The EU AI Act and Robot Training Data: What to Know

Picture the audit. A safety officer at a German logistics operator asks one question about the humanoid now shuttling totes down aisle seven: where did the data that taught it to grasp come from, and can you show that the people in those training videos agreed to be filmed? Under Regulation (EU) 2024/1689, better known as the EU AI Act, that question stops being rhetorical and becomes a documentation requirement.

Here is the part most summaries get wrong. The AI Act does not regulate datasets. It regulates AI systems placed on the Union market and the general-purpose models that power them. No article says a robot training set must contain a fixed number of hours of video or a quota of demonstrations. And yet, read the obligations closely and almost all of the weight lands on the data anyway. The Act makes your data the place where you prove your system behaves.

For teams building embodied foundation models, that indirection is the whole story. Whether you scrape first-person video, teleoperate arms in a lab, or pool trajectories across institutions the way Open X-Embodiment did with more than a million real-robot episodes, the compliance surface is the same short list of questions: provenance, representativeness, consent, and bias. This piece walks through what the Act actually asks of embodied datasets, which parts apply now, and which parts bite in 2026 and 2027.

The Act regulates systems, not datasets

Scope decides everything else. The AI Act applies to providers who place an AI system on the EU market or put it into service there, and to providers of general-purpose AI (GPAI) models wherever they sit. Output used in the Union counts too. A dataset on its own is not a regulated object. It becomes relevant the moment it trains a system or model that touches the EU.

The Act sorts systems by risk: a short list of prohibited practices, a larger high-risk tier, limited-risk systems with transparency duties, and everything else. A humanoid used as a safety component of industrial machinery, or inside another covered product, can land in the high-risk tier through Annex I, which ties the AI Act to existing product-safety law such as the Machinery Regulation. That classification is what pulls the data-governance rules into force.

So the honest framing is this: your embodied dataset is regulated by proxy. It inherits obligations from the system it trains and from the model you publish. Miss that, and you will read Article 10 as optional. It is not.

Article 10, the data-governance bar

Article 10 is the clause that matters most to anyone assembling robot data. It requires that the training, validation, and testing datasets behind a high-risk system meet quality criteria. The wording is deliberately practical rather than numeric.

The Act never tells you what your dataset must contain. It tells you how your system must behave, then makes the data the place where you prove it.

The representativeness test is where robotics diverges from a language model. Article 10 asks whether data reflects the specific geographical, contextual, behavioural, and functional setting of intended use. A manipulation policy trained only on bright lab teleoperation is not obviously representative of a dim European kitchen. DROID, assembled as roughly 76,000 teleoperated demonstrations across 13 institutions, exists partly because single-site data does not generalize. The Act gives that engineering intuition a legal edge.

There is one counterintuitive permission. Article 10(5) lets providers process special categories of personal data, the sensitive kind, strictly to detect and correct bias, under safeguards. For egocentric capture that records faces, hands, and body types, this is the narrow legal door that makes bias auditing lawful rather than a fresh violation.

Your foundation model is a GPAI model, and provenance goes public

Most robot foundation models are general-purpose AI models in the Act's sense, and GPAI obligations have applied since 2 August 2025. Providers must keep technical documentation, pass information to downstream integrators, adopt a policy to respect EU copyright, and publish a sufficiently detailed summary of the content used for training, on a template issued by the AI Office.

Read that last one twice. Provenance is no longer a private matter. If your model learned to fold laundry from scraped video, the summary has to say so at a meaningful level of detail. If it learned from consented, documented human demonstrations, the summary is easy to write and easy to defend. The two paths diverge sharply the day a regulator, or a downstream OEM's counsel, asks to see it.

One number is worth knowing. The Act reserves its heaviest GPAI duties for models trained above roughly 10^25 floating-point operations, which it presumes carry systemic risk. Today's robot foundation models sit well under that line, so they are ordinary GPAI, not systemic-risk GPAI. The transparency and copyright duties still apply; the extra evaluation and incident-reporting burden does not, at least for now.

GDPR and the Data Act did not go away

The AI Act sits on top of two regimes that embodied data touches constantly. The first is the GDPR. Egocentric footage is dense with personal data: the faces of bystanders, the interior of someone's home, a worker's gait. None of that stops being personal data because it is now robot training input. Lawful basis, minimization, and retention limits still apply, and the AI Act explicitly leaves the GDPR intact.

The second is the EU Data Act, in force since 12 September 2025, which governs access to data generated by connected products. A fleet of robots is a fleet of connected products. Who may access the streams they generate, and on what terms, now has a statutory answer. For anyone planning to pool robot-generated data across partners, the Data Act shapes the contracts before the AI Act ever looks at the model.

What this means for how you build a dataset

The calendar is the practical part. Prohibitions have applied since February 2025. GPAI duties since August 2025. The high-risk and data-governance obligations relevant to training data, Article 10 included, are phasing in across 2026 and 2027, with a later tranche for AI inside regulated products such as machinery. The exact application dates have shifted during implementation, so track the current schedule rather than any single deadline. If your robot reaches the EU market in that window, the data decisions you make in 2026 are the ones you will document in 2027.

The teams that move fastest treat data governance as a design constraint, not a retrofit. In practice that means:

• logging provenance at capture time, rather than reconstructing it under audit;
• recording consent as structured metadata, not a signed PDF in a drawer;
• measuring representativeness across locale, lighting, handedness, and body type before training, not after an auditor asks.

Ego4D, on the order of 3,670 hours of first-person video from hundreds of camera wearers across nine countries, showed how much scaffolding a consented egocentric collection actually needs. The Act turns that scaffolding from good practice into a requirement.

None of this requires a compliance department to begin. It requires deciding, early, that where your data came from is as much a part of the model as its weights. The Act simply made that decision legible to everyone else.