The New Ceiling for Physical AI is Certification, Not Capability

The New Ceiling for Physical AI is Certification, Not Capability

A review paper that appeared in Machine Intelligence Research reads, on the surface, like a technical audit of how vision-language models can be fooled. Its commercial significance is larger than its subject matter suggests, because it lands in a market that has quietly changed the question it asks about autonomous machines.

For most of the past decade the binding constraint on robotics was capability, meaning whether a machine could perceive a scene, follow an instruction and complete a task. That constraint is loosening fast. The harder question now is whether a machine can be certified, insured and defended when something goes wrong, and that is a commercial and legal problem rather than a purely technical one.

The survey, produced by researchers at the Institute of Automation of the Chinese Academy of Sciences, University College London, Minzu University of China and the China Academy of Electronics and Information Technology, maps the security and ethical risks that appear when vision-language models and their action-oriented successors guide physical systems. A mistaken description or a manipulated command can become a physical action, and in an autonomous vehicle or an industrial robot that translates into collisions, damaged equipment or failed missions rather than a bad answer on a screen.

That distinction is the whole game for construction and infrastructure, where the machines in question are earthmovers, inspection platforms and site logistics robots operating around people, plant and public assets. The research matters to the sector not because it describes new attacks, but because it explains why the safety of embodied systems cannot be bolted on late, which is precisely the realisation the market is now pricing.

Briefing

• A major review in Machine Intelligence Research argues that the safety of embodied AI cannot be secured by any single filter, and must instead be defended along the whole path from sensor input to physical action.
• NVIDIA launched Halos for Robotics on 22 June 2026, extending its autonomous-vehicle safety architecture to industrial and humanoid robots and adding an inspection lab to help partners reach third-party certification.
• The revised ISO 10218-1:2025 and ISO 10218-2:2025 standards replace the 2011 editions, adding system-level integration, functional safety, cybersecurity and a robot classification scheme.
• Insurers are treating autonomous robots as a distinct underwriting category, with AI exclusions entering general-liability renewals and reinsurers such as Munich Re building dedicated AI performance cover.
• For construction and infrastructure buyers, procurement is shifting from proving a machine works to proving it can be certified, insured and audited before it reaches a live site.

The Clearest Market Signal Comes From NVIDIA

The strongest evidence that the industry has reached this inflection point is where a chip company chose to invest. NVIDIA announced Halos for Robotics on 22 June 2026 as a comprehensive, standardised safety architecture for robots and physical AI systems operating in real-world environments alongside humans, and it did so by extending the safety stack it had already built for autonomous vehicles rather than starting fresh.

The system builds safety into every layer, pairing NVIDIA IGX Thor and Holoscan Sensor Bridge for compute and sensor connectivity with the Halos OS software stack, and adding an AI Systems Inspection Lab to help partners prepare for third-party certification. NVIDIA’s Deepu Talla framed the launch around the view that robotics teams need a unified safety architecture to scale autonomous systems into these environments, a statement that reads less like product marketing and more like an admission that fragmented, self-certified safety no longer scales.

The choice of launch partner tells the same story from the buyer’s side. Agility Robotics became the first company to integrate Halos into its Digit humanoids, which are already deployed with customers including Amazon, GXO, Schaeffler and Toyota Motor Manufacturing Canada. Those are logistics and manufacturing operations with mature safety cultures and real liability exposure, and they will not put an autonomous machine next to a worker on the strength of a demonstration video. The commercial logic is straightforward once it is stated plainly.

A standardised, certifiable safety architecture changes the procurement and liability calculus, because robots that can be certified against international standards by independent third parties are deployable in environments where self-certified systems cannot go. That is the unlock NVIDIA is selling, and it is far more valuable to a fleet operator than another increment of raw capability.

Standards Have Become the Gate, Not the Formality

Certification only carries weight when the standard behind it is credible, and the reference standard for industrial robotics has just been rewritten for the first time in over a decade. The revised ISO 10218-1:2025 and ISO 10218-2:2025 replace the 2011 editions, with Part 1 covering the requirements placed on robot manufacturers and Part 2 covering integrators of robot applications and robot cells. That split matters commercially, because it allocates responsibility across the supply chain in a way insurers and site owners can actually reason about.

The 2025 revision of Part 1 adds requirements for design and operating modes, clarifies functional safety, and introduces cybersecurity requirements to the extent they bear on robot safety, while consolidating the previously separate collaborative-robot guidance from ISO/TS 15066. Cybersecurity now sits inside the core safety standard, which reflects the reality that a cloud-connected autonomous machine is a cyber-physical asset whose digital and physical risks cannot be separated.

Two features of the revision reveal where the emphasis has shifted. Part 1 now defines two classes of industrial robot, with lower-risk Class 1 machines subject to reduced control requirements and Class 2 covering the higher-risk majority, which introduces proportionality into a framework that previously treated all robots alike. Part 2 has roughly tripled in length, with the terms and definitions section expanding from two pages to fifteen and the risk-reduction requirements growing from twenty-eight pages to fifty.

The weight has moved decisively toward integration and system-level assessment, which is the point at which a capable robot becomes a safe deployment or a liability. The market is not short of clever machines. It is short of machines whose integration into a working environment has been documented and validated to a standard that a certifier will sign and an insurer will accept.

The Insurance Reckoning Is Already Under Way

If certification is the gate, insurance is the toll, and the toll booth is being built now. The International Federation of Robotics named safety, cybersecurity and liability among its top trends for 2026, placing the deployment layer alongside the humanoid platforms that attract most of the attention. The investment community has drawn the same conclusion. PitchBook’s Q1 2026 Robotics and Physical AI report found that the diligence bar has changed, with commercial viability now judged on proving a path from lab to deployment rather than on whether the technology works. Capability has become table stakes, and the premium now attaches to demonstrable deployability.

The clearest sign that risk is being repriced is the behaviour of the carriers themselves. Specialty underwriters report that standard cyber and errors-and-omissions wordings increasingly exclude AI outright, with a new general-liability exclusion family arriving at renewals from January 2026, and legal analysts have coined the term “silent AI” for the coverage gap where neither insurer nor insured has established whether a robot-caused injury falls within existing policy language, warning that AI risk is becoming a distinct underwriting category attracting closer scrutiny at renewal.

That gap is a commercial opportunity as much as a hazard. Mosaic Insurance has partnered with Munich Re’s aiSure to cover financial losses when an AI model fails to perform as promised, giving vendors a way to stand behind performance warranties without carrying the liability on their own balance sheets. For any operator planning to run autonomous plant, the practical guidance is now explicit. Buyers are being advised to confirm coverage under general liability, workers’ compensation and cyber policies before deployment, because standard commercial policies may not address robotic systems at all.

What the Research Actually Diagnoses

The value of the Machine Intelligence Research survey is that it explains why the market is behaving this way, and why the fix has to be architectural rather than cosmetic. Its central finding is that no single filter can secure an embodied agent, because failures cascade through the system. Biased training data or a weak visual encoder can make a model describe objects that are not present, forged signs or altered labels can misguide perception, and small adversarial perturbations, hidden backdoor triggers or multimodal jailbreak prompts can bypass safety controls entirely.

Each of these failures can originate in a different layer of the system, which is why patching one component leaves the others exposed. The authors’ organising insight is that protection must follow the entire path from sensor input through model reasoning and system architecture to physical execution.

That conclusion maps almost exactly onto the commercial developments above, which is what gives the paper its editorial weight. A full-stack safety architecture such as Halos exists because a filter added at inference cannot catch a fault that entered at the sensor. A system-level standard such as ISO 10218-2 exists because integration is where isolated safe components combine into unsafe behaviour.

The survey also stresses that a trustworthy machine must recognise when it is uncertain and fall back safely rather than acting with false confidence, which is precisely the behaviour a certifier tests for and an insurer prices. The research reframes safety as a property of the whole deployment, not a feature of the model, and the market has reached the same position from the opposite direction.

Why Construction Sites Are the Hardest Case

The survey carries a warning that should concentrate minds across infrastructure, namely that strong laboratory results may not transfer cleanly to noisy, culturally diverse and resource-constrained environments. Few settings fit that description more precisely than a live construction site. Dust, vibration, changing light, temporary signage, informal hand signals between operators and the constant reconfiguration of the ground plane all conspire to degrade exactly the perception and instruction-following pipelines the paper identifies as fragile.

An autonomous earthmover or an inspection robot that performs flawlessly on a test track is operating in the controlled conditions the researchers explicitly caution against generalising from. The gap between demonstration and deployment is therefore widest in the environments where construction most wants to use these machines.

This is where the commercial and technical strands converge into procurement discipline. No single standard fully covers autonomous deployment today, so buyers are advised to apply the relevant combination of ISO 10218, ISO/TS 15066 and adjacent standards, and to document a risk assessment following ISO 12100 regardless of which specific standards apply.

Recognised marks from testing laboratories such as UL Solutions, TÜV and Intertek remain the fastest signal of conformity for both buyers and insurers, and clear documentation reduces liability exposure and insurer pushback while speeding deployment.

For a contractor or infrastructure owner, the implication is that the winning autonomous supplier will not be the one with the most impressive capability demonstration, but the one that arrives with certification evidence, auditable decision logs and a named accountable human already in place.

Where Value Is Concentrating and What Leaders Should Do

The money is following the permission layer rather than the machines. The vendors establishing whether a robot is allowed to operate without a person standing beside it, spanning cybersecurity, insurance, fleet management software and certification infrastructure, are building assets that hardware makers cannot quickly replicate.

Claims history behind specialty insurance, regulatory accreditation for certification, and multi-vendor orchestration already running in production take years to accumulate, and they compound. That is why a chip company built an inspection lab, why standards bodies spent nearly eight years rewriting ISO 10218, and why reinsurers are creating AI-specific products. The value is migrating from the capability that gets a robot to work toward the assurance that gets it deployed, insured and defended.

For construction, infrastructure and industrial leaders the practical steps are clear enough to act on immediately. Procurement specifications should require conformity to the 2025 ISO 10218 standards, third-party certification evidence rather than self-declaration, and contractual commitments from vendors to maintain compliance as further humanoid-specific standards are ratified.

Insurance arrangements should be confirmed before a machine reaches the site, with explicit attention to the silent-AI gap in existing general-liability and cyber wordings. Above all, the sector should treat the shift from capability to deployability as an advantage rather than an obstacle, because the operators who master certification and insurability first will be able to deploy autonomous plant in environments their competitors cannot yet touch. The research and the market are pointing in the same direction, and the firms that read the signal early will set the terms on which physical AI enters the built environment.

Key Industry Questions

1. What is NVIDIA Halos for Robotics and why does it matter for industrial deployment? Halos for Robotics is a full-stack safety architecture that NVIDIA launched on 22 June 2026, extending the safety stack originally developed for autonomous vehicles to industrial and humanoid robots. It combines industrial-grade compute and sensor connectivity, a dedicated safety operating system, and an inspection lab that helps manufacturers prepare for independent certification. Its commercial importance lies in standardisation. A common, certifiable architecture lets robots be validated against international standards by third parties, which allows deployment in regulated environments where self-certified systems are not accepted. Agility Robotics adopted it first for humanoids already working with Amazon, GXO, Schaeffler and Toyota, which signals that safety architecture, not raw capability, now determines whether serious industrial customers will proceed.
2. What actually changed in ISO 10218:2025, and who does each part apply to? The revision replaces the 2011 editions with ISO 10218-1:2025 for robot manufacturers and ISO 10218-2:2025 for integrators of robot applications and cells. Part 1 adds design and operating-mode requirements, clarifies functional safety, introduces cybersecurity requirements relevant to safety, and defines two robot classes so that lower-risk machines face proportionate controls. Part 2 has grown substantially, with far more detail on integration, risk assessment and system-level safeguarding, reflecting the recognition that integration is where safe components can combine into unsafe behaviour. The collaborative-robot guidance previously held in ISO/TS 15066 has been consolidated into the main standard. The manufacturer-integrator split matters because it allocates responsibility across the supply chain in a way that certifiers and insurers can assess.
3. Why are insurers now treating autonomous robots as a separate underwriting category? Because a robot with a body turns model errors into bodily injury and property damage rather than financial loss, which existing policies were not written to handle. Legal analysts describe a “silent AI” gap where neither insurer nor insured has established whether a robot-caused injury falls within current wording. Standard cyber and errors-and-omissions policies increasingly exclude AI, and a new general-liability exclusion family began appearing at renewals in January 2026. In response, reinsurers such as Munich Re have created dedicated AI performance cover, and specialty underwriters now price on what a machine is permitted to do and what safeguards are enforced in code. Buyers should confirm coverage explicitly before deployment rather than assuming general liability applies.
4. What does the survey mean by cascading failures, and why can they not be patched individually? The research shows that faults in an embodied system originate at different layers and propagate. Biased data or a weak visual encoder can cause hallucinated perceptions, forged signs or altered labels can mislead planning, and adversarial perturbations, backdoor triggers or jailbreak prompts can bypass safety controls. A filter added at one point cannot catch a fault that entered elsewhere, so isolated patches leave the system exposed. The authors argue that protection must follow the whole path from sensor input through reasoning and architecture to physical action. This is the technical reason full-stack safety architectures and system-level standards are winning, and why buyers should be sceptical of safety claims that rest on a single component.
5. How does this affect construction sites specifically? Construction is among the hardest environments for embodied AI because it is exactly the noisy, uncontrolled setting the survey warns against generalising to from laboratory results. Dust, vibration, variable light, temporary signage and constant reconfiguration of the ground degrade the perception and instruction-following pipelines the research identifies as fragile. A machine that performs perfectly on a test track is not proven for a live site. The practical consequence is that certification evidence, documented site-specific risk assessment and auditable decision logs become decisive purchasing criteria. Contractors should expect to apply a combination of standards, document assessments to ISO 12100 methodology, and require vendors to commit to compliance updates as further standards are ratified.
6. Does certification remove liability from the operator? No. Certification and recognised conformity marks reduce liability exposure and speed insurer acceptance, but they do not transfer responsibility away from the deployer. Responsibility is allocated across the chain, with manufacturers accountable under ISO 10218-1, integrators under Part 2, and end users accountable for operation in real conditions. Insurers increasingly expect documented risk assessments, enforced safeguards, incident logging and a named accountable human before they will write cover. Operators should treat certification as necessary evidence rather than a liability shield, maintain their own records, and ensure contracts clearly define which party bears responsibility for which failure mode. The defensible deployment is the one where evidence and accountability are documented from procurement onward.
7. Where is the commercial value concentrating in physical AI? Value is accruing to the permission layer that determines whether a robot may operate autonomously, rather than to the machines themselves. This layer spans certification infrastructure, specialty insurance, cybersecurity and fleet-management software, and its assets, such as claims history, regulatory accreditation and orchestration running in production, take years to build and cannot be bundled quickly by hardware makers. Investment diligence now judges companies on their path from lab to deployment rather than on capability alone. For infrastructure firms, the strategic reading is that competitive advantage will come from mastering certification and insurability early, because that mastery unlocks deployment in regulated, higher-value environments before competitors can follow.

Strategic Takeaways

1. The binding constraint on autonomous machines has moved from whether they can perform a task to whether they can be certified, insured and defended, and procurement specifications should be rewritten around that shift.
2. Full-stack safety architectures and the system-level emphasis of ISO 10218:2025 exist because embodied failures cascade across layers, so buyers should reject safety claims that rest on a single component or an uncertified demonstration.
3. Insurance is repricing physical AI in real time, with AI exclusions entering standard policies and dedicated products emerging, which makes confirming coverage before deployment a commercial necessity rather than an afterthought.
4. Construction sites are the hardest deployment case precisely because they are the uncontrolled environments the research warns against, so certification evidence, documented risk assessment and auditable logs will decide which autonomous suppliers win contracts.
5. The durable value in robotics is concentrating in the permission layer of certification, insurance, cybersecurity and fleet orchestration, and the operators who master deployability first will access regulated, higher-value work that capability-led competitors cannot yet reach.