Humanoid in a campaign: AI Act, GDPR and safety

Booking a humanoid robot for a stand is now routine. You call the provider, agree a date, the machine arrives with an operator. The harder part comes after: who answers for what the robot says, what happens to photos of visitors, who bears the consequences if somebody gets hurt.

The answer is usually uncomfortable for the client. Most duties fall not on the robot's owner, but on the brand or agency that booked it. The provider supplies the machine and the crew. You supply the purpose, place, communication and content.

This article sits on your side of the table and covers four areas: AI Act transparency, photos and video of visitors, advertising law and safety around people. The legal passages describe the position verified on 23 September 2026 and are not legal advice for a specific case.

Who answers for what around the robot

Regulation (EU) 2024/1689, the AI Act, works with two roles. A provider develops an AI system or has it developed and places it on the market under its own name or trademark (Article 3(3)). A deployer uses the system under its own authority (Article 3(4)). At an event the deployer is the brand or agency that brings the robot into its activation. The duty under Article 50(4) therefore sits with you, not the provider. The AI Act in practice covers how the roles split in an ordinary company.

That does not put the provider out of the picture. Ask what actually runs on the robot: a prepared script, remote control or an AI system. At CES 2026 the Unitree robots were still largely remote controlled, and at the Tesla Diner employees confirmed teleoperation. Your sentence to visitors follows from that answer. The same question, machine or human, comes up inside a company, as we discuss in AI in business without chaos.

Inform at the first interaction at the latest

Article 50(1) requires providers to design AI systems meant for direct interaction with people so the person knows they are dealing with an AI system. An exception applies where this is obvious to a reasonably well informed, observant and circumspect person, given the circumstances. The Commission's FAQ reads that exception restrictively. So do not rely on the robot being visible. Article 50(5) adds how to inform. Clearly and distinguishably, at the latest at the first interaction or exposure, and in line with accessibility requirements.

This duty lies with the provider, but on the stand it shows only when someone arranges it. So agree a panel at the entrance to the zone and the same sentence in the robot's opening line. The operator should be able to say it too.

The content the activation produces

As the deployer, under Article 50(4) you must disclose that content is artificially generated or manipulated. This covers image, audio or video content constituting a deep fake. For evidently artistic, creative or satirical work, disclosing its existence without hampering enjoyment of the work is enough. Machine readable marking of outputs under paragraph 2 and system design under paragraph 1 lie with the provider. With a bought solution, check that with the supplier.

Article 50 has applied since 2 August 2026, when the AI Act became generally applicable (Article 113). Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, is in force since 27 July 2026. It postponed the rules for high risk systems but left Article 50 unchanged. The Commission issued transparency guidelines on 20 July 2026. A voluntary code of practice for transparency of AI generated content also exists. Position verified on 23 September 2026.

Photos and video of visitors: two tracks

A robot at the stand is a magnet for phones and the reason you have a photographer there. Legally, two different things.

The first track is the GDPR. The legal basis is consent under Article 6(1)(a) or legitimate interest under Article 6(1)(f). Legitimate interest fails where the interests or fundamental rights of the data subject override it. Article 13(1) sets out what the notice at collection must contain: the identity and contacts of the controller, the contact for the data protection officer, the purposes and the legal basis, and with legitimate interest also what those interests are, plus the recipients and any transfers outside the EU. That belongs on a board at the zone entrance and in a short version for staff.

The second track is Slovak law. It decides whether a shot of a visitor goes into a campaign. Under paragraph 12 of the Slovak Civil Code (Act 40/1964 Zb.), effective from 31 July 2026, a natural person's portrait and image or audio recordings may be made or used only with their permission. Paragraph 12(3) allows proportionate use without permission for scientific and artistic purposes and for press, film, radio and television news reporting. Never, though, against the person's legitimate interests. That list does not mention advertising campaigns, so with a recognisable visitor in shot count on permission. A competition form signed at the stand does nothing about the crowd in the background. Other countries protect a person's image differently, so check the law where the event takes place.

The Slovak data protection authority has no separate guidance on photography at events. On its page about camera systems it warns against disinformation and points to EDPB Guidelines 3/2019 on processing personal data through video devices, adopted 30 January 2020. So there is no Slovak guide for events, the European text applies. Position verified on 23 September 2026.

What Slovak advertising law actually says

A common worry: must an ad with a robot be labelled as made with the help of AI? The Slovak advertising act 147/2001 Z. z., effective from 1 July 2024, contains no such duty. Nor does it require labelling advertising as advertising. Keeping advertising separable binds only broadcasters, under paragraph 84(1) of the Slovak act 264/2022 Z. z. on media services, effective from 18 February 2026. Both acts are Slovak. Other countries regulate advertising and AI labelling differently, so check the rules where the event takes place.

What the act requires touches robot activations where video is shot. Advertising must not contain personal data without the person's prior consent (paragraph 3(1)(g)). It must not use statements of other persons without their prior consent (paragraph 3(1)(h)) or interfere with the rights of others without their consent (paragraph 3(1)(i)). An enthusiastic sentence from a visitor is exactly the statement you need consent for before cutting it into a spot.

Residual supervision falls to the Slovak Trade Inspection (paragraph 10). A breach of paragraph 3(1)(d) to (j) carries a fine from 300 euros up to 4% of turnover, capped at 100,000 euros (paragraph 11(3)(c)). Position verified on 23 September 2026.

Safety around people: standards nobody wrote for this case

This is the part most offers skip. None of the three standards commonly cited for robots was written for a humanoid among visitors.

ISO 13482:2014 sets safety requirements for personal care robots: mobile servant robots, physical assistants and person carrier robots. It is published, confirmed in 2020 and expected to be replaced by ISO/FDIS 13482. Its own text says there is no exhaustive, internationally recognised data for impact risks.
ISO 10218-1:2025 and ISO 10218-2:2025 expressly cover industrial robots, their applications and cells.
ISO/TS 15066:2016 applies to industrial robot systems under ISO 10218. It says itself that it does not cover non industrial robots, though its principles may help. Revision is due.

Practical consequence: nobody will hand you a certificate that the machine is safe for a crowd. What remains is an assessment of the specific space and scenario. Not a theoretical worry: at CES 2025 a G1 humanoid hit a visitor at the Unitree stand after the operator accidentally switched on full power.

The machinery framework is changing right now. Regulation (EU) 2023/1230 applies from 14 January 2027 (Article 54). Directive 2006/42/EC is repealed that day (Article 51(2)) and applies until then. Making available on the market covers any supply for distribution or use in a commercial activity, for payment or free of charge, so renting falls under it. Technical documentation, conformity assessment, the EU declaration of conformity and CE marking are the manufacturer's job before the machine goes on the market or into service. We did not verify whether a given unit has that documentation, so ask.

In Slovakia operational responsibility lies with the employer and the equipment operator. Under paragraph 6(1)(c) of the Slovak act 124/2006 Z. z., hazards must be identified and a written risk assessment drawn up for employees' activities. It covers the operator and stand staff, not visitors. The Slovak government regulation 392/2006 Z. z. sets minimum safety requirements for using work equipment, including the danger zone and the duty to adapt equipment to the work done. The danger zone is where your boundary for people around the robot comes from. Occupational safety rules differ by country, so check what applies where the event takes place. Position verified on 23 September 2026.

What to agree before you sign

Go through this list before the contract and keep answers in writing. If you book through an agency, go through it twice, with the agency and the provider.

Who the operator is and what they do. Their role, their place during the activation, what they can stop. With the robot at an event service the operator comes along, but still clarify who controls it on the day.
What runs on the robot. A prepared script, remote control, an AI system or a combination. Without it you cannot write the sentence you say to people.
Who informs visitors and how. The wording, where the panel stands, the robot's opening line and who says it out loud. Clearly, distinguishably, at the first interaction at the latest.
The filming notice and the permissions. Who prepares it, who is the data controller and who collects permission to use footage in the campaign. A separate form for anyone recognisable.
The safety zone and the risk assessment. Its size, how it is marked, who guards it and who draws up the written risk assessment for activities inside.
Documentation for the machine. Ask for the EU declaration of conformity, the CE marking and the instructions for use, and agree who keeps them on site.
Who answers for what. A contract clause splitting responsibility for operating the machine, informing visitors, personal data and the content that goes into the campaign.

For a supplier this is an ordinary conversation that a good provider does not avoid. Humanoid robot rental in Slovakia is offered by robotrental.sk, our client, whose website we built. The machines and their parameters are on the humanoid robot models page.

What to take away

If an AI system runs on the robot, you are its deployer, so under Article 50(4) you disclose that content is artificially generated or manipulated. System design under paragraph 1 and machine readable marking of outputs under paragraph 2 lie with the provider.
Inform clearly and distinguishably at the first interaction at the latest. The exception for obvious cases is read restrictively, says the Commission.
Handle photos and video twice: the GDPR information duty when filming, and permission under paragraph 12 of the Slovak Civil Code when the shot goes into a campaign.
Slovak advertising law requires no AI labelling, but it bans personal data and statements of other persons without prior consent. The Slovak Trade Inspection supervises it.
None of the commonly cited ISO standards was written for a humanoid in a crowd. What remains is the zone, the written risk assessment and the split of responsibility in the contract. The position was verified on 23 September 2026, so have a lawyer in the event's country confirm it before you sign.