For manufacturers
The presumption fires by default. The record is what a rebuttal is built on.
From 9 December 2026, EU courts can presume your product defective where technical complexity makes proof excessively difficult — and a robot running a learned policy is the textbook case. The presumption explicitly covers products that lack "the means to log information" required by law. The exit is evidence — a record a rebuttal can be built on. This applies to anyone placing robots on the EU market, wherever you're headquartered.
Four recording duties, one deadline
From 20 January 2027, the Machinery Regulation's Annex III requires machines to:
| Duty | Provision | Retention |
|---|---|---|
| Identify installed safety software "at all times in an easily accessible form" — a live software inventory | Annex III 1.1.9 | Continuous |
| Collect evidence of interventions in that software — "legitimate or illegitimate" — and of configuration changes | Annex III 1.1.9 | Continuous |
| Keep the tracing log of interventions and safety-software versions, producible to a national authority | Annex III 1.2.1(f) | 5 years per upload |
| Record the safety-related decision-making process — for self-evolving and varying-autonomy control systems | Annex III 1.2.1 | 1 year |
The recorder today supplies the evidence for the first three duties — the Machinery-Regulation set. (Discharging them is your conformity assessment's job; 1.1.9's protective-design duties remain yours regardless of any recorder.) Decision-process recording, the learned-policy duty, is the next schema version, with event slots already reserved so it lands additively.
A self-signed changelog arguably meets the letter of these duties — until the first party with an incentive to attack it does. It does not survive the December presumption. The regulation says the diary must exist; it says nothing about whether anyone should believe it. That second property is what we build: hash-chained, countersigned by a neutral registry, anchored to independent timestamp authorities, verifiable by a tool that doesn't need to trust either of us.
Why this installs in a day
The collector publishes to zero command, actuation, or parameter interfaces — a CI guard fails any build containing one — and runs within published resource budgets as a separate, read-only process. No OEM negotiation: ROS 2 fleets install in a day, other stacks connect through the open capture protocol. Your safety team gets the resource budgets and the threat model to work from — whether the safety case reopens is your assessor's call, and our job is to make it an easy one. The liability posture is observation-class, not command-path.
The AI Act then extends the clock: lifetime event logging for high-risk systems, log retention duties on you and your customers, continuous post-market monitoring, and serious-incident reporting on a 15-day clock — 10 days for a death, 2 days for critical-infrastructure disruption. And once an incident is serious, the Act forbids altering the system to investigate before authorities are informed. The only comfortable way to live with that clause is a record that already exists, outside the machine, before the incident.
Start before the deadline does
We run fixed-fee Machinery Regulation readiness assessments for EU-shipping robot manufacturers: a gap analysis of your Annex III 1.1.9 / 1.2.1(f) posture, an evidence-architecture design, and a conformity-evidence plan your notified body and your counsel can work with — grounded in a running reference implementation, not slideware. The assessment is the on-ramp; the recorder and the registry are the product.
Request an assessmentRegulatory characterizations summarized from Regulation (EU) 2023/1230, Directive (EU) 2024/2853, and Regulation (EU) 2024/1689.