Before the attack: four duties EU law puts on a physical AI maker from 20 January 2027

What exactly must a robot maker build in, by law, against an attacker? In Europe the answer has a date: 20 January 2027. That's 92 days away.

The Machinery Regulation gives four lines. All four sit in the safety annex. None of them sits in a data law.

Duty one: withstand the attacker. Annex III 1.2.1(a) asks control systems to withstand outside influences "where appropriate to the circumstances and the risks". That includes:

reasonably foreseeable malicious attempts from third parties leading to a hazardous situation

The test is physical. It's about a hazardous situation, not stolen data.

Duty two: protect what the safety depends on. Annex III 1.1.9 carries the title "Protection against corruption". Its core sentence:

Software and data that are critical for the compliance of the machinery or related product with the relevant essential health and safety requirements shall be identified as such and shall be adequately protected against accidental or intentional corruption.

The same section asks the machine itself to collect "evidence of a legitimate or illegitimate intervention" in its software. From January, a robot will have to show it was changed.

Duty three: keep a learning machine inside its lane. Section 1.2.1 has a separate list for machines with self-evolving behaviour. Its first point keeps them from acting beyond their "defined task and movement space". The attacker clause and the learning-machine clause share one section.

Duty four: a third party checks the learning safety parts. Annex I Part A lists, at point 5:

Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions.

Annex I Part A means the maker can't self-certify that part. My own count of the Commission's register in September found three of 39 notified bodies for that category. The method is here.

Does the Cyber Resilience Act replace any of this? No. Its Recital 53 says machinery makers "should comply with both" sets of requirements. The recital names 1.1.9 and 1.2.1 directly.

Here's the honest limit. The EU hasn't cited a single harmonised standard under the Regulation yet. The Commission says the first list "can be expected before the end of this year". The standard written for 1.1.9, FprEN 50742, sat at approval stage on 9 October 2026. Until the EU cites one, a maker proves these duties directly.

Bottom line: Europe put "withstand the attacker" in the same annex as "don't crush the operator". For a physical AI, those are one risk.

Machinery makers: which of the four duties is hardest for your team today?

Part 4 of 12 · When the AI drives the motor: Physical AI cybersecurity as a safety problem.