazard, or by increasing an existing risk

The definition goes on, and this part is a condition. The change must also require new guards or protective devices that alter the safety control system, or new measures for stability or strength. A risk increase alone isn't enough.

Article 18 says what happens next. Whoever makes a substantial modification "shall be considered to be a manufacturer". New obligations. New conformity work.

So a patch can carry a new legal identity with it. Who's exposed? An integrator who retrains a robot's model on site. A service partner who pushes a fix the maker never planned.

The exit is in the same definition. A change "foreseen or planned by the manufacturer" isn't a substantial modification. I covered that test in detail here. For a learning machine, the risk assessment that foresees future updates does real legal work.

The Cyber Resilience Act adds a shipping rule. Annex I Part II wants security updates kept apart from feature updates:

where technically feasible, new security updates shall be provided separately from functionality updates

That keeps a security fix from smuggling in new behaviour. For a robot, new behaviour can mean new motion.

Liability will follow the same line. For products placed on the market after 8 December 2026, the new Product Liability Directive removes one defence. A maker can't escape liability for defects from "software, including software updates or upgrades" within its control. A "substantial modification" sits on the same list.

Here's the honest limit. Does retraining a model count as a substantial modification? The Regulation and its recitals don't settle it. It turns on the facts of each change.

Bottom line: after an attack, the fix is a safety event too. Plan which updates your risk assessment already foresees.

Integrators: who decides whether a robot's security patch was "foreseen"?

Part 9 of 12 · When the AI drives the motor: Physical AI cybersecurity as a safety problem.