Before the attack: the US has no physical AI cybersecurity law. It has sector rules.

Europe will have one rule for every machine from 20 January 2027. What does the US have? Four sector answers. Only one of them is a binding cybersecurity duty.

Medical robots: binding since 29 March 2023. Section 524B of the Food, Drug, and Cosmetic Act covers "cyber devices". Makers must submit a plan to monitor and address vulnerabilities. They must keep processes that give "a reasonable assurance" the device is cybersecure. And they must

make available postmarket updates and patches

They also file a software bill of materials. A surgical robot falls here if it meets the "cyber device" test. That includes the ability to connect to the internet.

Vehicles: recalls, plus voluntary guidance. NHTSA's 2022 cybersecurity best practices say plainly that they don't "have the force and effect of law". The binding part is the recall system. A maker reports a safety defect

not more than 5 working days after a defect in a vehicle or item of equipment has been determined to be safety related

Factory robots: no specific standard. OSHA's own page says it:

There are currently no specific OSHA standards for the robotics industry.

Under the OSH Act, the general duty falls on employers, not on robot makers. The consensus robot standard it points to is guidance, not regulation.

Consumer devices: a voluntary label. The FCC's Cyber Trust Mark is voluntary. A product that joins must disclose its support period for security updates. The program was still changing administrators in 2026.

And AI itself? NIST's AI Risk Management Framework is "intended for voluntary use".

So the picture splits in two. Binding = medical devices, plus vehicle recalls. Voluntary = almost everything else. Among the rules I counted, a warehouse humanoid sold in the US meets no federal cybersecurity duty written for it. The same humanoid sold in the EU meets Annex III from January.

I compared four jurisdictions, the EU, the US, Japan and Israel, in my paper on regulatory convergence in Physical AI.

Here's the honest limit. I counted federal rules only. State laws and contracts can add duties. I haven't mapped them.

Bottom line: the EU asks one question of every machine. The US asks it only where a sector regulator already sits.

Robot makers selling in both markets: do you build to the EU line, or one design per market?

Part 6 of 12 · When the AI drives the motor: Physical AI cybersecurity as a safety problem.